The City of Cambridge has transitioned to a new, more secure CodeRED by Crisis24 platform following a nationwide cyberattack on the old system that exposed user data. Residents are urged to reset their passwords and enhance their cybersecurity measures to stay protected. #OnSolveCodeRED #Crisis24Security…
Category: Cyber Security News
Microsoft has expanded its bug bounty program to include all online services and third-party components, making vulnerability reporting more comprehensive. This change aims to improve security by incentivizing researchers to identify flaws across the entire Microsoft ecosystem, including open-source and external dependencies. #MicrosoftBugBounty #ThirdPartyVulnerabilities…
LastPass UK Ltd was fined £1.2 million by the ICO after a 2022 data breach exposed personal information of 1.6 million UK customers. Despite using zero knowledge encryption, the breach highlighted vulnerabilities in employee device security and system safeguards. #LastPass #DataBreach #ICO #CybersecurityLessons…
A malicious campaign involving 19 VSCode extensions exploited the platform by hiding malware within dependency folders, with malicious code embedded in popular npm packages like ‘path-is-absolute.’ Security researchers found these extensions used obfuscated scripts and hosted dangerous binaries, prompting Microsoft to remove them. #VSCodeExtensions #SupplyChainAttacks
Notepad++ version 8.8.9 was updated to fix a security vulnerability involving hijacked update processes and malicious executables. Threat actors targeted the update mechanism, potentially leading to remote access breaches, especially in East Asian organizations. #NotepadPlusPlus #WinGUpSecurity #EastAsiaThreats
Hackers are exploiting a previously undocumented cryptographic vulnerability in Gladinet’s CentreStack and Triofox products, leading to remote code execution and access to sensitive information. Gladinet has issued updates and indicators of compromise to help organizations defend against ongoing attacks. #Gladinet #CentreStack #Triofox #cryptovulnerability #remotecodeexecution
Microsoft expands its bug bounty program to include all online services and third-party dependencies, incentivizing security research on critical vulnerabilities. This initiative aims to enhance safety across Microsoft’s ecosystem, supported by significant bounty payouts and aligned with their Secure Future strategy. #MicrosoftSecurityResponseCenter #BugBountyProgram
LastPass security breach exposed personal data and encrypted vaults of up to 1.6 million UK users, leading to a £1.2 million fine by the ICO. The attack involved a compromised employee device, malware deployment, and theft of cloud backup data, highlighting the importance of strong security measures and passwords. #LastPass #ICO #PasswordSecurity
An anonymous hacker group claimed responsibility for breaching a Russian tech company’s servers linked to the military registration database. The hackers leaked internal documents and stated they had maintained access for months, raising concerns about data security and government transparency. #Mikord #RussianMilitaryDatabase…
Federal agencies must now patch the React2Shell vulnerability (CVE-2025-55182) by December 26, with increased urgency due to widespread exploitation. Cybercriminal groups and nation-state hackers actively target affected organizations across various sectors, including finance, media, and government. #React2Shell #CISA #CyberThreats…
A new Android malware called DroidLock targets Spanish-speaking users with a phishing campaign that installs ransomware-like functionalities, locking phones and threatening data loss. The malware can exploit device administrator privileges, modify security settings, and secretly record user activity, posing serious privacy and security risks. #DroidLock #AndroidMalware #Phishing #Ransomware…
The Cyber AI & Automation Summit is a two-day event focusing on AI-driven cybersecurity challenges and solutions. Attendees can access sessions on identity fraud, LLM vulnerabilities, AI sprawl, and private AI deployment security. #CyberAI2025 #AdversarialAI…
The UK’s NCSC study highlights the potential of honeypots and cyber deception tools to improve threat detection and disrupt cyberattacks, though handling and standardization are needed for broader adoption. The agency emphasizes that effective implementation requires clear strategies, proper configuration, and standardized terminology to maximize benefits. #ActiveCyberDefence #CyberDeception…
An unpatched zero-day vulnerability in Gogs, a self-hosted Git service, has allowed threat actors to execute remote code and compromise over 700 servers. The attack exploits a path traversal weakness using symbolic links in the PutContents API, leading to potential system control and data overwriting risks. #Gogs #CVE-2025-8110
AI-powered cyberattacks are evolving rapidly, utilizing automation and machine learning to bypass traditional defenses and execute complex, large-scale operations. Network Detection & Response (NDR) systems, like Corelight, are crucial in detecting and counteracting these sophisticated threats through real-time network analysis and behavioral insights. #ScatteredSpider #AIOrchestration