Security Affairs

JANUARY 12, 2024

Researchers published a proof-of-concept (PoC) code for the recently disclosed critical flaw CVE-2023-51467 in the Apache OfBiz. Researchers from cybersecurity firm VulnCheck have created a proof-of-concept (PoC) exploit code for the recently disclosed critical flaw CVE-2023-51467 (CVSS score: 9.8) in the Apache OfBiz.

Honeypots 360

Honeypots Authentication Libraries Passwords 360

Security Affairs

MARCH 28, 2024

Google’s Threat Analysis Group (TAG) and Mandiant reported a surge in the number of actively exploited zero-day vulnerabilities in 2023. In 2023, Google (TAG) and Mandiant discovered 29 out of 97 vulnerabilities exploited in the wild. ” continues the report. ” concludes the report.

Government 349

Government Ransomware Libraries Access 349

Security Affairs

FEBRUARY 4, 2025

Netgear addressed two critical vulnerabilities, internally tracked as PSV-2023-0039 and PSV-2021-0117 , impacting multiple WiFi router models and urged customers to install the latest firmware. Netgear disclosed two critical flaws impacting multiple WiFi router models and urges customers to address them. ” reads the advisory.

Authentication 274

Authentication Security IT Information Security 274

Security Affairs

JANUARY 31, 2025

Security researchers from Michelin CERT and Abicom, including Maxime Escourbiac, Yassine Bengana, and Quentin Ebel, detected and reported the vulnerabilities. The vulnerability CVE-2023-34051 (CVSS score 8.1) Updated VMSA to note that VMware has confirmed that exploit code for CVE-2023-34051 has been published.

Authentication 266

Authentication Cloud Cybersecurity Access 266

Security Affairs

DECEMBER 19, 2024

Fortinet warned of a now-patched Wireless LAN Manager (FortiWLM) vulnerability, tracked as CVE-2023-34990 (CVSS score of 9.6), that could lead to admin access and sensitive information disclosure. ai security researcher Zach Hanley (@hacks_zach) reported this vulnerability to Fortinet. through 8.6.5 Fixed in 8.6.6 through 8.5.4

Authentication 264

Authentication Education Access IT 264

Security Affairs

OCTOBER 12, 2024

Since April 2021, Russian state-sponsored hackers have exploited vulnerabilities, including Zimbra’s CVE-2022-27924 for injecting commands to access credentials and emails, and JetBrains TeamCity’s CVE-2023-42793 for arbitrary code execution through an authentication bypass. cyber agencies warned.

Data collection 342

Data collection Authentication Access Cybersecurity 342

Security Affairs

NOVEMBER 13, 2024

In May 2023, Microsoft reported that the Volt Typhoon APT infiltrated critical infrastructure organizations in the U.S. In December 2023, the Black Lotus Labs team at Lumen Technologies linked a small office/home office (SOHO) router botnet, tracked as KV-Botnet to the operations of China-linked threat actor Volt Typhoon.

e-Discovery 308

e-Discovery Communications Ransomware Government 308

Security Affairs

JUNE 7, 2024

The campaign seems to have been active since at least October 2023, it initially targeted a limited number of customers/organizations but recently became widespread. Akamai researchers observed a Chinese threat actor exploiting two old remote code execution vulnerabilities, tracked as CVE-2018-20062 and CVE-2019-9082 , in ThinkPHP.

File names 343

File names Passwords Access Cloud 343

Security Affairs

JANUARY 16, 2025

The law firm Wolf Haldenstein disclosed a 2023 data breach that exposed the personal information of nearly 3.5 The security breach occurred on December 13, 2023, but the company discovered the incident only on April 18, 2024, and has only now disclosed it due to the complexity of the digital forensic investigation.

Data breaches 241

Data breaches Data collection Data Privacy Cybersecurity 241

Security Affairs

MAY 25, 2024

The MITRE Corporation revealed that threat actors behind the December 2023 attacks created rogue virtual machines (VMs) within its environment. The MITRE Corporation has provided a new update about the December 2023 attack. In April 2024, MITRE disclosed a security breach in one of its research and prototyping networks.

Communications 321

Communications Risk Access Security 321

The Last Watchdog

DECEMBER 16, 2024

Raising security baselines across industries is essential, with risk mitigationnot acceptancebecoming the standard. Salzman Shirley Slazman , CEO, SeeMetrics In 2025, organizations will recognize that adding more tools doesnt equate to better security. Attackers arent hacking in theyre logging in.

Security 264

Security Phishing IoT Risk 264

Security Affairs

APRIL 3, 2025

Ivanti addressed a critical remote code execution flaw in Connect Secure, which has been exploited since at least mid-March 2025. Ivanti released security updates to address a critical Connect Secure remote code execution vulnerability tracked as CVE-2025-22457. The flaw impacts Ivanti Connect Secure (version 22.7R2.5

Security 166

Security Cybersecurity IT Information Security 166

Security Affairs

MAY 9, 2024

Threat actors exploit recently disclosed Ivanti Connect Secure (ICS) vulnerabilities to deploy the Mirai botnet. Researchers from Juniper Threat Labs reported that threat actors are exploiting recently disclosed Ivanti Connect Secure (ICS) vulnerabilities CVE-2023-46805 and CVE-2024-21887 to drop the payload of the Mirai botnet.

Security 337

Security Authentication Ransomware Access 337

Security Affairs

FEBRUARY 5, 2024

According to Bleeping Computer , the company has yet to find any evidence suggesting a new security breach. HPE became aware of the intrusion on December 2023 and immediately launched an investigation into the security breach with the help of external cybersecurity experts. Securities and Exchange Commission (SEC).

Security 351

Security Data breaches Cybersecurity Access 351

Security Affairs

DECEMBER 23, 2024

The decision stems from a March 2023 investigation and aligns with the EDPB’s guidance on AI-driven services and personal data processing. ” reads the press release published by Italy’s Garante.

Artificial Intelligence 269

Artificial Intelligence Personal data Data collection Privacy 269

The Last Watchdog

OCTOBER 23, 2024

22, 2024, CyberNewswire — INE Security offers essential advice to protect digital assets and enhance security. Warn “Small businesses face a unique set of cybersecurity challenges and threats and must be especially proactive with cybersecurity training,” said Dara Warn, CEO of INE Security. “At Cary, NC, Oct.

Security 162

Security Data breaches Passwords Cybersecurity 162

Security Affairs

DECEMBER 5, 2024

Security Operations Center (SOC) analyst burnout is a very real problem. Amidst an already overstretched cybersecurity workforce— ISC2 estimated in 2023 that there was a 4 million gap between supply and demand—it’s enormously important that we address this problem. And right now, they’re not.

Cybersecurity 340

Cybersecurity Artificial Intelligence Risk Data collection 340

Security Affairs

JANUARY 24, 2025

Earliest evidence dates to September 2023, but the experts have yet to determine the initial access method. Lumen experts also mentioned another variant of cd00r, codenamed SEASPY , that was used in a campaign targeting Barracuda Email Security Gateway (ESG) appliances that dates back in 2022. ” concludes the report.

Encryption 304

Encryption Access Security IT 304

Security Affairs

OCTOBER 25, 2024

OPPC reported to the US Department of Health and Human Services that the security incident impacted 795916 individuals. The company started its incident response procedure to contain the incident with the help of a forensic security firm. ” reads the notice of Data Security Incident published by the company on its website.

Data breaches 324

Data breaches Ransomware Security IT 324

Security Affairs

OCTOBER 11, 2024

OpenAI disrupted 20 cyber and influence operations in 2023, revealing Iran and China-linked actors used ChatGPT for planning ICS attacks. These scripts sometimes leveraged publicly available pentesting tools and security services to programmatically find vulnerable infrastructure.” ” reads the OpenAI’s report.

Phishing 342

Phishing Passwords Security IT 342

Krebs on Security

NOVEMBER 1, 2024

In an email to KrebsOnSecurity, booking.com confirmed one of its partners had suffered a security incident that allowed unauthorized access to customer booking information. “2FA is required and enforced, including for partners to access payment details from customers securely,” a booking.com spokesperson wrote.

Phishing 260

Phishing Artificial Intelligence Authentication Cloud 260

Security Affairs

JANUARY 4, 2025

According to OFAC, between 2022 and 2023, Flax Typhoon hacked U.S. The botnet has been active since at least May 2020, reaching its peak with 60,000 compromised devices in June 2023. and European entities, exploiting VPNs and RDPs, including a California-based organization’s servers.

Cybersecurity 308

Cybersecurity IoT Risk IT 308

Security Affairs

NOVEMBER 3, 2024

Quad7 botnet, also known as CovertNetwork-1658 or xlogin, was first spotted in the summer of 2023 by security researcher Gi7w0rm. Microsoft has notified affected customers and shared details on CovertNetwork-1658, Storm-0940 tactics, and recommended mitigations to help secure affected environments.

Passwords 334

Passwords Access Cloud Government 334

Security Affairs

OCTOBER 14, 2024

The Bohemia marketplace ceased operations in late 2023 due to service disruptions, while its members suspected an exit scams of a rogue developer. At the time of its shut down, Bohemia hosted 82,000 daily ads and handled around 67,000 transactions monthly, with a turnover of €12 million in September 2023 alone.

Marketing 317

Marketing IT Information Security Security 317

Data Breach Today

OCTOBER 30, 2024

NY AG Action and $1M Fine Follow Back-to-Back Hacks That Affected 224,500 in 2023 An upstate New York-based medical practice must spend $2.25

Security 286

Security Ransomware IT 286

Security Affairs

FEBRUARY 24, 2025

TopSec is also a Tier 1 vulnerability supplier for China’s intelligence ministry and has provided cloud and IT security monitoring services nationwide since 2004. The data leak includes infrastructure details and work logs from employees of a state-affiliated private sector security firm in China. ” concludes the report.”The

Cybersecurity 247

Cybersecurity Government Cloud Security 247

Security Affairs

AUGUST 14, 2024

Patch Tuesday security updates for August 2024 addressed 90 vulnerabilities in Microsoft products including Windows and Windows Components; Office and Office Components; NET and Visual Studio; Azure; Co-Pilot; Microsoft Dynamics; Teams; and Secure Boot and others, bringing the total to 102 when including third-party bugs.

Security 352

Security IT Information Security 352

Security Affairs

MARCH 12, 2024

Microsoft Patch Tuesday security updates for March 2024 addressed 59 security vulnerabilities in its products, including RCE flaws. Microsoft released Patch Tuesday security updates for March 2023 that address 59 security vulnerabilities in its products. ” reported ZDI.

Security 342

Security Authentication Access IT 342

Security Affairs

FEBRUARY 8, 2024

26 key cyber security stats for 2024 that every user should know, from rising cyber crime rates to the impact of AI technolog y. Ransomware Attacks: In 2023, a whopping 72.7% Data Breach Costs: The average global cost of a data breach in 2023 was $4.45 Market Growth: AI cyber security technology is projected to grow by 23.6%

Security 355

Security Phishing IoT Ransomware 355

Security Affairs

JANUARY 9, 2025

Medusind, a medical billing provider, disclosed a data breach that occurred in December 2023 and affected over 360,000 individuals. The company disclosed a data breach discovered on December 29, 2023, that impacted 360,934 individuals. “On December 29, 2023, Medusind discovered suspicious activity within its IT network.

Data breaches 179

Data breaches Insurance Ransomware Information governance 179

Security Affairs

DECEMBER 4, 2024

The alert provides Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IOCs) obtained from law enforcement investigations and reports from third-party security firms. reads the CSA. According to the experts, the ransomware gang has infected over 329 victims, including ABB , Capita , Dish Network , and Rheinmetall.

Ransomware 315

Ransomware Blockchain Insurance Data breaches 315

Krebs on Security

DECEMBER 19, 2024

The makers of Acunetix, Texas-based application security vendor Invicti Security , confirmed Silent Push’s findings, saying someone had figured out how to crack the free trial version of the software so that it runs without a valid license key. According to an August 2023 report (PDF) from the U.S. Image: Ke-la.com.

IT 229

IT Data breaches Cloud Passwords 229

Security Affairs

AUGUST 30, 2024

The critical vulnerability CVE-2023-22527 (CVSS score 10.0) 5, 2023 as well as 8.4.5 which no longer receives backported fixes in accordance with our Security Bug Fix Policy. “With its continuous exploitation by threat actors, CVE-2023-22527 presents a significant security risk to organizations worldwide.

Mining 343

Mining Cloud Risk Security 343

Security Affairs

NOVEMBER 6, 2024

Canada ordered ByteDance to shut down TikTok operations over security concerns but did not issue a full ban on the platform. The government is taking action to address the specific national security risks related to ByteDance Ltd.’s The Canadian government ordered ByteDance to wind up TikTok Technology Canada, Inc.

Security 296

Security Government Risk Data collection 296

Security Affairs

AUGUST 10, 2024

In November 2023, McLaren Health Care (McLaren) disclosed a data breach that occurred between late July and August 2023. The security breach exposed the sensitive personal information of 2,192,515 people. The INC RANSOM has been active since 2023, it claimed responsibility for the breach of tens of organizations to date.

Ransomware 332

Ransomware Insurance Data breaches Access 332

Security Affairs

MARCH 1, 2024

Cybersecurity and Infrastructure Security Agency (CISA) adds a Microsoft Streaming Service vulnerability to its Known Exploited Vulnerabilities catalog. Cybersecurity and Infrastructure Security Agency (CISA) added the CVE-2023-29360 (CVSS Score 8.4)

IT 350

IT Cybersecurity Risk Security 350