Aggregator

CrowdStrike says an insider shared internal screenshots with hackers but confirms no system breach and no customer data exposure. BleepingComputer first reported that CrowdStrike said an insider shared internal system screenshots with hackers, after Scattered Lapsus$ Hunters leaked them on Telegram. The company stresses that no systems were breached and no customer data was exposed. […]

In a repeat of similar attacks during the summer, threat actors affiliated with the ShinyHunters extortion group used a third-party application to steal organizations' Salesforce data.

The lawsuit concerns the removal of apps like ICEBlock, Red Dot and DeICER from online playstores that provide real-time tracking of immigration raids.

The post Privacy group sues feds over talks with tech companies on ICE raid trackers  appeared first on CyberScoop.

The SEC dismissed the remain charges in the lawsuit filed in 2023 against software maker SolarWinds and CISO Timothy Brown in the wake of the massive Sunburst supply chain attack, in which a Russian nation-state group installed a malicious update into SolarWInds software that then compromised the systems of some customers.

The post SEC Dismisses Remains of Lawsuit Against SolarWinds and Its CISO appeared first on Security Boulevard.

Over the past weeks, I’ve had a series of conversations across the cybersecurity ecosystem. Founders in early-stage security startups, VC firms exploring new segments, PE groups accelerating roll-ups, MSP leaders navigating change, and friends pushing the boundaries of what AI can do. Individually, each conversation was fascinating. Taken together, they paint a picture of where […]

The post Security Is Fragmenting and Converging at the Same Time — Insights from the Field first appeared on Future of Tech and Security: Strategy & Innovation with Raffy.

The post Security Is Fragmenting and Converging at the Same Time — Insights from the Field appeared first on Security Boulevard.

A vulnerability was found in rnp up to 0.18.0. It has been rated as problematic. Affected is an unknown function of the component PKESK Session Key Handler. This manipulation causes missing encryption of sensitive data. This vulnerability is tracked as CVE-2025-13402. The attack is only possible within the local network. No exploit exists. Upgrading the affected component is advised.

A vulnerability was found in IDonate Plugin up to 2.1.15 on WordPress. It has been declared as critical. This impacts the function panding_blood_request_action. The manipulation results in missing authorization. This vulnerability is identified as CVE-2025-12877. The attack can be executed remotely. There is not any exploit available.

A vulnerability was found in Scott Paterson Subscriptions & Memberships for PayPal Plugin up to 1.1.7 on WordPress. It has been classified as critical. This affects an unknown function. The manipulation leads to insufficient verification of data authenticity. This vulnerability is referenced as CVE-2025-12752. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability was found in codepeople CP Contact Form with PayPal Plugin up to 1.3.56 on WordPress and classified as critical. The impacted element is an unknown function of the component Query Parameter Handler. Executing manipulation of the argument cp_contactformpp_ipncheck can lead to missing authorization. The identification of this vulnerability is CVE-2025-13384. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in codepeople Appointment Booking Calendar Plugin up to 1.3.96 on WordPress and classified as critical. The affected element is an unknown function. Performing manipulation of the argument cpabc_ipncheck results in missing authorization. This vulnerability was named CVE-2025-13317. The attack may be initiated remotely. There is no available exploit.

A vulnerability, which was classified as problematic, was found in GSheetConnector for Ninja Forms Plugin up to 2.0.1 on WordPress. Impacted is an unknown function. Such manipulation leads to missing authorization. This vulnerability is uniquely identified as CVE-2025-13136. The attack can be launched remotely. No exploit exists.

In a potential gift to geopolitical adversaries, the encrypted messaging app uses a leaky custom protocol that allows message replays, impersonation attacks, and sensitive information exposure from chats.

A vulnerability, which was classified as problematic, has been found in Amazon Wickr, Wickr Gov and Wickr Enterprise up to 6.62.12. This issue affects some unknown processing. This manipulation causes denial of service. This vulnerability is handled as CVE-2025-13524. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability classified as problematic was found in AMD μProf up to 4.x. This vulnerability affects unknown code. The manipulation results in improper validation of specified index, position, or offset in input. This vulnerability is known as CVE-2025-48502. Attacking locally is a requirement. No exploit is available. Upgrading the affected component is advised.

A vulnerability classified as problematic has been found in AMD EPYC 9004 Processors, EPYC 9005 Processors, EPYC 8004 Processors, EPYC Embedded 7003 Processors, EPYC Embedded 9004 Processors, EPYC Embedded 9005 Processors and EPYC Embedded 8004 Processors. This affects an unknown part of the component TLB Handler. The manipulation leads to incomplete cleanup. This vulnerability is traded as CVE-2025-29934. An attack has to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability described as problematic has been identified in AMD Ryzen 9000HX Processors. Affected by this issue is some unknown functionality. Executing manipulation can lead to improper handling of insufficient entropy in trng. This vulnerability appears as CVE-2025-62626. The attack requires local access. There is no available exploit. Upgrading the affected component is recommended.

Even the most advanced systems like Cloudflare can fall victim to software issues and become a global point of failure, Dr. David Utzke argues, adding that the recent outage should be a warning for enterprises.

A vulnerability marked as critical has been reported in Wazuh up to 4.12.x. Affected by this vulnerability is an unknown functionality of the file C:\Program Files (x86)\ossec-agent\authd.pass. Performing manipulation results in incorrect default permissions. This vulnerability is reported as CVE-2025-54866. The attack requires a local approach. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability labeled as problematic has been found in Browser Company of New York Dia up to 1.5.x. Affected is an unknown function of the component Fullscreen Handler. Such manipulation leads to improper restriction of rendered ui layers. This vulnerability is documented as CVE-2025-13132. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

A vulnerability identified as problematic has been detected in Wazuh up to 4.11.x. This impacts the function fim_alert of the component Message Handler. This manipulation causes unchecked return value. This vulnerability is registered as CVE-2025-64169. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.