22-Year-Old IPMI Flaw Exposes 24,000 Servers to Offline Password Cracking
Researchers found 24,650 public BMC interfaces leaking IPMI password hashes, exposing servers to offline password cracking through a decades-old protocol flaw.
general
20 articles
Critical WordPress Plugin Backdoor Exposes 20,000 Sites to Full Administrator Takeover
A critical supply-chain compromise in a widely used WordPress plugin has exposed approximately 20,000 websites to potential administrator takeover. Researche...
Accuris uses AI to improve BOM decisions and supply chain resilience
Accuris has announced new AI capabilities for BOM Intelligence, part of its Supply Chain Intelligence suite. The launch gives engineering, procurement and su...
Transparency, The Key To Team Motivation For Remote Workers - Charles Gaudet - BSW #458
Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass
Cybersecurity researchers have shared additional technical details about a recently patched critical security flaw impacting Check Point Security Management ...
JFrog Zero-Days Exploited in OpenAI-Hugging Face Hack
The OpenAI models targeted services beyond Hugging Face as they attempted to solve the tasks they were given. The post JFrog Zero-Days Exploited in OpenAI-Hu...
FortiGate 1200G brings FortiSASE Outpost to customer-controlled environments
Fortinet has announced the FortiGate 1200G series, the newest addition to the FortiGate G series with FortiSASE Outpost, which brings cloud-delivered securit...
Stolen Meta and Google ad accounts are worth more than the money they hold
Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy complete wi...
NCSC Publishes Guidance to Aid Incident Response and Recovery
The National Cyber Security Centre has released a detailed framework to assist with incident response and recovery
VPN Breach Exposes 58 Million Connection Logs Despite “No-Logs” Claims
A breached “no-logs” VPN exposed 58 million connection logs and millions of user, device, and payment records, contradicting its privacy claims. A threat act...
1Password targets standing privileges with new access management capabilities
1Password has launched 1Password Privileged Access, extending the 1Password Unified Access platform with privileged access management (PAM). It enables just-...
WhatsApp brings end-to-end encrypted voice and video calls to the web
WhatsApp has launched support for voice and video calls on the web, allowing users to make and receive calls directly from their browser without installing t...
Flying Eagle RAT Abuses Android Accessibility Services for Keylogging, Screen Capture and Gesture Injection
A newly analyzed Android remote access trojan (RAT) dubbed “Flying Eagle” is leveraging Accessibility Services to enable large-scale surveillance, credential...
Torq makes AI SOC investigations continuously self-learning
Torq has introduced Torq SOC Brain, a new layer of the Torq AI SOC Platform that continuously learns from historical investigations, analyst decisions, and o...
Root Evidence puts real-world evidence at the center of vulnerability prioritization
Root Evidence has launched the Evidence Platform, a vulnerability management platform that prioritizes vulnerabilities based on evidence of real-world exploi...
Abnormal AI extends behavioral security to identities, AI systems, and insider threats
Abnormal AI has announced the expansion of its Behavioral Security Platform across the enterprise, introducing three new products: Identity Threat Protection...
Dozens of Minnesota Water Utilities Targeted in Coordinated OT Attacks
State and federal agencies respond after intrusions disrupt automated controls at municipal water and wastewater utilities. The post Dozens of Minnesota Wate...
Mend.io enhances application security with AI runtime protection and faster zero-day response
Mend.io has announced new capabilities across Mend AI and Mend AppSec to help organizations respond faster to both application risk and the expanding attack ...
New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands
Gitea, the self-hosted Git platform, has patched a critical remote code execution vulnerability. A user with ordinary repository write access can turn attack...
Realm Security adds Detection Integrity and Data Haven Search to cut SIEM costs
Realm Security has announced two new capabilities. Detection Integrity proves that reducing SIEM log volume never breaks a threat detection.