Threat actors are exploiting a medium-severity vulnerability in the Gravity SMTP WordPress plugin to steal complete system details, Defiant warns. Gravity SMTP for WordPress is an email deliverability plugin that integrates with multiple SMTP providers and API-based services to allow… Read More "Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data"
Earlier this month, I spoke at the Gartner Security & Risk Management Summit about a blind spot most security programs are still not accounting for – how attackers are circumventing AI security programs by using legacy infrastructure to hijack AI… Read More "Stop Your Legacy Infrastructure from Hijacking Your AI Agents"
A supply chain attack which targeted Mastra, an open-source typescript for building AI-powered applications and agents, was the work of North Korean hackers, cybersecurity researchers have said. The attribution was made on June 19 by Microsoft Defender Security Research Team… Read More "Microsoft Attributes Mastra AI Supply Chain Attack to North Korea"
The North Korean state-sponsored threat actor Sapphire Sleet is behind the Mastra supply chain attack that hit over 140 NPM packages last week, Microsoft reports. Mastra is an open source TypeScript framework for building AI agents, workflows, and RAG pipelines.… Read More "North Korean Hackers Blamed for Mastra NPM Supply Chain Attack"
Canada’s spy service got a judge’s permission to reach into infected servers, home routers, and IoT gear sitting on Canadian soil and neutralize two foreign-run botnets. The Federal Court released a public version of the ruling on June 15. It is… Read More "Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices"
Several companies have disclosed that they were affected by a breach of business intelligence provider Klue, including at least five cybersecurity firms. Huntress, ReliaQuest, Recorded Future, Jamf and Tanium have all acknowledged using Klue’s intelligence services and confirmed that the… Read More "Klue Breach Enables Hackers to Compromise Cybersecurity Firms"
You got a World Cup ticket. It arrived in your inbox with a QR code, professional branding, and a confirmation email that looked like the real thing. Unfortunately, it wasn’t. For years, spotting a scam was relatively simple. A suspicious… Read More "World Cup Scams Are Getting Harder to Spot"
Fortinet says the large-scale credential-harvesting campaign currently targeting its customers’ firewalls and VPNs does not exploit new vulnerabilities. As part of the campaign, tracked as FortiBleed, threat actors have compiled a database of over 86,000 confirmed working credentials for Fortinet… Read More "Fortinet Responds to FortiBleed Campaign"
“CISOs need to provide input and remediation on the impact of security cost because these often-hidden costs have a negative impact on profitability,” he says. “This is usually overlooked by finance teams when analyzing the true cost of goods sold,… Read More "6 security leader tips for mastering business risk"
The UK’s National Cyber Security Centre (NCSC) has released guidance for Fortinet customers impacted by a global credential theft campaign. A database of around 75,000 credentials stolen from FortiGate firewall and SSL VPN customers was discovered by security researchers last… Read More "NCSC Urges Fortinet Customers to Tackle FortiBleed Fallout"
