Attack Feeds
An unsecured database managed by Hello Gym has exposed over 1.6 million audio recordings of gym members. Learn… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Author: Deeba Ahmed
Privacy/Governance Feed
A flaw in the Cursor extension allows unauthorized code execution when opening repositories in Visual Studio – Read More –
Attack Feeds
American furniture maker Lovesac, known for its modular couches and comfy beanbags, has warned customers that their data was breached by hackers earlier this year, and that they should remain vigilant to the threat of identity theft. Read more in my article on the Hot for Security blog. – Read More – Graham Cluley
Privacy/Governance Feed
The vulnerability, dubbed SessionReaper, allows customer account takeover and unauthenticated remote code execution – Read More –
Attack Feeds
Apple on Tuesday revealed a new security feature called Memory Integrity Enforcement (MIE) that’s built into its newly introduced iPhone models, including iPhone 17 and iPhone Air. MIE, per the tech giant, offers “always-on memory safety protection” across critical attack surfaces such as the kernel and over 70 userland processes without sacrificing device performance by … Read More “Apple iPhone Air and iPhone 17 Feature A19 Chips With Spyware-Resistant Memory Safety – The Hacker News” »
Attack Feeds
Meet Buterat, a new backdoor malware spreading through phishing and trojanized downloads, giving attackers persistent access to enterprise and government networks. – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Attack Feeds
Microsoft on Tuesday addressed a set of 80 security flaws in its software, including one vulnerability that has been disclosed as publicly known at the time of release. Of the 80 vulnerabilities, eight are rated Critical and 72 are rated Important in severity. None of the shortcomings has been exploited in the wild as a … Read More “Microsoft Fixes 80 Flaws — Including SMB PrivEsc and Azure CVSS 10.0 Bugs – The Hacker News” »
Privacy/Governance Feed
Sophos found that average ransom demands and payments fell substantially in the education sector in 2025, as recovery time and costs fell – Read More –
Attack Feeds
Introduction Managed service providers (MSPs) and managed security service providers (MSSPs) are under increasing pressure to deliver strong cybersecurity outcomes in a landscape marked by rising threats and evolving compliance requirements. At the same time, clients want better protection without managing cybersecurity themselves. Service providers must balance these growing demands with the – Read More … Read More “The Time-Saving Guide for Service Providers: Automating vCISO and Compliance Services – The Hacker News” »
Attack Feeds
The House Select Committee on China has formally issued an advisory warning of an “ongoing” series of highly targeted cyber espionage campaigns linked to the People’s Republic of China (PRC) amid contentious U.S.–China trade talks. “These campaigns seek to compromise organizations and individuals involved in U.S.-China trade policy and diplomacy, including U.S. government agencies, U.S. … Read More “China-Linked APT41 Hackers Target U.S. Trade Officials Amid 2025 Negotiations – The Hacker News” »
Privacy/Governance Feed
In a decade of digital disruption, regulatory evolution and customer expectations; traditional Banking, Financial Services and Insurance (BFSI) players… The post The Power of Collaboration: BFSI + Fintech for a Resilient Financial Ecosystem appeared first on JISA Softech Pvt Ltd. – Read More – JISA Softech Pvt Ltd
Privacy/Governance Feed
Microsoft has fixed over 80 vulnerabilities including two publicly disclosed zero-days in its latest Patch Tuesday release – Read More –
Attack Feeds
Phishing-as-a-Service (PhaaS) platforms keep evolving, giving attackers faster and cheaper ways to break into corporate accounts. Now, researchers at ANY.RUN has uncovered a new entrant: Salty2FA, a phishing kit designed to bypass multiple two-factor authentication methods and slip past traditional defenses. Already spotted in campaigns across the US and EU, Salty2FA puts enterprises at – … Read More “Watch Out for Salty2FA: New Phishing Kit Targeting US and EU Enterprises – The Hacker News” »
Privacy/Governance Feed
Wiz Security warns that a recently discovered supply chain attack campaign targeting npm is far from over – Read More –
Attack Feeds
SAP on Tuesday released security updates to address multiple security flaws, including three critical vulnerabilities in SAP Netweaver that could result in code execution and the upload arbitrary files. The vulnerabilities are listed below – CVE-2025-42944 (CVSS score: 10.0) – A deserialization vulnerability in SAP NetWeaver that could allow an unauthenticated attacker to submit a … Read More “SAP Patches Critical NetWeaver (CVSS Up to 10.0) and Previously Exploited S/4HANA Flaws – The Hacker News” »
Attack Feeds
Adobe has warned of a critical security flaw in its Commerce and Magento Open Source platforms that, if successfully exploited, could allow attackers to take control of customer accounts. The vulnerability, tracked as CVE-2025-54236 (aka SessionReaper), carries a CVSS score of 9.1 out of a maximum of 10.0. It has been described as an improper … Read More “Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts – The Hacker News” »
Attack Feeds
The top cyber official at the National Security Council said Tuesday that he’s dismayed by the lag in security technology embedded in critical infrastructure, saying it pales in comparison to the tech in modern smartphones. “I worry a lot about critical infrastructure cybersecurity,” Alexei Bulazel said at the Billington Cybersecurity Summit. “I also think about … Read More “Critical infrastructure security tech needs to be as good as our smartphones, top NSC cyber official says – CyberScoop” »
Attack Feeds
Microsoft addressed 81 vulnerabilities affecting its enterprise products and underlying Windows systems, but none have been actively exploited, the company said in its latest security update. The company’s monthly bundle of patches includes one high-severity vulnerability and eight critical defects, including three designated as more likely to be exploited. The most severe defect disclosed this … Read More “Microsoft Patch Tuesday addresses 81 vulnerabilities, none actively exploited – CyberScoop” »
Attack Feeds
Microsoft Corp. today issued security updates to fix more than 80 vulnerabilities in its Windows operating systems and software. There are no known “zero-day” or actively exploited vulnerabilities in this month’s bundle from Redmond, which nevertheless includes patches for 13 flaws that earned Microsoft’s most-dire “critical” label. Meanwhile, both Apple and Google recently released updates … Read More “Microsoft Patch Tuesday, September 2025 Edition – Krebs on Security” »
Attack Feeds
The Department of Justice unsealed an indictment against a Ukrainian national alleged to be central to a ransomware campaign affecting hundreds of companies worldwide. Volodymyr Viktorovych Tymoshchuk, known online as “deadforz,” “Boba,” “msfv,” and “farnetwork,” is accused of developing and deploying ransomware variants Nefilim, LockerGoga, and MegaCortex, all of which have been used in attacks … Read More “U.S. indicts Ukrainian national for hundreds of ransomware attacks using multiple variants – CyberScoop” »
Attack Feeds
There’s a crispness in the air – at least here in North America – and with it comes the latest security patches from Adobe and Microsoft. Take a break from your scheduled activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering … Read More “The September 2025 Security Update Review – Zero Day Initiative – Blog” »
Attack Feeds
Meta is being sued by its former head of security, who claims the company ignored repeated warnings that its messaging platform WhatsApp was riddled with security vulnerabilities and privacy violations, and retaliated against him for raising these concerns, ultimately firing him. Attaullah Baig was the head of security at Meta from 2021 until this past … Read More “Former Meta security chief sues company for privacy violations, professional retaliation – CyberScoop” »
Attack Feeds
Republic today announced a strategic partnership with Incentiv, an EVM-compatible Layer 1 blockchain designed to make Web3 simple,… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Attack Feeds
A new, sophisticated phishing kit, Salty2FA, is using advanced tactics to bypass MFA and mimic trusted brands. Read… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Gov/ISAC Feeds
Why planning and rehearsing your recovery from an incident is as vital as building your defences – Read More – NCSC Feed
Attack Feeds
The United States needs a “new, coordinated strategy” to counter its cyber adversaries and “shift the burden of risk in cyberspace from Americans to them,” National Cyber Director Sean Cairncross said Tuesday. “Collectively, we’ve made great progress in identifying, responding to and remediating threats, but we still lack strategic coherence and direction,” he said at … Read More “National cyber director: U.S. strategy needs to shift cyber risk from Americans to its adversaries – CyberScoop” »
Attack Feeds
In episode 67 of The AI Fix, Graham talks to an AI with a fax machine, Bill Gates says there’s one job AI will never replace, criminals use Claude Code for cyberattacks, Mark reveals why GPT-5 was better than you think, and a bird brings new meaning to the words “cloud storage”. Also, Graham reveals … Read More “The AI Fix #67: Will Smith’s AI crowd scandal, and gullible agents fall for scams – Graham Cluley” »
Privacy/Governance Feed
A threat actor accidentally revealed their AI-powered methods by installing Huntress security software – Read More –
Attack Feeds
Threat actors are abusing HTTP client tools like Axios in conjunction with Microsoft’s Direct Send feature to form a “highly efficient attack pipeline” in recent phishing campaigns, according to new findings from ReliaQuest. “Axios user agent activity surged 241% from June to August 2025, dwarfing the 85% growth of all other flagged user agents combined,” … Read More “Axios Abuse and Salty 2FA Kits Fuel Advanced Microsoft 365 Phishing Attacks – The Hacker News” »
Attack Feeds
Industrial conglomerate Mitsubishi Electric has agreed to acquire OT and IoT cybersecurity specialist Nozomi Networks in a transaction that values the San Francisco-based firm near the $1 billion mark. The deal, slated to close in the fourth quarter of 2025, will see Nozomi Networks become a wholly owned subsidiary while continuing to operate independently. The … Read More “Mitsubishi Electric to acquire Nozomi Networks in $1 billion deal – CyberScoop” »
Privacy/Governance Feed
Salty2FA phishing campaign showcases advanced techniques and professionalism of cybercrime operations – Read More –
Attack Feeds
A new Android malware called RatOn evolved from a basic tool capable of conducting Near Field Communication (NFC) attacks to a sophisticated remote access trojan with Automated Transfer System (ATS) capabilities to conduct device fraud. “RatOn merges traditional overlay attacks with automatic money transfers and NFC relay functionality – making it a uniquely powerful threat,” … Read More “RatOn Android Malware Detected With NFC Relay and ATS Banking Fraud Capabilities – The Hacker News” »
Privacy/Governance Feed
What could have been a historic supply chain attack seems to have been averted due to the rapid response of the open source community – Read More –
Attack Feeds
Silver Spring, USA, 9th September 2025, CyberNewsWire – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Attack Feeds
Akamai finds new Docker malware blocking rivals on exposed APIs, replacing cryptominers with tools that hint at early botnet development. – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Privacy/Governance Feed
ReliaQuest warns that phishing campaigns abusing the Axios user agent have surged 241% in three months – Read More –
Privacy/Governance Feed
A House select committee said Chinese actors impersonated Representative John Moolenaar to steal information that could be used to influence trade talks – Read More –
![[Webinar] Shadow AI Agents Multiply Fast — Learn How to Detect and Control Them – The Hacker News](https://attackfeed.com/wp-content/uploads/2025/09/webinar-qfzj3Y.webp)
Attack Feeds
⚠️ One click is all it takes. An engineer spins up an “experimental” AI Agent to test a workflow. A business unit connects to automate reporting. A cloud platform quietly enables a new agent behind the scenes. Individually, they look harmless. But together, they form an invisible swarm of Shadow AI Agents—operating outside security’s line … Read More “[Webinar] Shadow AI Agents Multiply Fast — Learn How to Detect and Control Them – The Hacker News” »
Attack Feeds
Cybersecurity researchers have discovered a variant of a recently disclosed campaign that abuses the TOR network for cryptojacking attacks targeting exposed Docker APIs. Akamai, which discovered the latest activity last month, said it’s designed to block other actors from accessing the Docker API from the internet. The findings build on a prior report from Trend … Read More “TOR-Based Cryptojacking Attack Expands Through Misconfigured Docker APIs – The Hacker News” »
Attack Feeds
Cybersecurity researchers have disclosed details of a phishing campaign that delivers a stealthy banking malware-turned-remote access trojan called MostereRAT. The phishing attack incorporates a number of advanced evasion techniques to gain complete control over compromised systems, siphon sensitive data, and extend its functionality by serving secondary plugins, Fortinet FortiGuard Labs said. ” – Read More … Read More “From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks – The Hacker News” »
Privacy/Governance Feed
Security teams have become the first and, in many cases, the last line of attack defense in the current… The post Burnout in Security Teams: Why It’s a Security Risk Too appeared first on JISA Softech Pvt Ltd. – Read More – JISA Softech Pvt Ltd
Attack Feeds
It’s budget season. Once again, security is being questioned, scrutinized, or deprioritized. If you’re a CISO or security leader, you’ve likely found yourself explaining why your program matters, why a given tool or headcount is essential, and how the next breach is one blind spot away. But these arguments often fall short unless they’re framed … Read More “How Leading CISOs are Getting Budget Approval – The Hacker News” »
Privacy/Governance Feed
Salesloft has revealed that threat actors targeted customer Salesforce data after breaching its GitHub account – Read More –
Attack Feeds
Multiple npm packages have been compromised as part of a software supply chain attack after a maintainer’s account was compromised in a phishing attack. The attack targeted Josh Junon (aka Qix), who received an email message that mimicked npm (“support@npmjs[.]help”), urging them to update their update their two-factor authentication (2FA) credentials before September 10, 2025, … Read More “20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack – The Hacker News” »
Attack Feeds
Threat hunters have discovered a set of previously unreported domains, some going back to May 2020, that are associated with China-linked threat actors Salt Typhoon and UNC4841. “The domains date back several years, with the oldest registration activity occurring in May 2020, further confirming that the 2024 Salt Typhoon attacks were not the first activity … Read More “45 Previously Unreported Domains Expose Longstanding Salt Typhoon Cyber Espionage – The Hacker News” »
Alert Feeds
Posted by Taylor Newsome on Sep 08 Reporter: [Taylor Christian Newsome / SleepRaps () gmail com] Date: [8/21/2025] Target: Discord WebRTC / Voice Gateway API Severity: Critical 1. Executive Summary A proof-of-concept (PersistentRTC) demonstrates remote code execution (RCE) capability against Discord users. The PoC enables Arbitrary JavaScript execution in a victim’s browser context via … Read More “Critical Security Report – Remote Code Execution via Persistent Discord WebRTC Automation – Full Disclosure” »
Alert Feeds
Posted by Stefan Kanthak via Fulldisclosure on Sep 08 Hi @ll, this extends the two previous posts titled Defense in depth — the Microsoft way (part 90): “Digital Signature” property sheet missing without “Read Extended Attributes” access permission <https://seclists.org/fulldisclosure/2025/Jul/39> and Defense in depth — the Microsoft way (part 91): yet another 30 year old … Read More “Defense in depth — the Microsoft way (part 92): more stupid blunders of Windows’ File Explorer – Full Disclosure” »
Alert Feeds
Posted by Ron E on Sep 08 An integer overflow vulnerability exists in the FFmpeg cache: URL protocol implementation. The CacheEntry structure uses a 32-bit signed integer to store cache entry sizes (int size), but the cache layer can accumulate cached data exceeding 2 GB. Once entry->size grows beyond INT_MAX and new data is … Read More “FFmpeg 7.0+ Integer Overflow in FFmpeg cache: Protocol (CacheEntry::size) – Full Disclosure” »
Alert Feeds
Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Sep 08 SEC Consult Vulnerability Lab Security Advisory < 20250908-0 > ======================================================================= title: NFC Card Vulnerability Exploitation Leading to Free Top-Up product: KioSoft “Stored Value” Unattended Payment Solution (Mifare) vulnerable version: Current firmware/hardware as of Q2/2025 fixed version: No version numbers available CVE number:… – Read … Read More “SEC Consult SA-20250908-0 :: NFC Card Vulnerability Exploitation Leading to Free Top-Up in KioSoft “Stored Value” Unattended Payment Solution (Mifare) – Full Disclosure” »
Alert Feeds
Posted by Taylor Newsome on Sep 08 *To:* support () mellanox com, networking-support () nvidia com *From:* Taylor Christian Newsome *Date:* August 20, 2025 *Dear Mellanox/NVIDIA Networking Support Team,* I am writing to formally submit the critical firmware parameters for Mellanox PCI Express Host Channel Adapter (HCA) cards, as detailed in the official documentation … Read More “Submission of Critical Firmware Parameters – PCIe HCA Cards – Full Disclosure” »