> TODAY'S SUMMARY (8 articles)
Today's cyber news highlights significant threats and vulnerabilities. The FBI has seized $1.2 billion in cryptocurrency linked to North Korean hackers, who are also implicated in a $400 million social engineering scheme. This operation involved using video call deception to trick victims. In software security, several vulnerabilities in Ubuntu products have been addressed, including fixes for x11vnc's insecure shared memory permissions, TigerVNC's server impersonation risks, and the signing-party's potential for executing malicious commands via crafted OpenPGP keys. Additionally, updates for SA-Exim and Ruby OpenID have been released to mitigate risks of unsafe rule evaluations and server-side request forgery, respectively.
|
// AI-powered summary generated at 04:01
CISA Warns of Google Chrome 0-Day Vulnerability Exploited in Attacks CISA has added CVE-2025-13223, a zero day vulnerability in Google Chrome’s V8 engine, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw allows attackers to execute arbitrary code through...
Oxygen Remote Explorer 2.0 introduces major updates—including new iOS collections, Android triage, and macOS support—to streamline and strengthen remote digital investigations.
Researchers demonstrated a now-patched vulnerability that could have been used to enumerate all WhatsApp accounts.
The post Vulnerability Allowed Scraping of 3.5 Billion WhatsApp Accounts appeared first on SecurityWeek.
GlobalProtect login endpoints targeted, sparking concern that something bigger may be brewing Malicious traffic targeting Palo Alto Networks' GlobalProtect portals surged almost 40-fold in the space of 24 hours, hitting a 90-day high and putting defenders on alert for whatever comes next.…
CTM360 has identified a rapidly expanding WhatsApp account-hacking campaign targeting users worldwide via a network of deceptive authentication portals and impersonation pages. The campaign, internally dubbed HackOnChat, abuses WhatsApp’s familiar web interface, using social engineering tactics to t...
What is an SSL Certificate? An SSL certificate is a digital file that verifies a website’s identity and establishes an encrypted connection between the server and a web browser. An SSL certificate allows for the safe transmission of sensitive data, including usernames and passwords, payment informat...
Cybersecurity researchers have disclosed details of a new Android banking trojan called Sturnus that enables credential theft and full device takeover to conduct financial fraud.
"A key differentiator is its ability to bypass encrypted messaging," ThreatFabric said in a report shared with The Hacker...
The founders of the Samourai Wallet (Samourai) cryptocurrency mixing service have been sent to prison for helping criminals launder over $237 million. [...]
Amped Software rolls out a stronger, sleeker Authenticate update that speeds deepfake triage, boosts first-look analysis, and delivers clearer, more defensible reporting.
A proof-of-concept (PoC) exploit targeting the high-severity remote code execution (RCE) bug exists.
The post Recent 7-Zip Vulnerability Exploited in Attacks appeared first on SecurityWeek.
A technical manager at a Dutch wind farm operator has been sentenced after it was discovered he had secretly installed cryptocurrency mining rigs at two wind farm sites - just as the company was recovering from a ransomware attack.
Read more in my article on the Hot for Security blog.
Iran-linked actors mapped ship AIS data ahead of a missile strike attempt, highlighting the rise of cyber operations enabling real-world attacks. Iran-linked threat actors mapped ship Automatic Identification System (AIS) data shortly before an attempted missile strike, showing how Tehran-aligned gr...
Gartner predicts that two-fifths of organizations will suffer security and compliance incidents due to shadow AI by 2030
Generative AI is making it even easier for attackers to exploit old and often forgotten network equipment. Replacing it takes investment, but Cisco is making the case that it’s worth it.
A new Android banking trojan named Sturnus can capture communication from end-to-end encrypted messaging platforms like Signal, WhatsApp, and Telegram, as well as take complete control of the device. [...]
Here’s how open-source intelligence helps trace your digital footprint and uncover your weak points, plus a few essential tools to connect the dots
Allies sanction bulletproof hoster Media Land and four executives
Bedrock Data announced Bedrock Data ArgusAI and Natural Language Policy. ArgusAI is a new product that expands the company’s capabilities into artificial intelligence governance. It allows enterprises to understand what data their AI models and agents access during training and inference, and evalua...
Stop the press - a company has actually said "sorry" after a data breach, and hotels are helping hackers phish their own guests.
We examine a refreshingly honest breach response (and why legacy systems are still going to ruin your week), dig into a nasty hotel-booking malware campaign that abuses...
Originally published at Regulatory Landscape: DMARC, GDPR, DORA & What Businesses Need to Know in 2025 by Amanda E. Clark.
In 2025, compliance is key to remaining in ...
The post Regulatory Landscape: DMARC, GDPR, DORA & What Businesses Need to Know in 2025 appeared first on EasyDMARC.
The p...