Aggregator

Депутаты во втором чтении одобрили порядок ареста и хранения цифровой валюты.

Zr.Ms. Johan de Witt is met de ongeveer 200-koppige bemanning na 2,5 maand terug in Den Helder. Toen het amfibisch transportschip in zicht kwam, stonden familie en vrienden al te wachten op de kade. Zij zorgden in druilerig en fris weer voor een warm onthaal.

Jamf Threat Labs has identified a new family of malicious stealers tracked as DigitStealer, representing a significant evolution in macOS-targeted malware. Unlike traditional infostealers that follow linear execution paths, DigitStealer introduced sophisticated multi-stage attack techniques, extensive anti-analysis checks, and novel persistence mechanisms, demonstrating the threat actors’ deep understanding of macOS architecture. The DigitStealer campaign begins […]

The post Advanced macOS DigitStealer Uses Multi-Stage Attack Chain to Evade Detection appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Anthropic’s Claude Code AI assistant performed 80% to 90% of the tasks involved in a recent cyber-attack campaign, said Anthropic researchers

A new campaign leveraging Formbook malware has emerged, showcasing sophisticated multi-stage infection tactics that underscore the importance of analyzing more than just executable files during malware investigations. When teaching malware reverse-engineering in courses like SANS FOR610, it’s critical to addressed that reverse engineering applies to every component in the infection chain, not just PE or […]

The post Formbook Malware Campaign Uses Malicious ZIP Files and Layered Scripting Techniques appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

CISA has updated this Alert to include an additional vulnerability, CVE-2025-58034, and its relation to CVE-2025-64446, and associated resources.

CISA is aware of the exploitation of two vulnerabilities, CVE-2025-64446 and CVE-2025-58034, in Fortinet FortiWeb, a web application firewall. CISA is also aware that threat actors could exploit CVE-2025-64446 as an initial access vector and then chain CVE-2025-58034 to escalate privileges on a target system. These vulnerabilities chained together could lead to unauthenticated remote code execution against vulnerable FortiWeb products.

CVE-2025-64446 affects the following FortiWeb versions:1 

• 8.0.0 through 8.0.1
• 7.6.0 through 7.6.4
• 7.4.0 through 7.4.9
• 7.2.0 through 7.2.11
• 7.0.0 through 7.0.11

CVE-2025-58034 affects the following FortiWeb versions:2 

• 8.0.0 through 8.0.1
• 7.6.0 through 7.6.5
• 7.4.0 through 7.4.10
• 7.2.0 through 7.2.11
• 7.0.0 through 7.0.11

CVE-2025-64446 is a relative path traversal vulnerability (CWE-23: Relative Path Traversal) that may allow an unauthenticated malicious actor to execute administrative commands on a system via specially crafted HTTP or HTTPS requests.

CVE-2025-58034 is an OS Command Injection vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command [‘OS Command Injection’]) that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.

Fortinet recommends affected organizations:

Apply the necessary upgrades listed in the table below and use Fortinet’s guidance to address CVE-2025-64446.

Version Affected  Solution FortiWeb 8.0 8.0.0 through 8.0.1 Upgrade to 8.0.2 or above FortiWeb 7.6 7.6.0 through 7.6.4 Upgrade to 7.6.5 or above FortiWeb 7.4 7.4.0 through 7.4.9 Upgrade to 7.4.10 or above FortiWeb 7.2 7.2.0 through 7.2.11 Upgrade to 7.2.12 or above FortiWeb 7.0 7.0.0 through 7.0.11 Upgrade to 7.0.12 or above

Apply the necessary upgrades listed in the table below and use Fortinet’s guidance to address CVE-2025-58034.

Version Affected  Solution FortiWeb 8.0 8.0.0 through 8.0.1 Upgrade to 8.0.2 or above FortiWeb 7.6 7.6.0 through 7.6.5 Upgrade to 7.6.6 or above FortiWeb 7.4 7.4.0 through 7.4.10 Upgrade to 7.4.11 or above FortiWeb 7.2 7.2.0 through 7.2.11 Upgrade to 7.2.12 or above FortiWeb 7.0 7.0.0 through 7.0.11 Upgrade to 7.0.12 or above

If you cannot immediately upgrade the affected systems, disable HTTP or HTTPS for internet-facing interfaces. Note: Limiting access to HTTP/HTTPS management interfaces to internal networks is a best practice that reduces, but does not eliminate, risk; upgrading the affected systems remains essential and is the only way to fully remediate this vulnerability.

After upgrading, review configuration and review logs for unexpected modifications or the addition of unauthorized administrator accounts.

CISA added CVE-2025-64446 and CVE-2025-58034 to its Known Exploited Vulnerabilities (KEV) Catalog on Nov. 14, 2025 and Nov. 18, 2025, respectively.

Disclaimer

Note: This Alert may be updated to reflect new guidance issued by CISA or other parties. 

Organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at [email protected] or (888) 282-0870.   

The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.

Notes: 

1. FortiGuard Labs, Path confusion vulnerability in GUI (November 14, 2025), https://fortiguard.fortinet.com/psirt/FG-IR-25-910.
2. FortiGuard Labs, Multiple OS command injection in API and CLI (November 18, 2025), https://fortiguard.fortinet.com/psirt/FG-IR-25-513.

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2025-64446 Fortinet FortiWeb Path Traversal Vulnerability 

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.   

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. 

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. 

Перевел 200 тысяч незнакомцу? Ты подозрителен.

Researchers at Group-IB have uncovered a sophisticated phishing framework that demonstrates how cybercriminals are industrializing credential theft through automation, evasion techniques, and Telegram-based data exfiltration. The kit targets explicitly Aruba S.p.A., an Italian IT services provider serving over 5.4 million customers, highlighting the significant financial and operational risks posed by modern phishing-as-a-service operations. The analyzed […]

The post Analysis of Multi-Stage Phishing Kits Leveraging Telegram for Credential Theft and Evasion Techniques appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Akira ransomware has extorted $244M since September 2025, with some attacks exfiltrating data in just two hours, a joint cybersecurity advisory warns

MCPZoo：世界上（目前）最大的MCP动物园要来了！

Власти внесут закон об обязательной маркировке видео, созданных с помощью ИИ.

腾讯云安全公布近期安全漏洞清单,建议自查更新,防入侵保业务安全!

关键词安全漏洞Cl0P 勒索软件组织近日声称，他们利用 Oracle E-Business Suite（EBS

关键词安全漏洞Imunify360 AV 作为全球最常用的 Linux 网站恶意软件扫描器之一，为数以千万计的

关键词WhatsApp一种通过 WhatsApp 屏幕共享功能实施的新型骗局正在全球快速蔓延。

关键词chromeChrome Web Store 再次被曝出现恶意扩展长期上架的问题。

Retailers are exposed to cyber attacks – and personnel, not tech, is the answer.

The post The retail sector needs a cybersecurity talent incubator appeared first on CyberScoop.

Cisco Talos has identified an emerging threat from Kraken, a sophisticated cross-platform ransomware group that has emerged from the remnants of the HelloKitty ransomware cartel. In August 2025, the security firm observed the Russian-speaking group conducting big-game hunting and double-extortion attacks against enterprise environments worldwide. Kraken represents a significant evolution in ransomware threats due to […]

The post Kraken Ransomware Targets Windows, Linux, and VMware ESXi in Enterprise Environments appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Key Takeaways: 85 active ransomware and extortion groups observed in Q3 2025, reflecting the most decentralized ransomware ecosystem to date. 1,590 victims disclosed across 85 leak sites, showing high, sustained activity despite law-enforcement pressure. 14 new ransomware brands launched this quarter, proving how quickly affiliates reconstitute after takedowns. LockBit’s reappearance with