Ransomware
Microsoft says Cl0p ransomware operator has been exploiting a recently patched PaperCut vulnerability since April 13.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
Successful exploitation could lead to unexpected behavior or denial-of-service (DoS) conditions.
Vulnerabilities
It abuses CLFS and Windows Defender to trigger arbitrary file creation in the context of the antimalware process.
Malware & Threats
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root.
Vulnerabilities
Dubbed 4EverAble2Shell, the flaw could allow remote, unauthenticated attackers to execute code with root privileges.
Cybercrime
Russian cybercrime group FIN7 has been observed exploiting a Veeam Backup & Replication vulnerability patched in March 2023.
Network Security
A high-severity vulnerability in the Service Location Protocol can be exploited to launch massive DoS amplification attacks.
Vulnerabilities
Attackers can exploit Apache Superset installations with default configurations to gain administrator access and execute code on servers and databases.
Vulnerabilities
VMware this week released patches for a critical vulnerability disclosed at the Pwn2Own Vancouver 2023 hacking contest.
Endpoint Security
Over a nine-month audit, Google researchers identified ten security defects in Intel TDX, including nine vulnerabilities addressed with TDX code changes.
Malware & Threats
Researchers warn that majority of Windows and macOS PaperCut installations still vulnerable to critical vulnerability already exploited in malware attacks.
ICS/OT
Critical vulnerability found in Inea RTU can be exploited to remotely hack devices and cause disruption in industrial organizations.
Vulnerabilities
SolarWinds has patched two high-severity vulnerabilities that could lead to command execution and privilege escalation.
Vulnerabilities
A vulnerability in Google Cloud Platform allowed attackers to modify and hide OAuth applications to create a stealthy backdoor to any Google account.
Application Security
VMware warns of two critical vulnerabilities -- CVE-2023-20864 and CVE-2023-20865 -- in the VMware Aria Operations for Logs product.
Vulnerabilities
Cisco this week released patches for critical-severity vulnerabilities impacting its Industrial Network Director and Modeling Labs applications.
Vulnerabilities
Print management solutions provider PaperCut warns that exploitation of a recently patched vulnerability has commenced.
Data Breaches
Fortra has shared a summary of its investigation into the GoAnywhere zero-day incident that hit dozens of the company’s customers earlier this year.
Vulnerabilities
Google warns of another zero-day vulnerability in Chrome, only days after addressing a similar issue.
Vulnerabilities
Oracle’s April 2023 critical patch update (CPU) includes 433 new security patches, including more than 70 that fix critical vulnerabilities.
Malware & Threats
US and UK government agencies have issued a joint warning for Russian group APT28 targeting Cisco routers by exploiting an old vulnerability.
Malware & Threats
NSO Group used at least three iOS zero-click exploits in Pegasus attacks in 2022: FindMyPwn, PwnYourHome, and LatentImage.
Vulnerabilities
CISA has added two vulnerabilities to its ‘must patch’ list, including a recently fixed Chrome flaw and a macOS flaw exploited by the DazzleSpy...
Vulnerabilities
The low code/no code movement provides simplified app generation – but it needs to be understood to be safe.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)