Aggregator

This week’s cybersecurity landscape highlights a dynamic threat environment characterized by newly disclosed vulnerabilities, active exploitation of known flaws, and […]

The post Weekly Threat Landscape Digest – Week 33 appeared first on HawkEye.

Cybercriminal groups peddling sophisticated phishing kits that convert stolen card data into mobile wallets have recently shifted their focus to targeting customers of brokerage services, new research shows. Undeterred by security controls at these trading platforms that block users from wiring funds directly out of accounts, the phishers have pivoted to using multiple compromised brokerage accounts in unison to manipulate the prices of foreign stocks.

A vulnerability was found in Linux Kernel up to 5.19.3 and classified as critical. This issue affects the function dsa_tree_change_tag_proto of the file /sys/class/net/eno2/dsa/tagging. The manipulation leads to null pointer dereference. The identification of this vulnerability is CVE-2022-50063. Access to the local network is required for this attack. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in Linux Kernel. Affected by this vulnerability is an unknown functionality of the component Nitro Enclaves Driver. The manipulation leads to null pointer dereference. This vulnerability is known as CVE-2021-3543. The attack can be launched remotely. There is no exploit available.

A vulnerability was found in Linux Kernel up to 6.13.1. It has been declared as critical. Affected by this vulnerability is the function dpu_plane_atomic_print_state. The manipulation leads to null pointer dereference. This vulnerability is known as CVE-2024-58073. The attack needs to be approached within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.16-rc5. This vulnerability affects the function to_atmarpd of the component atm. The manipulation leads to null pointer dereference. This vulnerability was named CVE-2025-38460. The attack can only be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability identified as critical has been detected in Linux Kernel up to 5.10.136/5.15.60/5.18.17/5.19.1. Affected is the function ast_vhub_init_desc of the component usb. The manipulation leads to improper update of reference count. This vulnerability is traded as CVE-2022-50139. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

An analysis of telemetry data published by Red Canary, a unit of Zscaler, finds only 16% of the tens of thousands of phishing emails reported by end users in the first half of 2025 proved to be actual threats. At the same time, however, the report also noted that cybercriminals are employing increasingly sophisticated techniques,..

The post Analysis Sees Limited End User Ability to Accurately Identify Phishing Attacks appeared first on Security Boulevard.

The UK telco said it temporarily took some systems offline as a "protective" measure in its investigation.

Free data recovery software or tools are among the most essential tools, playing a crucial role in our lives. Although you can find dozens of them nowadays, their importance remains significant. Losing our data from a device due to failure of the device, an attack by ransomware or accidentally erasing of data can become a […]

The post 10 Best Free Data Recovery Software 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Физики построили карту из ничего — и доказали, что пустота управляет Вселенной.

Every October, organizations revisit the same cybersecurity routines. "Security is everyone’s responsibility,” makes the rounds. However, if awareness alone were enough, we would not see so many security incidents linked to human behavior.

A vulnerability was found in Check Point ZoneAlarm Extreme Security. It has been classified as critical. This vulnerability affects unknown code. The manipulation leads to link following. This vulnerability was named CVE-2024-6233. Attacking locally is a requirement. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability identified as critical has been detected in Malwarebytes Antimalware. Affected by this issue is some unknown functionality. The manipulation leads to link following. This vulnerability is handled as CVE-2024-6260. Local access is required to approach this attack. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in aio-libs aiohttp up to 3.10.10. It has been rated as problematic. Affected is an unknown function. The manipulation leads to http request smuggling. This vulnerability is traded as CVE-2024-52304. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in IBM Engineering Systems Design Rhapsody 7.0.2/7.0.3. This vulnerability affects unknown code of the component Request Handler. The manipulation leads to time-of-check time-of-use. This vulnerability was named CVE-2024-41779. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability labeled as critical has been found in Insyde InsydeH2O up to 05.70.49. This issue affects some unknown processing of the component VariableRuntimeDxe Driver. The manipulation leads to buffer overflow. The identification of this vulnerability is CVE-2024-52877. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability marked as critical has been reported in Insyde InsydeH2O up to 05.70.49. Affected is the function SmmUpdateVariablePropertySmi of the component VariableRuntimeDxe Driver. The manipulation leads to incorrect comparison. This vulnerability is traded as CVE-2024-52879. Access to the local network is required for this attack. There is no exploit available. It is recommended to upgrade the affected component.