Vulnerabilities
October 28, 2025
58 views 16 secs 0

Hackers took over 8.7 million WordPress sites in two days, targeting critical vulnerabilities in popular plugins.

As seen on a Russian-language hacking forum, this news report: A major vulnerability exploitation campaign has hit WordPress sites: attackers are targeting resources running the GutenKit and Hunk Companion plugins, which are vulnerable to critical vulnerabilities that allow arbitrary code execution on the server. Wordfence , a WordPress security company, recorded 8.7 million attack attempts in just two days—October […]

Vulnerabilities, Data Breach News
October 27, 2025
57 views 57 secs 0

Qilin Ransomware Exploits MSPaint and Notepad to Find Sensitive Information

Cyber Press reports: Cisco Talos has identified a sophisticated technique employed by the Qilin ransomware group, in which threat actors leverage legitimate Windows utilities, specifically MSPaint and Notepad, to inspect and locate high-sensitivity information across compromised networks manually. […] During the credential access and exfiltration phase, attackers execute a comprehensive credential-harvesting workflow using tools such […]

Vulnerabilities
October 27, 2025
39 views 19 secs 0

Newly Patched Critical Microsoft WSUS Flaw Comes Under Active Exploitation

The Hacker News reports: Microsoft on Thursday released out-of-band security updates to patch a critical-severity Windows Server Update Service (WSUS) vulnerability with a proof-of-concept (Poc) exploit publicly available and has come under active exploitation in the wild. The vulnerability in question is CVE-2025-59287 (CVSS score: 9.8), a remote code execution flaw in WSUS that was originally fixed by the […]

Vulnerabilities, News
October 24, 2025
44 views 27 secs 0

Experts hack FIA site, access Verstappen’s personal information

Max Verstappen after United States Grand Prix win. Picture: RacePictures

GP Blog reports: An FIA website containing sensitive information and documents relating to drivers, including Max Verstappen, has been hacked. Whilst this was not a malicious hacking attempt, the hackers were able to access sensitive personal information of any driver they chose. The FIA’s Driver Categorisation website contains the details of almost 7,000 drivers. The hackers, who breached […]

Education Sector, Data Breach News, Vendor News, Vulnerabilities
October 14, 2025
59 views 9 secs 0

Harvard investigating breach linked to Oracle zero-day exploit

Bleeping Computer reports: Harvard University is investigating a data breach after the Clop ransomware gang listed the school on its data leak site, saying the alleged breach was likely caused by a recently disclosed zero-day vulnerability in Oracle’s E-Business Suite servers. “Harvard is aware of reports that data associated with the University has been obtained […]

Vulnerabilities, Data Breach News
October 10, 2025
89 views 42 secs 0

FBI Alert: Update Red Hat OpenShift AI Now

The FBI urges all organizations using Red Hat’s OpenShift AI platform to address a 9.9/10 security flaw. It allows an attacker with authenticated access to a low-privileged account to escalate privileges, potentially leading to stolen data, disrupted services, and complete takeover of the underlying infrastructure. If you have OpenShift deployed in your environment, urgent action is […]

Vulnerabilities, News, Vendor News
October 08, 2025
75 views 42 secs 0

Critical Vulnerability Alert: Oracle E-Business Suite

The FBI Cyber Division has posted the following on LinkedIn to emphasize this critical alert and the need to patch and hunt promptly: Oracle just issued a Security Alert for CVE-2025-61882, a remote code execution vulnerability (CVSS 9.8 – Critical) affecting Oracle E-Business Suite versions 12.2.3 through 12.2.14. The vulnerability allows unauthenticated attackers to execute […]

Vulnerabilities, News
September 26, 2025
77 views 28 secs 0

UK and US security agencies order urgent fixes as Cisco firewall bugs exploited in wild

The Register reports: Cybersecurity agencies on both sides of the Atlantic are sounding the alarm over Cisco firewall vulnerabilities that are being exploited by an “advanced threat actor.” The Cybersecurity and Infrastructure Security Agency (CISA) issued an Emergency Directive on Thursday, saying there is “an unacceptable risk” to government systems if Cisco’s Adaptive Security Appliance (ASA) […]

Commentaries and Analyses, Data Breach News, Vulnerabilities
September 17, 2025
489 views 23 secs 0

Self-Replicating Worm Hits 180+ Software Packages

KrebsOnSecurity.com reports: At least 187 code packages made available through the JavaScript repository NPM have been infected with a self-replicating worm that steals credentials from developers and publishes those secrets on GitHub, experts warn. The malware, which briefly infected multiple code packages from the security vendor CrowdStrike, steals and publishes even more credentials every time an infected package is installed. […]

Data Breach News, Vendor News, Vulnerabilities
September 13, 2025
823 views 45 secs 0

FBI FLASH: Cyber Criminal Groups UNC6040 and UNC6395 Compromising Salesforce Instances for Data Theft and Extortion

The FBI has issued an alert, FLASH-20250912-001. Summary The Federal Bureau of Investigation (FBI) is releasing this FLASH to disseminate Indicators of Compromise (IOCs) associated with recent malicious cyber activities by cyber criminal groups UNC6040 and UNC6395, responsible for a rising number of data theft and extortion intrusions. Both groups have recently been observed targeting […]