Cyber Security News

A sophisticated fraud scheme known as SMS pumping is quietly draining millions from businesses worldwide by exploiting SMS verification systems. This cybercrime tactic, similar to a modern-day toll scam, involves artificially inflating SMS traffic through automated means, generating fraudulent revenue while leaving legitimate businesses to absorb unexpected costs. The scheme has become increasingly prevalent as […]

The post Threat Actors Turning Messaging Service into a Cash Making Machine appeared first on Cyber Security News.

A hacker known by the alias “Satanic” has claimed responsibility for a massive data breach involving WooCommerce, one of the most widely used eCommerce platforms on the web. The breach, which reportedly occurred on April 6, 2025, involves the theft of over 4.4 million user records, including detailed personal and business information. Cyber Security News […]

The post Hackers Allegedly Claiming WooCommerce Breach, 4.4 Million Customer Details Stolen appeared first on Cyber Security News.

A new wave of phishing emails is sweeping across Latin America, and once again, Grandoreiro is behind it. This banking trojan is no newcomer; it’s been active for years, evolving steadily into a more sophisticated and evasive threat.   With targeted tactics like geofencing and DNS evasion, Grandoreiro is staying just ahead of standard security solutions.  […]

The post How Banking Trojan Grandoreiro is Evolving Tactics To Attack Victims in LATAM  appeared first on Cyber Security News.

OpenSSH 10.0, a significant update to the widely adopted secure remote login and file transfer toolset, was officially released on April 9, 2025.  This milestone version introduces substantial protocol changes, enhanced security features, and critical improvements to prepare for quantum computing threats. The most notable security enhancement is the implementation of the hybrid post-quantum algorithm […]

The post OpenSSH 10.0 Released With Protocol Changes & Security Upgrades appeared first on Cyber Security News.

Hackers intercepted and monitored the emails of over 103 bank regulators at the Office of the Comptroller of the Currency (OCC) for more than a year, gaining access to highly sensitive financial data. The breach was discovered on February 11, 2025, when Microsoft’s security team alerted the OCC about unusual activities on its network. The […]

The post Hackers Intercepted 100+ Bank Regulators’ Emails for More Than a Year appeared first on Cyber Security News.

Google has unveiled Firebase Studio, a groundbreaking cloud-based platform designed to streamline the creation of full-stack AI applications. This innovative tool integrates the power of Gemini AI with existing Firebase services, offering developers an end-to-end solution to prototype, build, test, and deploy applications with unprecedented speed and efficiency. Key Features of Firebase Studio Firebase Studio […]

The post Google Released AI-powered Firebase Studio to Accelerate Build, Test, & Deployment appeared first on Cyber Security News.

A critical vulnerability in the USB-audio driver, which could lead to out-of-bounds memory reads, has been addressed by a recent patch to the Linux kernel, authored by Takashi Iwai of SUSE. The USB-audio driver in the Linux kernel has an out-of-bounds access vulnerability that possibly enables an attacker with physical access to the system to […]

The post Linux USB Audio Driver Vulnerability Let Attackers Execute Arbitrary Code Via Malicious USB Device appeared first on Cyber Security News.

VMware has released critical security updates to address 47 vulnerabilities across multiple VMware Tanzu Greenplum products, including 29 issues in VMware Tanzu Greenplum Backup and Restore and 18 bugs in various components of VMware Tanzu Greenplum.  The security advisories, published on April 7, 2025, include patches for vulnerabilities with CVSS scores as high as 9.8, […]

The post VMware Patches Multiple 47 Vulnerabilities VMware Tanzu Greenplum Backup & Components appeared first on Cyber Security News.

Microsoft has disclosed a significant security vulnerability in Active Directory Domain Services that could allow attackers to elevate their privileges to the system level, potentially gaining complete control over affected systems.  The vulnerability tracked as CVE-2025-29810, was patched as part of Microsoft’s April 2025 Patch Tuesday security update cycle.  Security researchers classify the flaw as […]

The post Windows Active Directory Domain Vulnerability Let Attackers Escalate Privileges appeared first on Cyber Security News.

A sophisticated ransomware strain known as Hellcat has emerged as a formidable threat in the cybersecurity landscape since its first appearance in mid-2024. The malware has rapidly evolved its capabilities, specifically targeting critical sectors including government agencies, educational institutions, and energy infrastructure. This group doesn’t merely encrypt data; they weaponize psychological tactics and exploit previously […]

The post Hellcat Ransomware Updated It’s Arsenal to Attack Government, Education, and Energy Sectors appeared first on Cyber Security News.

Adobe has released a comprehensive set of security updates addressing multiple vulnerabilities across twelve of its products.  The patches, all released on April 8, 2025, aim to resolve critical, important, and moderate security flaws that could potentially expose users to various cyber threats, including arbitrary code execution, privilege escalation, and application denial-of-service attacks. Significant Vulnerabilities […]

The post Adobe Security Update – Patch for Multiple Vulnerabilities Across Products appeared first on Cyber Security News.

Microsoft has confirmed a global outage affecting the Exchange Admin Center (EAC), leaving administrators unable to access critical management tools. The issue, which has been designated as a critical service incident under ID EX1051697, is causing widespread disruptions across organizations relying on Exchange Online. Administrators attempting to log in to the EAC are encountering an […]

The post Microsoft Exchange Admin Center Down Globally appeared first on Cyber Security News.

Cybercriminals have devised sophisticated methods to exploit Near Field Communication (NFC) technology via popular mobile payment platforms. These attackers are now leveraging Apple Pay and Google Wallet to conduct unauthorized transactions after obtaining victims’ card credentials through phishing operations. The scheme involves linking stolen payment card information to fraudulent mobile wallet accounts, allowing criminals to […]

The post Hackers Hiding NFC Carders Behind Apple Pay and Google Wallet appeared first on Cyber Security News.

A plugin designed to patch security vulnerabilities in older versions of Shopware has itself been found vulnerable to SQL injection attacks. The flaw, discovered in Shopware Security Plugin 6 version 2.0.10, affects Shopware installations below versions 6.5.8.13 and 6.6.5.1, potentially allowing attackers to compromise database systems with read and write permissions. The vulnerability arises from […]

The post Shopware Security Plugin Exposes Systems to SQL Injection Attacks appeared first on Cyber Security News.

Cybercriminals have devised a sophisticated scheme exploiting SourceForge, a popular software hosting platform, to distribute malicious software disguised as legitimate office applications. The attack leverages the platform’s feature that automatically assigns sourceforge.io domains to projects, creating convincing facades for malware distribution campaigns that primarily target Russian-speaking users. The attackers created a project called “officepackage” on […]

The post Attackers Exploits SourceForge Software Hosting Platform to Deliver Malware appeared first on Cyber Security News.

Microsoft has released a patch for a critical Windows Kerberos vulnerability (CVE-2025-29809) that allows attackers to bypass security features and potentially access sensitive authentication credentials.  The flaw, addressed in the April 2025 Patch Tuesday updates, continues a troubling trend of Kerberos-related vulnerabilities that have plagued Windows systems in recent years. The security flaw, classified as […]

The post Windows Kerberos Vulnerability Let Attackers Bypass Security Feature & Access Credentials appeared first on Cyber Security News.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Microsoft Windows vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.  The flaw in the Windows Common Log File System (CLFS) driver, tracked as CVE-2025-29824, is being actively exploited in targeted ransomware attacks.  Organizations are required to patch this vulnerability by April 29, 2025, […]

The post CISA Warns of Microsoft Windows CLFS Vulnerability Exploited in Wild appeared first on Cyber Security News.

A critical security vulnerability discovered in pgAdmin 4, the most widely used management tool for PostgreSQL databases, is allowing attackers to execute arbitrary code on affected systems.  Security researchers have disclosed details of CVE-2025-2945, a severe Remote Code Execution (RCE) vulnerability with a CVSS score of 9.9, indicating the highest level of severity. The vulnerability […]

The post Critical pgAdmin Vulnerability Let Attackers Execute Remote Code appeared first on Cyber Security News.

The US Cybersecurity and Infrastructure Security Agency (CISA) has officially released Version 2.0.0 of the NICE Workforce Framework for Cybersecurity, marking a significant update to this nationally focused resource.  Released on March 5, 2025, this major update introduces substantial changes aimed at enhancing the framework’s utility across public, private, and academic sectors. The NICE (National […]

The post CISA Releases NICE Workforce Framework Version 2.0.0 Released – What’s New appeared first on Cyber Security News.

A critical security vulnerability has been discovered in Bitdefender GravityZone Console that could allow remote attackers to execute arbitrary commands on affected systems.  The flaw tracked as CVE-2025-2244 has a CVSS score of 9.5. It stems from an insecure PHP deserialization issue that poses significant risks to enterprise security infrastructures relying on this widely used […]

The post Bitdefender GravityZone Console PHP Vulnerability Let Attackers Execute Arbitrary Commands appeared first on Cyber Security News.