πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ–‹οΈ Simple Steps for Attack Surface Reduction πŸ–‹οΈ

Story teaser text Cybersecurity leaders face mounting pressure to stop attacks before they start, and the best defense may come down to the settings you choose on day one. In this piece, Yuriy Tsibere explores how default policies like denybydefault, MFA enforcement, and application Ringfencing can eliminate entire categories of risk. From disabling Office macros to blocking outbound server.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
❀1
πŸ–‹οΈ Google Fined $379 Million by French Regulator for Cookie Consent Violations πŸ–‹οΈ

The French data protection authority has fined Google and Chinese ecommerce giant Shein 379 million 325 million and 175 million 150 million, respectively, for violating cookie rules. Both companies set advertising cookies on users' browsers without securing their consent, the National Commission on Informatics and Liberty CNIL said. Shein has since updated its systems to comply with.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited πŸ–‹οΈ

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Wednesday added two security flaws impacting TPLink wireless routers to its Known Exploited Vulnerabilities KEV catalog, noting that there is evidence of them being exploited in the wild. The vulnerabilities in question are listed below CVE202350224 CVSS score 6.5 An authentication bypass by spoofing vulnerability.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” GhostRedirector Emerges as New China-Aligned Threat Actor πŸ“”

A newly identified hacking group named GhostRedirector has compromised 65 Windows servers using previously unknown tools.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” North Korean Hackers Exploit Threat Intel Platforms For Phishing πŸ“”

North Korean hackers have been observed exploiting cyber threat intelligence platforms in a campaign targeting job seekers with malwarelaced lures.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” CMS Provider Sitecore Patches Exploited Critical Zero Day πŸ“”

Google Clouds Mandiant successfully disrupted an active ViewState deserialization attack affecting Sitecore deployments.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” US and 14 Allies Release Joint Guidance on Software Bill of Materials πŸ“”

The joint guidance is a welcome first step towards a common, global adoption of SBOMs, experts argued.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” Scattered Spider-Linked Group Claims JLR Cyber-Attack πŸ“”

JLR said it is investigating following claims by the actor Scattered Lapsus Hunters that it had stolen data from the firm and had issued an extortion demand.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” Threat Actors Abuse Hexstrike-AI Tool to Accelerate Exploitation πŸ“”

Hackers are using legitimate red team tool HexstrikeAI to simplify and speed up vulnerability exploitation.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” Healthcare Sector Takes 58 Days to Resolve Serious Vulnerabilities πŸ“”

A new Cobalt study finds healthcare organizations among the slowest at resolving serious vulnerabilities.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
🌊 Exabeam vs. The Field: 2025’s AI SOC Comparison 🌊

Looking for Exabeam alternatives? High pricing at scale, SIEM baggage that never goes away, and blind spots in SaaS and identity are all legit reasons to shop around. Either way, there are lots of options for you. AI SOC startups are popping up like mushrooms after rain. Investment is flowing, promises are loud. But when The post Exabeam vs. The Field 2025s AI SOC Comparison appeared first on UnderDefense.

πŸ“– Read more.

πŸ”— Via "UnderDefense"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸš€ GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes πŸš€

ESET researchers have identified a new threat actor targeting Windows servers with a passive C backdoor and a malicious IIS module that manipulates Google search results.

πŸ“– Read more.

πŸ”— Via "ESET - WeLiveSecurity"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ¦… The Week in Vulnerabilities: Apple, Citrix Flaws Draw Threat Actor Interest πŸ¦…

IT Vulnerabilities Recorded by Cyble " dataimagecaption"" datamediumfile"httpscyble.comwpcontentuploads202509ITVulnerabilitiesRecordedbyCyble300x150.webp" datalargefile"httpscyble.comwpcontentuploads202509ITVulnerabilitiesRecordedbyCyble.webp" title"The Week in Vulnerabilities Apple, Citrix Flaws Draw Threat Actor Interest 1" Cyble Vulnerability Intelligence researchers tracked 787 vulnerabilities in the last week, and more than 229 of the disclosed vulnerabilities already have publicly available ProofsofConcept PoCs. The exploitation rate just under 30 is at the high end of the 2030 range observed by Cyble in recent weeks.  A total of 56 vulnerabilities were rated as critical under CVSS v3.1, while 43 received a critical severity rating based on the newer CVSS v4.0 scoring system....

πŸ“– Read more.

πŸ”— Via "CYBLE"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ VirusTotal Finds 44 Undetected SVG Files Used to Deploy Base64-Encoded Phishing Pages πŸ–‹οΈ

Cybersecurity researchers have flagged a new malware campaign that has leveraged Scalable Vector Graphics SVG files as part of phishing attacks impersonating the Colombian judicial system. The SVG files, according to VirusTotal, are distributed via email and designed to execute an embedded JavaScript payload, which then decodes and injects a Base64encoded HTML phishing page masquerading as a.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
❀1
πŸ–‹οΈ Automation Is Redefining Pentest Delivery πŸ–‹οΈ

Pentesting remains one of the most effective ways to identify realworld security weaknesses before adversaries do. But as the threat landscape has evolved, the way we deliver pentest results hasn't kept pace. Most organizations still rely on traditional reporting methodsstatic PDFs, emailed documents, and spreadsheetbased tracking. The problem? These outdated workflows introduce delays,.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” 61% of US Companies Hit by Insider Data Breaches πŸ“”

The OPSWAT report found that insider breaches cost impacted firms 2.7m on average due to factors such as regulatory fines and diminished productivity.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
❀1
πŸ“” US and 14 Allies Release Joint Guidance on Software Bill of Materials πŸ“”

The joint guidance is a welcome first step towards a common, global adoption of SBOMs, experts argued.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ SAP S/4HANA Critical Vulnerability CVE-2025-42957 Exploited in the Wild πŸ–‹οΈ

A critical security vulnerability impacting SAP S4HANA, an Enterprise Resource Planning ERP software, has come under active exploitation in the wild. The command injection vulnerability, tracked as CVE202542957 CVSS score 9.9, was fixed by SAP as part of its monthly updates last month. "SAP S4HANA allows an attacker with user privileges to exploit a vulnerability in the function module.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
🚨 NCSC statement: Incident impacting Jaguar Land Rover 🚨

Statement from the NCSC regarding the cyber incident affecting Jaguar Land Rover.

πŸ“– Read more.

πŸ”— Via "UK NCSC"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” macOS Stealer Campaign Uses β€œCracked” App Lures to Bypass Apple Security πŸ“”

Trend Micro observed the attackers using terminalbased installation methods for the AMOS malware, luring macOS users into installing cracked versions of apps.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
🌊 Dropzone AI Against 11 Rivals: AI SOC Showdown 2025 🌊

Running a Tesla on autopilot in LA is fine. In a warzone, though? Youd not give it a chance. Yet some companies switch cybersecurity onto autopilot with AI SOC, reducing human oversight to zero.   One of those AI SOC startups is Dropzone AI, but rivals are lining up. Lets see which Dropzone AI competitors are The post Dropzone AI Against 11 Rivals AI SOC Showdown 2025 appeared first on UnderDefense.

πŸ“– Read more.

πŸ”— Via "UnderDefense"

----------
πŸ‘οΈ Seen on @cibsecurity