Today, we're excited to announce that Tonic.ai has raised $35 million in Series B funding led by global venture capital and private equity firm Insight Partners. A milestone that serves as further proof of the value of mimicking production data for development—the value of fake data.
The post We raised a $35M Series B. Here’s what’s next for fake data. appeared first on Security Boulevard.
Global Partner Program empowers partners to deliver top-tier supply chain security solutions to enterprise customers Portland, OR – March 24, 2025 – Eclypsium, a leader in infrastructure supply chain security, is proud to announce that it has been included in the prestigious 2025 CRN® Partner Program Guide. The guide is issued annually by CRN®, a […]
The post Eclypsium Earns Spot on Coveted 2025 CRN Partner Program Guide appeared first on Eclypsium | Supply Chain Security for the Modern Enterprise.
The post Eclypsium Earns Spot on Coveted 2025 CRN Partner Program Guide appeared first on Security Boulevard.
This is a news item roundup of privacy or privacy-related news items for 16 MAR 2025 - 22 MAR 2025. Information and summaries provided here are as-is for warranty purposes.
Note: You may see some traditional "security" content mixed-in here due to the close relationship between online privacy and cybersecurity - many things may overlap; for example, major vulnerabilities in popular software, which may compromise the security of user's devices (and therefore pose a threat to their privacy) and large data breaches where significant personal information is exposed.
Items presented here are typically curated with the end user and small groups (such as families and small/micro businesses) in mind. Due to this focus, items primarily affecting enterprises or large organizations may not be included, even if they are widespread or "popular" stories.
TABLE OF CONTENTS
You should at least enable MFA on important/sensitive accounts. While MFA is primarily a security feature, its primary privacy benefit is adding another layer of security to prevent unauthorized access to information contained in particular important or sensitive accounts.
Surveillance Tech in the NewsThis section covers surveillance technology and methods in the news. Specifically, stories and news items where public and/or private organizations have leveraged their capabilities to encroach on user privacy; for example, data brokers using underhanded means to harvest user location data without user knowledge or public organizations using technology without regard for user privacy.
Android Apps Use Bluetooth and WiFi Scanning to Track Users Without GPS
Cyber Insider
Researchers found that 86% of apps they analyzed collect sensitive data, including location data stemming from scanning Wi-Fi network details, and collecting device identifiers. These apps also frequently use Bluetooth data to gather location information and proximity to nearby devices.
This data collection is primarily facilitated by software development kits, which developers may include in apps to bring features without coding things from the ground up - however, they may even be unaware of the privacy implications for their app users.
Judge stops Musk's team from 'unbridled access' to Social Security private data
Reuters
As DOGE continues to push for more access to various systems containing sensitive information of Americans' a judge orders the Social Security Administration to stop sharing data with "DOGE affiliates". Allegedly (and in line with prior reporting), DOGE accessed sensitive SSA data without proper vetting -- similar to when they gained access to US Treasury payment data, which also contains sensitive information of millions of Americans.
Researchers name several countries as potential Paragon spyware customers
TechCrunch
The Citizen Lab, a group of academics and security researchers, recently published a report indicating the governments of Australia, Canada, Cyprus, Denmark, Israel, and Singapore are "likely" customers of Israeli spyware maker Paragon Solutions.
Privacy Tools and ServicesPrimarily covers tools and services with a focus on maintaining/improving/respecting user privacy. Generally includes recommended services/tools found on avoidthehack, but also may feature upcoming/other privacy services not necessarily recommended or promoted by avoidthehack.com
Privacy ToolsBitwarden enables biometric unlock on Linux
Bitwarden
Installing Bitwarden through Snapcraft on Linux can use biometrics to unlock the desktop application.
Privacy ServicesCape opens $99/month beta of its privacy-first mobile plan, inks Proton deal, raises $30M
TechCrunch
I usually don't include beta software on in this series (or really on avoidthehack) or early-stage startups because things in those early-stages go through such turbulence... but given the Salt Typhoon breach and the apparent lackluster security practices and culture at just about every American telecommunications company, this was too interesting to ignore.
Cape is a mobile carrier startup claiming to provide a more secure and private service alternative to traditional telecommunications services. They also have appeared to partner with Proton...
Vulnerabilities and MalwarePrimarily includes severe and exploited vulnerabilities in devices or software used by end users (ex: a major router firmware flaw). Malware campaigns covered generally target/affect the end user.
This section will not contain every vulnerability/CVE or malware campaign reported, but will focus on those with the largest potential impact on a wide range of end users.
VulnerabilitiesApple’s Passwords app was vulnerable to phishing attacks for nearly three months after launch
9to5Mac
Mysk security researchers first discovered this vulnerability after noticing the Passwords app had connected to 130 different domains over regular (unencrypted) HTTP. Specifically, it was fetching account icons and defaulted to opening password reset pages over HTTP.
This vulnerability was patched by Apple in December 2024, but they only disclosed it recently.
Cybercriminals Exploit CheckPoint Antivirus Driver in Malicious Campaign
Infosecurity Magazine
Threat actors are leveraging a "bring your own vulnerable driver" (BYOVD) attack to bypass Windows security measures. Once bypassed, threat actors had high-level access and could view information such as user passwords and other stored credentials.
Microsoft isn't fixing 8-year-old shortcut exploit abused for spying
The Register
Nation-state backed threat actors (which includes North Korea, Iran, Russia, and China) have been abusing Windows shortcut files LNK for many years. These threat actors go to lengths to bury the actual commands used in malicious .LNK files which download malware onto the machine.
According to Microsoft, despite this observed trend, it doesn't intend to release a security fix -- but could do so in the future.
MalwareAMOS and Lumma stealers actively spread to Reddit users
MalwareBytes
Reddit posts (directly on reddit.com) by threat actors on subreddits frequented by cryptocurrency traders link to information stealing malware.
New Arcane infostealer infects YouTube, Discord users via game cheats
Bleeping Computer
A campaign spreading information stealer Arcane primarily uses video game cheats as a lure; specifically, the campaign uses YouTube videos promoting game cheats and cracks to trick users into downloading a password-protected archive containing a malware loader script. Once executed, the script fetches the information stealing malware.
The Kaspersky researchers noted the this "Arcane" information stealer has no known links or overlapping code with Arcane Stealer V. Additionally, Arcane steals a wide range of user data, including VPN account credentials, gaming client information, messaging apps, and information stored in various web browsers.
300 Malicious ‘Vapor’ Apps Hosted on Google Play Had 60 Million Downloads
SecurityWeek
Vapor campaign included over 180 malicious apps on Google Play posing as utility, health and fitness, and lifestyle apps designed to deploy "endless, intrusive full-screen interstitial video ads." Apps in the Vapor campaign bypassed the recent protections introduced in the latest...
The post Privacy Roundup: Week 12 of Year 2025 appeared first on Security Boulevard.
Guidance to help organizations reduce their attack surface, implement a stronger defense-in-depth security model, as well as more quickly detect and contain an intrusion by this ever-prevalent threat.
The post Prevent, Detect, Contain: A Guide Against Black Basta Affiliates’ Attacks appeared first on Security Boulevard.
What is the Cyber Resilience Act? The Cyber Resilience Act is a comprehensive regulatory framework introduced by the EU to enhance cybersecurity resilience. Its primary focus is on minimizing vulnerabilities in digital products and ensuring robust cybersecurity measures are implemented throughout their lifecycle. The act applies to both manufacturers and suppliers of software and hardware […]
The post EU Cyber Resilience Act: What You Need to Know appeared first on Centraleyes.
The post EU Cyber Resilience Act: What You Need to Know appeared first on Security Boulevard.
SOCs without AI aren't just behind the curve — they're fundamentally outmatched in the asymmetric battle against sophisticated threat actors.
The post Evaluating AI for Security Operations appeared first on Security Boulevard.
Paris, France, 24th March 2025, CyberNewsWire
The post Arsen Introduces AI-Powered Phishing Tests to Improve Social Engineering Resilience appeared first on Security Boulevard.
Deception is a core component of many cyberattacks, including phishing, scams, social engineering and disinformation campaigns.
The post Intro to Deceptionology: Why Falling for Scams is Human Nature appeared first on Security Boulevard.
Quantum computing’s ability to break today’s encryption may still be years away—but security leaders can’t afford to wait. Forrester’s The Future of Quantum Security makes it clear: the transition to quantum-safe cryptography must start now.
Related: Quantum standards come of … (more…)
The post SHARED INTEL Q&A: Forrester highlights why companies need to strive for ‘cryptoagility’– today first appeared on The Last Watchdog.
The post SHARED INTEL Q&A: Forrester highlights why companies need to strive for ‘cryptoagility’– today appeared first on Security Boulevard.
When security vulnerabilities appear in popular frameworks, they can affect thousands of websites overnight. That’s exactly what’s happening with a newly discovered vulnerability in Next.js – one of the most...
The post CVE-2025-29927 – Understanding the Next.js Middleware Vulnerability appeared first on Strobes Security.
The post CVE-2025-29927 – Understanding the Next.js Middleware Vulnerability appeared first on Security Boulevard.
Decoding Fake US ESTA Emails: Scam or Real Deal?
The post Decoding Fake US ESTA Emails: Scam or Real Deal? appeared first on Security Boulevard.
In this special episode of the Shared Security Podcast, join Tom Eston and Dan DeCloss, CTO and founder of PlexTrac, as they discuss the challenges of data overload in vulnerability remediation. Discover how PlexTrac addresses these issues by integrating various data sources, providing customized risk scoring, and enhancing remediation workflows. The episode offers an insightful […]
The post From Spreadsheets to Solutions: How PlexTrac Enhances Security Workflows appeared first on Shared Security Podcast.
The post From Spreadsheets to Solutions: How PlexTrac Enhances Security Workflows appeared first on Security Boulevard.
Welcome to this week's edition of our cybersecurity news roundup, bringing you the latest developments and insights from the UK and beyond.
NHS Scotland Confirms Cyberattack DisruptionOn 20 March 2025, NHS Scotland reported a major cyber incident that caused network outages across multiple health boards. The cyberattack disrupted clinical systems and led to delayed patient care, with staff reverting to paper-based processes. The incident has been linked to a suspected ransomware group, although official attribution is still pending. Investigations are ongoing with support from the National Cyber Security Centre (NCSC).
Further coverage from The Register confirmed that some systems were taken offline to prevent further spread, while emergency care remained operational. The affected regions included NHS Dumfries and Galloway, which issued a statement urging patients to only attend if absolutely necessary. (Read more on The Register)
NCSC Weekly Threat Report – 22 March 2025The NCSC's latest threat report highlights ongoing exploitation of known vulnerabilities in Progress Telerik UI by state-aligned threat actors. The report urges UK organisations to patch vulnerable systems immediately, as attackers continue to target unpatched web servers.
Additionally, the NCSC notes an increase in malicious QR code campaigns—so-called "quishing"—where attackers embed phishing URLs into QR codes used in emails, posters, or even receipts. Organisations are advised to educate staff and implement QR code scanning policies.
Cyber Threats on the Rise as UK Eyes General ElectionAs the UK gears up for a general election later this year, the NCSC has raised concerns over potential interference campaigns and disinformation efforts by hostile states. Security services are reportedly on high alert, coordinating with political parties to bolster cyber resilience. While no major incidents have been reported yet, the threat landscape is being closely monitored.
Quick BytesThat’s all for this week! Stay tuned for more updates, and follow best practices to keep your systems secure.
➡️ Previous Post: UK Cybersecurity Weekly News Roundup - 17 March 2025
The post UK Cybersecurity Weekly News Roundup – 23 March 2025 appeared first on Security Boulevard.
Speaker: Lenin Alevski
Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite []DEF CON 32]2 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.
The post DEF CON 32 – Recon Village – Recon MindMap: Organize, Visualize & Prioritize Recon Data appeared first on Security Boulevard.
Are Centralized Management Solutions the Key to Mastering Non-Human Identities Within IAM? For enterprises operating, managing Non-Human Identities (NHIs) within Identity and Access Management (IAM) remains a critical requirement. But how can organizations keep pace with the sheer volume of machine identities and their associated secrets? The answer lies in centralized management for NHIs within […]
The post What solutions offer centralized management for NHIs within IAM? appeared first on Entro.
The post What solutions offer centralized management for NHIs within IAM? appeared first on Security Boulevard.
Is Monitoring Non-Human Identities (NHIs) in Your IAM System Crucial? Ensuring the security of your data and systems is a top priority for all organizations operating. One of the key players in this arena that often goes unnoticed is Non-Human Identities (NHIs). They are a vital component for ensuring end-to-end protection of your digital assets. […]
The post How can I monitor NHI activities within my IAM system? appeared first on Entro.
The post How can I monitor NHI activities within my IAM system? appeared first on Security Boulevard.
Speaker: Steven Sheffield
Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite []DEF CON 32]2 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.
The post DEF CON 32 – Recon Village – OSINT at Clemson: Unmasking John Mark Dougan’s Disinformation Empire appeared first on Security Boulevard.
IntroductionCVE-2025-24813 was originally published on March 10 with a medium severity score of 5.5, and Apache Tomcat released an update to fix it. On March 12, the first attack was detected in Poland by Wallarm researchers, even before a Proof-of-Concept (PoC) was made public. After the PoC was released on March 13 on GitHub and gained attention, the NVD raised the severity score to 9.8 (critical) on March 18.The vulnerability stems from a path equivalence issue where files containing an internal dot (e.g. file.Name) can lead to remote code execution (RCE), information disclosure, or malicious content injection if uploaded via a write-enabled default servlet in Apache Tomcat. Exploiting this vulnerability could allow attackers to take control of compromised servers, access sensitive data, and disrupt normal operations for an organization.RecommendationsZscaler ThreatLabz recommends users on Apache Tomcat software, upgrade to any of the following versions to avoid this vulnerability:Apache Tomcat 11.0.3 or laterApache Tomcat 10.1.35 or laterApache Tomcat 9.0.99 or laterAffected VersionsThe following versions of Apache Tomcat are affected by the vulnerability and should be updated immediately: Apache Tomcat 11.0.0-M1 to 11.0.2Apache Tomcat 10.1.0-M1 to 10.1.34Apache Tomcat 9.0.0-M1 to 9.0.98BackgroundApache Tomcat is an open-source, widely used Java-based web server and servlet container developed by the Apache Software Foundation. It serves as a platform for deploying web applications that use Java Servlets and JavaServer Pages (JSP).Threat actors have been observed attempting to exploit CVE-2025-24813 in the wild. No authentication is required for exploitation, and attackers can use Base-64 encoded payloads to avoid detection by traditional security systems. However, successful exploitation relies on specific configurations within the victim’s environment.Criteria for Assessing VulnerabilityYour environment is only vulnerable if ALL of the following conditions are true:For the DefaultServlet to allow PUT requests, the readonly parameter in conf/web.xml must be changed to false, as it is set to true by default.The server must have Partial PUT requests enabled, which is typically on by default, allowing attackers to manipulate uploaded files.Tomcat needs to be configured to use file-based session storage, which is not enabled by default, with session files saved in the standard storage location.The application must include deserialization libraries that are vulnerable and can be exploited during an attack.How It WorksAssuming all the conditions in the section above are true, the exploit process involves two steps, as shown in the figure below.Figure 1: Attack chain depicting an attacker exploiting CVE-2025-24813.Step 1: Uploading malicious files The attacker sends a PUT request to the vulnerable server to upload a malicious Java payload file as a session entry. This file is then stored in Tomcat’s session storage directory, waiting to be deserialized. The PUT request is shown in the figure below.Figure 2: Malicious PUT request that uploads the payload to the Apache Tomcat server.Step 2: Triggering deserialization The attacker sends a GET request with a specially crafted JSESSIONID cookie pointing to the uploaded session file. During deserialization, the malicious Java code executes, allowing the attacker to steal sensitive data and execute arbitrary commands on the server.The GET request and special session cookie can be seen in the figure below.Figure 3: GET request with JSESSIONID session cookie that triggers CVE-2025-24813.The rce command in the initial PUT request is executed, as shown in the figure below.Figure 4: RCE command from malformed request is executed.ConclusionTo protect against CVE-2025-24813, update Apache Tomcat systems to versions 11.0.3 or later, 10.1.35 or later, or 9.0.99 or later. Failure to upgrade increases the risk of exploitation, potentially allowing attackers to upload malicious session files and achieve RCE on compromised servers. Zscaler CoverageThe Zscaler ThreatLabz team has deployed protection for CVE-2025-24813.Zscaler Private Access AppProtection6000004: Remote Command Execution: Unix Command Injection944250: Remote Command Execution: Suspicious Java method detected944110: Remote Command Execution: Java Process SpawnDetails related to these signatures can be found in the Zscaler Threat Library.
The post CVE-2025-24813: Apache Tomcat Vulnerable to RCE Attacks appeared first on Security Boulevard.
Major cybersecurity breaches continue to plague the US healthcare industry, and on December 27, 2024, the U.S. Department of Health and Human Services (HHS) issued a Notice of Proposed Rulemaking (NPRM) to amend the HIPAA Security Rule, titled "The HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information". Comments were requested and over 4000 were received before the comment period ended on March 7 2025. This blog summarizes what the comments covered - and what comes next.
The post HIPAA Security Rule Amendment: Key Public Comments and Next Steps appeared first on Security Boulevard.
Could Your Legacy IAM Be The Achilles Heel of Your Cybersecurity? When security breaches and data leaks proliferate, organizations grapple with the rising challenge of protecting their digital assets. This is particularly true for organizations with legacy Identity and Access Management (IAM) systems. While these systems have served us well in the past, could they […]
The post How can legacy IAM systems be updated to support NHIs? appeared first on Entro.
The post How can legacy IAM systems be updated to support NHIs? appeared first on Security Boulevard.
