Cyber Security News

In a sophisticated business email compromise (BEC) scheme, cybercriminals are targeting tenants with fraudulent requests to redirect rent payments to attacker-controlled bank accounts. The campaign primarily focuses on French-speaking victims in France and occasionally Canada, exploiting the anxiety associated with potential missed rent payments to manipulate targets into immediate action without proper verification. The attacks […]

The post Cybercriminals Deceive Tenants into Redirecting Rent Payments to Fraudulent Accounts appeared first on Cyber Security News.

In today’s hyper-connected business environment, supply chains are no longer just about the physical movement of goods they are digital ecosystems linking organizations, suppliers, partners, and service providers. This interdependence brings efficiency and innovation, but also introduces significant cybersecurity risks. Attackers increasingly target supply chains, exploiting the weakest links to infiltrate even the most secure […]

The post Supply Chain Cybersecurity – CISO Risk Management Guide appeared first on Cyber Security News.

Cybersecurity researchers have uncovered a sophisticated technique to bypass Microsoft’s phishing-resistant multi-factor authentication (MFA) by exploiting the device code authentication flow and Primary Refresh Tokens (PRTs). This method allows attackers to register Windows Hello for Business keys, effectively creating a persistent backdoor even in environments with strict MFA policies. The technique was initially developed for […]

The post Researchers Find Way to Bypass Phishing-Resistant MFA in Microsoft Entra ID appeared first on Cyber Security News.

In 2025, with cybersecurity threats evolving at an unprecedented pace, effective patch management has never been more critical for organizational security posture. As organizations grapple with an ever-expanding digital landscape, CISOs find themselves at a crossroads where traditional patch management approaches no longer suffice. Recent data reveals that approximately 80% of cyberattacks exploit unpatched software […]

The post Prioritizing Patch Management – CISO’s 2025 Focus appeared first on Cyber Security News.

A sophisticated new information-stealing malware toolkit called “Nullpoint-Stealer” has recently been published on GitHub, raising concerns among cybersecurity professionals about its potential for misuse despite being labeled as an educational tool. The stealer, developed by GitHub user monroe31s, boasts extensive data harvesting capabilities designed to extract sensitive information from compromised systems. Nullpoint-Stealer is a “powerful, […]

The post New Powerful Nullpoint-Stealer With Extensive Capabilities Hosted on GitHub appeared first on Cyber Security News.

In today’s digital landscape, the Chief Information Security Officer (CISO) role has evolved far beyond technical oversight. As cybersecurity concerns grow, senior executives and board members increasingly turn to CISOs to shape risk management and strategic planning related to technology. According to recent research, one in five organizations has its CISO reporting directly to the […]

The post Responding to Data Breaches – CISO Action Plan appeared first on Cyber Security News.

The multi-cloud landscape has transformed enterprise IT, with over 87% of organizations now operating across multiple cloud platforms. This distributed approach delivers flexibility and resilience but creates significant security challenges for today’s CISOs. Managing consistent security controls across diverse environments, navigating complex compliance requirements, and maintaining comprehensive visibility all while supporting rapid innovation demands a […]

The post Securing Multi-Cloud Environments – CISO Resource Blueprint appeared first on Cyber Security News.

In today’s data-driven world, Chief Information Security Officers (CISOs) face unprecedented challenges managing cybersecurity operations. The volume of data requiring protection continues to expand exponentially, while new compliance requirements like SEC breach reporting rules demand faster response times than ever before. Manual processes cannot scale to meet these demands, creating a critical efficiency gap in […]

The post Automating Incident Response – CISO’s Efficiency Guide appeared first on Cyber Security News.

Phishing remains one of the most pervasive and damaging cyber threats, accounting for over 36% of data breaches globally. For Chief Information Security Officers (CISOs), the challenge lies in reacting to attacks and building a proactive defense strategy that mitigates risk before threats materialize. Modern phishing campaigns leverage AI-driven social engineering, polymorphic URLs, and hyper-personalized […]

The post Proactive Phishing Defense – CISO’s Essential Guide appeared first on Cyber Security News.

Mozilla has released Firefox 138, addressing several high-severity security vulnerabilities while introducing long-awaited features, including improved profile management.  Security researchers identified multiple critical flaws that could allow attackers to escalate privileges or bypass security mechanisms, prompting this significant security update, which was released on April 29, 2025. High-Impact Security Flaws in Firefox and Thunderbird The […]

The post Firefox 138 Released With Fix for Multiple High-Severity Vulnerabilities appeared first on Cyber Security News.

Link11 has fully integrated DOSarrest and Reblaze to become one of Europe’s leading providers of network security, web application security, and application performance Link11, DOSarrest, and Reblaze have combined their strengths into a single, integrated platform with a new brand identity. The result: a consistent user experience, maximum efficiency, and seamless security. As a European […]

The post Link11 brings three brands together on one platform with new branding appeared first on Cyber Security News.

A critical Cross-Site Request Forgery (CSRF) vulnerability in Zimbra Collaboration Server (ZCS) versions 9.0 through 10.1, tracked as CVE-2025-32354, allows attackers to execute unauthorized GraphQL operations and access sensitive user data.  The flaw resides in Zimbra’s webmail interface’s GraphQL endpoint (/service/extension/graphql), where improper CSRF token validation enables malicious actors to manipulate authenticated users into triggering […]

The post Zimbra Collaboration Server GraphQL Vulnerability Exposes Sensitive User Data appeared first on Cyber Security News.

Advanced Persistent Threats (APTs) represent one of the most formidable challenges in the cybersecurity landscape. These sophisticated attacks, typically orchestrated by nation-states or well-funded criminal organizations, target critical infrastructure, government agencies, and enterprises with surgical precision. Unlike conventional cyber threats, APTs maintain a long-term, stealthy presence within networks, often for months or years, maximizing damage […]

The post Defending Against APTs – CISO’s Strategic Guide appeared first on Cyber Security News.

A newly disclosed vulnerability in Docker Desktop’s Registry Access Management (RAM) feature has left macOS users vulnerable to unauthorized image pulls, undermining critical container security controls.  Designated CVE-2025-4095, the flaw allows developers to bypass registry restrictions enforced by administrators, potentially exposing organizations to malicious container images or unapproved software dependencies. Registry Access Management Vulnerability on […]

The post Docker Registry Vulnerability Lets MacOS Users Pull Images from Any Registry appeared first on Cyber Security News.

A high-severity vulnerability (CVE-2025-30194) in PowerDNS DNSdist, a widely used DNS load balancer and security tool, enables remote attackers to trigger denial-of-service (DoS) conditions by exploiting flaws in its DNS-over-HTTPS (DoH) implementation.  The vulnerability, disclosed in PowerDNS Security Advisory, affects DNSdist versions 1.9.0 through 1.9.8 when configured to use the nghttp2 library for DoH processing. […]

The post PowerDNS DNSdist Vulnerability Let Attackers Cause Denial of Service Condition appeared first on Cyber Security News.

Cybercriminals have discovered a new attack vector utilizing the legitimate file-sharing service GetShared to distribute malware and conduct phishing campaigns. This emerging threat allows attackers to circumvent traditional email security measures by exploiting the trusted status of notifications from recognized platforms. The technique represents an evolution in threat actors’ methodologies as they continue to adapt […]

The post Hackers Leveraging GetShared to Deploy Malware Bypassing Defenses appeared first on Cyber Security News.

WhatsApp, the world’s largest messaging platform, has announced a major leap in privacy-preserving artificial intelligence (AI) with the introduction of its new “Private Processing” system.  This technology enables users to access advanced AI features-such as message summarization and writing suggestions-while upholding WhatsApp’s core promise of end-to-end message secrecy, ensuring that not even Meta, WhatsApp, or […]

The post WhatsApp Introduces AI Tools With Promise of Full Message Secrecy appeared first on Cyber Security News.

CISA has added a critical SAP NetWeaver vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on April 29, 2025.  The zero-day flaw, tracked as CVE-2025-31324, carries a maximum CVSS score of 10.0 and has been actively exploited in the wild since at least March 2025. CVE-2025-31324: Critical SAP NetWeaver File Upload Flaw CVE-2025-31324 is an […]

The post CISA Warns SAP 0-day Vulnerability Exploited in the Wild  appeared first on Cyber Security News.

Security researchers have disclosed a critical vulnerability in Avast Free Antivirus that could allow attackers to gain elevated system privileges and execute malicious code with kernel-level access. The vulnerability, tracked as CVE-2025-3500, received a high CVSS score of 8.8 and was publicly disclosed on April 24, 2025, after being patched by Avast. The security flaw […]

The post Avast Antivirus Vulnerability Let Attackers Escalate Privileges appeared first on Cyber Security News.

By fusing agentic AI and contextual threat intelligence, SecAI transforms investigation from a bottleneck into a force multiplier. SecAI, an AI-enriched threat intelligence company, made its official debut today at RSA Conference 2025 in San Francisco, marking the company’s first public appearance on the global cybersecurity stage. At the event, the SecAI team is showcasing […]

The post SecAI Debuts at RSA 2025, Redefining Threat Investigation with AI appeared first on Cyber Security News.