Apr 09, 2025The Hacker NewsSecrets Management / DevOps GitGuardian’s State of Secrets Sprawl report for 2025 reveals the alarming scale of secrets exposure in modern software environments. Driving this is the rapid growth of non-human identities (NHIs), which have been… Read More "Explosive Growth of Non-Human Identities Creating Massive Security Blind Spots"
Apr 09, 2025Ravie LakshmananEndpoint Security / Vulnerability Microsoft has released security fixes to address a massive set of 126 flaws affecting its software products, including one vulnerability that it said has been actively exploited in the wild. Of the 126… Read More "Microsoft Patches 126 Flaws Including Actively Exploited Windows CLFS Vulnerability"
Apr 09, 2025Ravie LakshmananSoftware Security / Vulnerability Adobe has released security updates to fix a fresh set of security flaws, including multiple critical-severity bugs in ColdFusion versions 2025, 2023 and 2021 that could result in arbitrary file read and code execution.… Read More "Adobe Patches 11 Critical ColdFusion Flaws Amid 30 Total Vulnerabilities Discovered"
Threat actors have been observed distributing malicious payloads such as cryptocurrency miner and clipper malware via SourceForge, a popular software hosting service, under the guise of cracked versions of legitimate applications like Microsoft Office. “One such project, officepackage, on the… Read More "Cryptocurrency Miner and Clipper Malware Spread via SourceForge Cracked Software Listings"
Apr 08, 2025Ravie LakshmananNetwork Security / Vulnerability Fortinet has released security updates to address a critical security flaw impacting FortiSwitch that could permit an attacker to make unauthorized password changes. The vulnerability, tracked as CVE-2024-48887, carries a CVSS score of… Read More "Fortinet Urges FortiSwitch Upgrades to Patch Critical Admin Password Change Flaw"
Apr 08, 2025Ravie LakshmananCloud Security / Vulnerability Cybersecurity researchers have disclosed details of a now-patched security flaw in the Amazon EC2 Simple Systems Manager (SSM) Agent that, if successfully exploited, could permit an attacker to achieve privilege escalation and code… Read More "Amazon EC2 SSM Agent Flaw Patched After Privilege Escalation via Path Traversal"
The Computer Emergency Response Team of Ukraine (CERT-UA) has revealed a new set of cyber attacks targeting Ukrainian institutions with information-stealing malware. The activity is aimed at military formations, law enforcement agencies, and local self-government bodies, particularly those located near… Read More "UAC-0226 Deploys GIFTEDCROOK Stealer via Malicious Excel Files Targeting Ukraine"
Security Operations Centers (SOCs) today face unprecedented alert volumes and increasingly sophisticated threats. Triaging and investigating these alerts are costly, cumbersome, and increases analyst fatigue, burnout, and attrition. While artificial intelligence has emerged as a go-to solution, the term “AI”… Read More "Agentic AI in the SOC"
Apr 08, 2025Ravie LakshmananCyber Attack / Vulnerability A recently disclosed critical security flaw impacting CrushFTP has been added by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to its Known Exploited Vulnerabilities (KEV) catalog after reports emerged of active exploitation… Read More "CISA Adds CrushFTP Vulnerability to KEV Catalog Following Confirmed Active Exploitation"
Apr 08, 2025Ravie LakshmananMobile Security / Vulnerability Google has shipped patches for 62 vulnerabilities, two of which it said have been exploited in the wild. The two high-severity vulnerabilities are listed below – CVE-2024-53150 (CVSS score: 7.8) – An out-of-bounds… Read More "Google Releases Android Update to Patch Two Actively Exploited Vulnerabilities"
