Author: Andy Stern
-
Per KI aufgespürt: Microsoft warnt vor Lücken in Grub2 und anderen Bootloadern
by
in SecurityNewsMit einem KI-Tool hat Microsoft 20 Sicherheitslücken in weitverbreiteten Bootloadern aufgespürt. Angreifer können damit etwa Bootkits einschleusen. First seen on golem.de Jump to article: www.golem.de/news/per-ki-aufgespuert-microsoft-warnt-vor-luecken-in-grub2-und-anderen-bootloadern-2504-194879.html
-
Neuer JFrog-Bericht warnt vor Sicherheitslücken in der Software-Lieferkette im KI-Zeitalter
by
in SecurityNewsDer Bericht thematisiert zudem die mangelnde Transparenz der Code-Herkunft in der Software-Lieferkette. Viele Entwickler laden Open-Source-Pakete direkt aus öffentlichen Registries herunter, ohne Schwachstellen oder Risiken zu berücksichtigen. Weitere Themen umfassen die Herausforderungen durch die “Sicherheits-Tool-Ausuferung” und vieles mehr. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/neuer-jfrog-bericht-warnt-vor-sicherheitsluecken-in-der-software-lieferkette-im-ki-zeitalter/a40356/
-
Hackers exploit little-known WordPress MU-plugins feature to hide malware
A new security issue is putting WordPress-powered websites at risk. Hackers are abusing the “Must-Use” plugins (MU-plugins) feature to hide malicious code and maintain long-term access on hacked websites. First seen on bitdefender.com Jump to article: www.bitdefender.com/en-us/blog/hotforsecurity/hackers-exploit-little-known-wordpress-mu-plugins-feature-to-hide-malware
-
Unbefugter Zugriff bei einer Gewerkschaft in Kalifornien, USA
by
in SecurityNewsSubmitted Breach Notification Sample First seen on oag.ca.gov Jump to article: oag.ca.gov/ecrime/databreach/reports/sb24-600575
-
BSidesLV24 Keynotes Day One: Opening Remarks
by
in SecurityNews
Tags: conferenceAuthors/Presenters: Daemon Tamer Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel. Permalink First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/03/bsideslv24-keynotes-day-one-opening-remarks/
-
Betrüger wollten Zahlungen der Bundesagentur für Arbeit umleiten
by
in SecurityNews
Tags: unclassifiedKriminelle wollten Leistungen der Bundesagentur ergaunern First seen on heise.de Jump to article: www.heise.de/news/Kriminelle-wollten-Leistungen-der-Bundesagentur-ergaunern-10333185.html
-
Earth Alux APT Group: Unveiling Its Espionage Toolkit
by
in SecurityNewsResearchers at Trend Micro detail a highly sophisticated cyber-espionage group actively targeting the Asia-Pacific and Latin American regions. First seen on securityonline.info Jump to article: securityonline.info/earth-alux-apt-group-unveiling-its-espionage-toolkit/
-
Versuchter Angriff auf einen Mailserver eines IT-Dienstleisters in Bremen, Deutschland
by
in SecurityNewsCyberangriffe auf Bremer Behörden: Fünf Attacken in vier Monaten First seen on weser-kurier.de Jump to article: www.weser-kurier.de/bremen/politik/cyberangriffe-auf-bremer-behoerden-fuenf-attacken-in-vier-monaten-doc8005bpm0hee1dacwwmne
-
Infostealer malware poses potent threat despite recent takedowns
by
in SecurityNewsHow CISOs can defend against infostealers: To defend against these threats, CISOs should rely on multi-factor authentication MFA and least privilege access to prevent their incursion into the corporate network, as well as endpoint detection and response (EDR) and anti-malware to detect and quarantine infostealers that manage to trick users into running the malware. Regular…
-
Wenn Hacker den Wasserhahn abdrehen
by
in SecurityNews
Tags: hackerWasser ist als Grundlage allen Lebens eine der wertvollsten Ressourcen. Kein Wunder also, dass auch die Wasserversorgung zunehmend zum Ziel krimineller Aktivität wird. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/wenn-hacker-den-wasserhahn-abdrehen
-
Cyberkriminalität befeuert durch KI: Endend-Sicherheit ist gefragt
by
in SecurityNewsFast 70 Prozent der deutschen Unternehmen spüren die Auswirkungen der offensiven Nutzung künstlicher Intelligenz durch Cyberkriminelle. Doch noch fehlen den meisten die Konzepte, um den teils völlig neuartigen Bedrohungsszenarien durch KI zu begegnen. Das sind Ergebnisse des aktuellsten »State of AI Cybersecurity«-Report von Darktrace [1]. KI ermöglicht nämlich auch nur mittelmäßig ausgebildeten Angreifern raffinierte und……
-
Volume of attacks on network devices shows need to replace end of life devices quickly
by
in SecurityNews
Tags: access, apache, attack, authentication, best-practice, breach, cloud, control, credentials, cve, cyber, dns, endpoint, espionage, exploit, firewall, flaw, government, group, Hardware, infrastructure, injection, Internet, ivanti, lazarus, macOS, monitoring, network, north-korea, open-source, password, risk, router, russia, sans, service, software, threat, tool, update, vulnerabilityCVE-2023-1389, a vulnerability in TP-Link Archer AX21 router;CVE-2024-3400, a hole in Palo Alto Networks PAN-OS firewall operating system;CVE-2023-36845, a vulnerability in Juniper Networks Junos OS operating system;CVE-2021-44529, a vulnerability in Ivanti Endpoint Manager Cloud Service Appliance;CVE-2023-38035, a hole in Ivanti Sentry security gateway;CVE-2024-36401, a vulnerability in OSGeo GeoServer;CVE-2024-0012, a vulnerability in Palo Alto Neworks PAN-OS…
-
CVE-2025-26633: MSC EvilTwin Zero-Day Exploited by Water Gamayun
by
in SecurityNewsIn early 2025, cybersecurity researchers uncovered a zero-day vulnerability in Microsoft’s Management Console (MMC), tracked as CVE-2025-26633 and nicknamed MSC EvilTwin. This critical flaw is being actively exploited by a threat group dubbed Water Gamayun and represents a dangerous vector… First seen on sensorstechforum.com Jump to article: sensorstechforum.com/cve-2025-26633-eviltwin-exploit/
-
Schadsoftware bei einem Stahlproduzent in der Republik China / Taiwan
by
in SecurityNewsExplanation of Our Company’s Cybersecurity Incident First seen on emops.twse.com.tw Jump to article: emops.twse.com.tw/server-java/t05sr01_1_e
-
DDoS-Angriff auf ein Wirtschaftsförderungsunternehmen in Bremen, Deutschland
by
in SecurityNewsCyberangriffe auf Bremer Behörden: Fünf Attacken in vier Monaten First seen on weser-kurier.de Jump to article: www.weser-kurier.de/bremen/politik/cyberangriffe-auf-bremer-behoerden-fuenf-attacken-in-vier-monaten-doc8005bpm0hee1dacwwmne
-
Top cybersecurity boffin, wife vanish as FBI raids homes
by
in SecurityNews
Tags: cybersecurityIndiana Uni rm -rf online profiles while agents haul boxes of evidence First seen on theregister.com Jump to article: www.theregister.com/2025/03/31/indiana_cybersecurity_professor_fbi/
-
Morphing Meerkat’s Phishing Tactics: Abusing DNS MX Records
by
in SecurityNewsA recent report has uncovered a sophisticated phishing operation that uses DNS techniques to tailor content to victims. First seen on securityonline.info Jump to article: securityonline.info/morphing-meerkats-phishing-tactics-abusing-dns-mx-records/
-
Does Your Cybersecurity Solution Deliver Value?
by
in SecurityNewsIs Your Cybersecurity Strategy Delivering Value? One pivotal question hovers in every professional’s mind: ‘Is my cybersecurity strategy delivering value?’ The answer lies deep within the nuances of Non-Human Identities (NHIs) and Secrets Security Management. What is Non-Human Identities (NHIs) and Secrets Security Management? Simply put, NHIs are machine identities used. These identities are created……
-
7 Wege, Daten (besser) zu verschlüsseln
by
in SecurityNews
Tags: ai, blockchain, business, crypto, dns, encryption, github, healthcare, infrastructure, nist, office, privacy, software, updateVerschlüsseln Sie Ihre Daten zeitgemäß?Das Konzept der Kryptografie existiert schon ein paar Hundert Jahre, wird aber von findigen Wissenschaftlern und Mathematikern immer weiter vorangetrieben. Im Rahmen dieser Entwicklungsarbeit hat sich gezeigt, dass Algorithmen noch viel mehr können, als nur Daten zu schützen: Sie sind auch in der Lage, komplexe Regeln durchzusetzen und die Zusammenarbeit zu…
-
Cyberangriff auf eine Winzergenossenschaft in Italien
by
in SecurityNewsMoncaro nel mirino degli hacker: computer bloccati da 19 giorni First seen on corriereadriatico.it Jump to article: www.corriereadriatico.it/ancona/montecarotto_moncaro_mirino_degli_hacker_computer_bloccati_da_19_giorni-8744538.html
-
Mehr als nur Backup Wie eine resiliente Datenschutzstrategie aussieht
by
in SecurityNews
Tags: backupDer World Backup Day ist kein bloßes Symbol er ist ein klarer Aufruf, blinde Flecken in der Datenschutzstrategie aufzudecken und für echten, lückenlosen Schutz zu sorgen. Doch wie sieht das Grobkonzept einer widerstandsfähigen Schutzstrategie aller Daten aus, egal wo sie liegen? First seen on itsicherheit-online.com Jump to article: www.itsicherheit-online.com/news/security-management/mehr-als-nur-backup-wie-eine-resiliente-datenschutzstrategie-aussieht/
-
Cyberangriff auf Arztpraxen in den USA
by
in SecurityNewsSimonMed Imaging Provides Notice of Security Incident First seen on prnewswire.com Jump to article: www.prnewswire.com/news-releases/simonmed-imaging-provides-notice-of-security-incident-302414648.html
-
6 hard-earned tips for leading through a cyberattack, from CSOs who’ve been there
by
in SecurityNews
Tags: attack, awareness, breach, business, cisco, ciso, control, cyber, cyberattack, cybersecurity, data, group, incident response, infosec, infrastructure, lessons-learned, military, open-source, phishing, phone, privacy, programming, ransomware, security-incident, service, skills, software, strategy, threat, training, updateDevelop muscle memory, and patience, through simulations: Authority under crisis is meaningless if you can’t establish followership. And this goes beyond the incident response team: CISOs must communicate with the entire organization, a commonly misunderstood imperative, says Pablo Riboldi, CISO of nearshore talent provider BairesDev.”I find that employee involvement tends to be overlooked during cyberattacks.…
-
Rockwell Automation Vulnerability Allows Attackers to Execute Arbitrary Commands
by
in SecurityNewsRockwell Automation has identified a critical flaw in itsVerve Asset Managersoftware, exposing industrial systems to potential exploitation. The vulnerability, tracked as CVE-2025-1449, enables attackers with administrative access to execute arbitrary commands within the containerized service environment. This flaw has been rated as critical due to its high potential impact on affected systems, particularly in industrial control…
-
Cyber-Zwischenfall bei einem Kernforschungsinstitut in Brasilien
by
in SecurityNewsAtaque cibernético suspende produção de remédios no Instituto de Pesquisas Energéticas e Nucleares First seen on convergenciadigital.com.br Jump to article: convergenciadigital.com.br/mercado/ataque-cibernetico-suspende-producao-de-remedios-no-instituto-de-pesquisas-energeticas-e-nucleares/
-
GCHQ intern took top secret spy tool home, now faces prison
by
in SecurityNewsNot exactly Snowden levels of skill First seen on theregister.com Jump to article: www.theregister.com/2025/04/01/student_gchq_theft/
-
CISA spots spawn of Spawn malware targeting Ivanti flaw
Resurge an apt name for malware targeting hardware maker that has security bug after security bug First seen on theregister.com Jump to article: www.theregister.com/2025/04/01/cisa_ivanti_warning/
-
How Secure Are Your NHIs Across the Cloud?
by
in SecurityNewsAre Your Machine Identities Trapped in a Security Blindspot? A critical question persists: How secure are your Non-Human Identities (NHIs) across the cloud? While businesses invest heavily in human-centric cybersecurity solutions, they often overlook the vulnerabilities associated with NHIs the machine identities such as servers, service accounts, applications, and bots that are integral to… First…
-
Unbefugter Zugriff bei einem Taxi-Netzwerk in Australien
by
in SecurityNews
Tags: accessPublic Notice to affected customers – 13cabs – 28 March 2028 First seen on 13cabs.com.au Jump to article: www.13cabs.com.au/data-breach-communications/