Enterprise software maker SAP documents multiple critical-severity issues and warns of risk of command injection attacks.
The post SAP Patches Critical Command Injection Vulnerabilities appeared first on SecurityWeek….
A threat actor has purportedly disclosed the database of Gobierno del Estado (Quintana Roo) – qroo.gob.mx, raising concerns about the potential exposure of sensitive information. The leaked data reportedly includes access to cameras, credentials for interns and users, phone numbers, IMEI contracts,…
The Tor Project officially introduced WebTunnel, a new bridge type specifically designed to help bypass censorship targeting the Tor network by hiding connections in plain sight. […]…
Xehook Stealer is a .NET Windows stealer discovered in January 2024 that supports dynamic collection from Chromium-based browsers, targets 110+ cryptocurrency and 2FA extensions, and is commonly distributed via SmokeLoader. Analysis links Xehook to the Agniane…
Google awarded $10 million to 632 researchers from 68 countries in 2023 for finding and responsibly reporting security flaws in the company’s products and services. […]…
Japanese cybersecurity officials issued a warning that North Korea’s infamous Lazarus Group hacking group recently launched a supply chain attack on the PyPI software repository for Python apps. Threat actors disseminated contaminated packages with names like “pycryptoenv” and “pycryptoconf” th…
GitHub users accidentally exposed 12.8 million authentication and sensitive secrets in over 3 million public repositories during 2023, with the vast majority remaining valid after five days. […]…
Siemens and Schneider Electric publish March 2024 Patch Tuesday advisories to inform customers about over 200 vulnerabilities.
The post ICS Patch Tuesday: Siemens Ruggedcom Devices Impacted by 45 Fortinet Vulnerabilities appeared first on SecurityWeek….
Identifying the who, what, and how behind a cyberattack is crucial for preventing future strikes….
In the digital society, defenders are grappling with the transformative impact of artificial intelligence (AI), automation, and the rise of Cybercrime-as-a-Service. Recent research commissioned by Darktrace reveals that 89% of global IT security teams believe AI-augmented cyber threats will signific…
FortiGuard Labs analyzed a phishing campaign that delivers a malicious Java downloader which fetches and runs VCURMS and STRRAT Java RATs, with components hosted on public services (AWS/GitHub) and protected by commercial obfuscators. The malware uses email (P…
GAO study finds that CISA does not have enough staff to respond to significant OT attacks in multiple locations at the same time.
The post CISA’s OT Attack Response Team Understaffed: GAO appeared first on SecurityWeek….
Anonymous Collective Launches DDoS Attack on Liverpool Airport in Political Protest – Daily Dark Web
In what appears to be a politically charged move, the Anonymous Collective purportedly orchestrated a distributed denial-of-service (DDoS) attack targeting Liverpool Airport. The group’s message suggests that the assault was in direct response to the United Kingdom’s perceived support of Israel amid…
Threat hunters have discovered a set of seven packages on the Python Package Index (PyPI) repository that are designed to steal BIP39 mnemonic phrases used for recovering private keys of a cryptocurrency wallet.
The software supply chain attack campaign has been codenamed BIPClip by ReversingLabs. The packages were collectively downloaded 7,451 times prior to…
There was an update on the hacking attempts by hackers linked to Russian foreign intelligence on Friday. They used data stolen from corporate emails in January to gain access to Microsoft’s systems again, which were used by the foreign intelligence services to gain access to the tech giant’s product…