Aggregator

Also: US' Multi-Million Dollar Scam Funds Seizure
Iran exchange leak raises sanctions risks, $580M frozen in scam crackdown, $61M romance scam funds seized, feds seek $327K in dating scam case, Russia exploit broker sanctioned, South Korean wallet recovery phrase exposure and arrest in custody bitcoin theft, Axiom data misuse and Uniswap lawsuit ends.

Who Knew APT Hackers Liked Emojis So Much?
All the nation-state hackers are vibe coding. Vibeware won't win any coding awards. It's not pretty. It doesn't target any zero-day vulnerabilities or known flaws in innovative new ways - but it does allow polyglot malware to be generated at scale.

Passaic County, home to nearly 600,000 people in Northern New Jersey, published a statement on Wednesday evening warning residents that it is aware of a “malware attack” affecting county IT systems and phone lines.

Cal OES offers up to $250,000 to help California’s state, local, and tribal agencies strengthen their digital infrastructure against evolving cyber threats. Organizations must submit their applications by March 13, 2026. 

Key takeaways

1. Significant competitive funding: Cal OES is distributing $9.7 million for local and tribal governments and $1.8 million for state agencies, with individual awards capped at $250,000.
2. Direct Tenable alignment: Tenable solutions fulfill grant requirements to meet the program’s objectives and statewide priorities by providing continuous asset identification, risk-based vulnerability prioritization, and real-time security gap analysis.
3. Focus on national priorities: Grant applications receive high priority when addressing critical security gaps considered national priorities, such as lack of multi-factor authentication (MFA), use of end-of-life (EOL) software, and inadequate encryption—all of which Tenable identifies and surfaces.
4. Strict deadline and submission rules: Applications are due by 11:59 PM PDT on March 13, 2026, and must be submitted as PDF email attachments; Cal OES will not accept links to files in cloud storage services like Google Drive or Dropbox.

Grant overview

The California Governor’s Office of Emergency Services (Cal OES) is now accepting applications for its Federal Fiscal Year (FFY) 2024 State and Local Cybersecurity Grant Program (SLCGP). The grant program is intended to help local and tribal governments, as well as state agencies address threats to information systems. It also aims to improve the security of critical infrastructure organizations and the resilience of the services these entities provide to their communities.

Tenable solutions directly align with the grant's objectives to “understand your current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments” and “ implement security protections commensurate with risk.”

Organizations can apply for up to $250,000 through two competitive programs:

• Local and tribal governments: $9.7 million available for local agencies and federally recognized tribes.
• State agencies: $1.8 million available for California state agencies.

Key program details

• Application deadline: Friday, March 13, 2026, at 11:59 PM PDT.
• Performance period: 26 months, July 1, 2026 – August 31, 2028.
• Cost match: Grant recipients must have a 30% cost match (cash or third-party in-kind). For example, for a $250,000 award, the match is $107,143, totaling a $357,143 project cost.
• Eligibility restrictions: Previous recipients of FY 2022 or 2023 SLCGP funding are not eligible for this cycle.

Meeting SLCGP objectives

Proposed projects must align with one of the four primary SLCGP objectives: 1) Governance and Planning; 2) Assessment and Evaluation; 3) Mitigation; and 4) Workforce Development. Tenable solutions are uniquely positioned to support objectives 1, 2, and 3 as described below:

SLCGP ObjectiveHow Tenable HelpsObjective 1: Governance and PlanningTenable provides centralized visibility into cyber risk to support stronger governance and strategic planning. Our exposure management insights help agencies align security programs with recognized frameworks and grant requirements.Objective 2: Assessment and EvaluationTenable continuously identifies assets and vulnerabilities across IT, OT, cloud and identity environments to identify security gaps in real-time. Risk-based scoring enables agencies to assess their security posture and measure improvement over time.Objective 3: MitigationTenable pinpoints the exposures that represent the highest risk to organizations, helping them to prioritize and accelerate remediation and mitigation. Meeting SLCGP statewide priorities

Applicants are also strongly encouraged to incorporate statewide priorities in their project descriptions which align with Tenable solutions, including:

• Enhance the preparation, response, and resiliency of information systems, applications, and user accounts.
• Implement a process of continuous cybersecurity risk factors and threat mitigation practices prioritized by degree of risk.
• Assess and mitigate risks and threats impacting local jurisdictions’ critical infrastructure and key resources.

Application requirements

To be considered, applicants must submit:

1. Notice of Interest (NOI): Applicants must respond to each question in the NOI form. The applicant’s response to each question will be evaluated as part of the rating process. Applicants should develop a thorough project proposal that takes into consideration planning and implementation of the entire process for the proposed project – from conception to completion of all activities using the requested funding.
2. Project Worksheet: Applicants will complete the Project Worksheet to demonstrate their project alignment to SLCGP objectives, their implementation plan, and to identify key project milestones. The Project Worksheet is an Excel spreadsheet that includes two tabs to be completed by the applicant: the Baseline Project Information tab and the Project Implementation tab. Each will be evaluated as part of the rating process.
3. Cybersecurity Maturity Survey: In addition to the NOI form and Project Worksheet, applicants must complete the Cybersecurity Maturity Survey. This is an online survey that will not be scored, but that is required and will be a helpful tool to assist in identifying gaps to address through SLCGP. Upon completion of the survey, applicants must download a copy of their survey responses and attach them as a PDF file to submit with their proposal; proposals submitted without completing the survey may not be considered for funding.
4. System for Award Management (SAM) registration: Applications must have a Unique Entity Identifier (Unique Entity ID) registered in the federal System for Award Management (SAM). Applicants who do not currently have a Unique Entity ID will need to register at SAM.gov to obtain one.

Pro Tip: All proposals must be emailed to [email protected]. Cal OES cannot access cloud-based storage like Google Drive.

Ready to apply?

You can find the full Request for Proposal (RFP) and necessary forms (Notice of Interest, Project Worksheet, and Cybersecurity Maturity Survey) at the links below:

• Official Press Release: Cal OES News
• Grant Application Info for Local and Tribal Agencies
• Grant Application Info for State Agencies
• Cal OES Grants Management Memorandum

For more information on how Tenable can support your CA SLCGP application, contact us at [email protected] or submit a contact request here.

Cal OES offers up to $250,000 to help California’s state, local, and tribal agencies strengthen their digital infrastructure against evolving cyber threats. Organizations must submit their applications by March 13, 2026. 

Key takeaways

1. Significant competitive funding: Cal OES is distributing $9.7 million for local and tribal governments and $1.8 million for state agencies, with individual awards capped at $250,000.
2. Direct Tenable alignment: Tenable solutions fulfill grant requirements to meet the program’s objectives and statewide priorities by providing continuous asset identification, risk-based vulnerability prioritization, and real-time security gap analysis.
3. Focus on national priorities: Grant applications receive high priority when addressing critical security gaps considered national priorities, such as lack of multi-factor authentication (MFA), use of end-of-life (EOL) software, and inadequate encryption—all of which Tenable identifies and surfaces.
4. Strict deadline and submission rules: Applications are due by 11:59 PM PDT on March 13, 2026, and must be submitted as PDF email attachments; Cal OES will not accept links to files in cloud storage services like Google Drive or Dropbox.

Grant overview

The California Governor’s Office of Emergency Services (Cal OES) is now accepting applications for its Federal Fiscal Year (FFY) 2024 State and Local Cybersecurity Grant Program (SLCGP). The grant program is intended to help local and tribal governments, as well as state agencies address threats to information systems. It also aims to improve the security of critical infrastructure organizations and the resilience of the services these entities provide to their communities.

Tenable solutions directly align with the grant's objectives to “understand your current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments” and “ implement security protections commensurate with risk.”

Organizations can apply for up to $250,000 through two competitive programs:

• Local and tribal governments: $9.7 million available for local agencies and federally recognized tribes.
• State agencies: $1.8 million available for California state agencies.

Key program details

• Application deadline: Friday, March 13, 2026, at 11:59 PM PDT.
• Performance period: 26 months, July 1, 2026 – August 31, 2028.
• Cost match: Grant recipients must have a 30% cost match (cash or third-party in-kind). For example, for a $250,000 award, the match is $107,143, totaling a $357,143 project cost.
• Eligibility restrictions: Previous recipients of FY 2022 or 2023 SLCGP funding are not eligible for this cycle.

Meeting SLCGP objectives

Proposed projects must align with one of the four primary SLCGP objectives: 1) Governance and Planning; 2) Assessment and Evaluation; 3) Mitigation; and 4) Workforce Development. Tenable solutions are uniquely positioned to support objectives 1, 2, and 3 as described below:

SLCGP Objective How Tenable Helps Objective 1: Governance and Planning Tenable provides centralized visibility into cyber risk to support stronger governance and strategic planning. Our exposure management insights help agencies align security programs with recognized frameworks and grant requirements. Objective 2: Assessment and Evaluation Tenable continuously identifies assets and vulnerabilities across IT, OT, cloud and identity environments to identify security gaps in real-time. Risk-based scoring enables agencies to assess their security posture and measure improvement over time. Objective 3: Mitigation Tenable pinpoints the exposures that represent the highest risk to organizations, helping them to prioritize and accelerate remediation and mitigation.  Meeting SLCGP statewide priorities

Applicants are also strongly encouraged to incorporate statewide priorities in their project descriptions which align with Tenable solutions, including:

• Enhance the preparation, response, and resiliency of information systems, applications, and user accounts.
• Implement a process of continuous cybersecurity risk factors and threat mitigation practices prioritized by degree of risk.
• Assess and mitigate risks and threats impacting local jurisdictions’ critical infrastructure and key resources.

Application requirements

To be considered, applicants must submit:

1. Notice of Interest (NOI): Applicants must respond to each question in the NOI form. The applicant’s response to each question will be evaluated as part of the rating process. Applicants should develop a thorough project proposal that takes into consideration planning and implementation of the entire process for the proposed project – from conception to completion of all activities using the requested funding.
2. Project Worksheet: Applicants will complete the Project Worksheet to demonstrate their project alignment to SLCGP objectives, their implementation plan, and to identify key project milestones. The Project Worksheet is an Excel spreadsheet that includes two tabs to be completed by the applicant: the Baseline Project Information tab and the Project Implementation tab. Each will be evaluated as part of the rating process.
3. Cybersecurity Maturity Survey: In addition to the NOI form and Project Worksheet, applicants must complete the Cybersecurity Maturity Survey. This is an online survey that will not be scored, but that is required and will be a helpful tool to assist in identifying gaps to address through SLCGP. Upon completion of the survey, applicants must download a copy of their survey responses and attach them as a PDF file to submit with their proposal; proposals submitted without completing the survey may not be considered for funding.
4. System for Award Management (SAM) registration: Applications must have a Unique Entity Identifier (Unique Entity ID) registered in the federal System for Award Management (SAM). Applicants who do not currently have a Unique Entity ID will need to register at SAM.gov to obtain one.

Pro Tip: All proposals must be emailed to [email protected]. Cal OES cannot access cloud-based storage like Google Drive.

Ready to apply?

You can find the full Request for Proposal (RFP) and necessary forms (Notice of Interest, Project Worksheet, and Cybersecurity Maturity Survey) at the links below:

• Official Press Release: Cal OES News
• Grant Application Info for Local and Tribal Agencies
• Grant Application Info for State Agencies
• Cal OES Grants Management Memorandum

For more information on how Tenable can support your CA SLCGP application, contact us at [email protected] or submit a contact request here.

The post Strengthening California’s Cyber Defenses: Apply Now for FFY 2024 SLCGP Grants appeared first on Security Boulevard.

A vulnerability was found in OpenSSL up to 3.3.5/3.4.3/3.5.4/3.6.0 and classified as problematic. Impacted is an unknown function of the component CompressedCertificate Message Handler. Executing a manipulation can lead to uncontrolled memory allocation. This vulnerability appears as CVE-2025-66199. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability was found in OpenSSL up to 3.6.0. It has been rated as critical. This affects the function PKCS12_get_friendlyname of the component PKCS#12 File Handler. This manipulation causes out-of-bounds write. This vulnerability is handled as CVE-2025-69419. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability, which was classified as critical, has been found in OpenSSL up to 3.6.0. Impacted is the function BIO_f_linebuffer of the component BIO Handler. Performing a manipulation results in out-of-bounds write. This vulnerability is cataloged as CVE-2025-68160. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

A vulnerability marked as problematic has been reported in OpenSSL up to 3.6.0. Affected by this issue is the function levelCRYPTO_ocb128_encrypt of the component Low-level OCB API. The manipulation leads to missing cryptographic step. This vulnerability is referenced as CVE-2025-69418. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability was found in OpenSSL up to 3.4.3/3.5.4/3.6.0. It has been declared as critical. The impacted element is an unknown function of the component PKCS#12 File Handler. The manipulation results in out-of-bounds write. This vulnerability is known as CVE-2025-11187. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in OpenSSL up to 3.3.5/3.4.3/3.5.4/3.6.0. This issue affects the function SSL_CIPHER_find of the component QUIC Protocol. Such manipulation leads to null pointer dereference. This vulnerability is listed as CVE-2025-15468. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

A vulnerability classified as critical has been found in OpenSSL up to 3.0.18/3.3.5/3.4.3/3.5.4/3.6.0. This vulnerability affects unknown code of the component AuthEnvelopedData Message Handler. This manipulation causes out-of-bounds write. This vulnerability is tracked as CVE-2025-15467. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

A vulnerability labeled as problematic has been found in OpenSSL up to 3.5.4/3.6.0. Affected by this vulnerability is an unknown functionality of the component dgst. Executing a manipulation can lead to improper verification of cryptographic signature. The identification of this vulnerability is CVE-2025-15469. The attack can only be executed locally. There is no exploit available. The affected component should be upgraded.

A vulnerability classified as problematic has been found in qs up to 6.14.0. Affected by this vulnerability is the function parse in the library code (lib/parse.js. This manipulation of the argument a[] causes denial of service. This vulnerability is handled as CVE-2025-15284. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in F5 NGINX Open Source and NGINX Plus. This vulnerability affects unknown code of the component Transport Layer Security. The manipulation results in acceptance of extraneous untrusted data with trusted data. This vulnerability was named CVE-2026-1642. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

The bureau didn’t provide any further details on the incident, which reportedly targeted a network for managing surveillance activity.

The post FBI targeted with ‘suspicious’ activity on its networks appeared first on CyberScoop.

The Wikimedia Foundation suffered a security incident today after a self-propagating JavaScript worm began vandalizing pages and modifying user scripts across multiple wikis. [...]

Bitdefender research reveals Pakistani group APT36 is using AI-generated vibeware and trusted cloud services like Google Sheets to target Indian officials.

A vulnerability was found in FantasticLBP Hotels Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. It has been declared as critical. This affects an unknown part of the file /controller/api/OrderList.php. The manipulation of the argument telephone results in sql injection. This vulnerability is identified as CVE-2025-14710. The attack can be executed remotely. Additionally, an exploit exists. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

Edge bugs are so fetch, and Cisco just patched 50 new ones, including some heavy hitters with 10 out of 10 scores on the CVSS scale.