Cybersecurity News from Across the Internet
Posted by Andrey Stoykov on Jul 07 # Exploit Title: Directory Traversal “Site Title” – bluditv3.16.2 # Date: 07/2025 # Exploit Author: Andrey Stoykov # Version: 3.16.2 # Tested on: Debian 12 # Blog: https://msecureltd.blogspot.com/ Directory Traversal “Site Title” #1: Steps to Reproduce: 1. Login with admin account and “General” > “General” 2. Set … Read More “Directory Traversal “Site Title” – bluditv3.16.2 – Full Disclosure” »
AT&T’s $177M data breach settlement. Check eligibility for payouts from 2019 and 2024 incidents. Get claim details here. – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
International Criminal Court faces new “sophisticated” cyberattack in The Hague. Occurring near the NATO summit, this incident impacts the ICC as it handles major global cases. – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
If you didn’t hear about Iranian hackers breaching US water facilities, it’s because they only managed to control a single pressure station serving 7,000 people. What made this attack noteworthy wasn’t its scale, but how easily the hackers gained access — by simply using the manufacturer’s default password “1111.” This narrow escape prompted CISA to urge manufacturers … Read More “Manufacturing Security: Why Default Passwords Must Go – The Hacker News” »
The makers of Call of Duty: World War 2 took the PC version of the game offline over the weekend amid widespread reports online that a remote code execution vulnerability was being used to take over victim computers during live multiplayer matches. On June 30, the 2017 game was released through Xbox’s GamePass service. On … Read More “Call of Duty takes PC game offline after multiple reports of RCE attacks on players – CyberScoop” »
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2014-3931 Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability CVE-2016-10033 PHPMailer Command Injection Vulnerability CVE-2019-5418 Rails Ruby on Rails Path Traversal Vulnerability CVE-2019-9621 Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability These types of vulnerabilities are … Read More “CISA Adds Four Known Exploited Vulnerabilities to Catalog – All CISA Advisories” »
In an underworld fueled by infamy and money that leaves a trail of human misery in its wake, the unbound collective colloquially known as Scattered Spider deviates from many norms in cybercrime. The cunning threat group composed of young, native English-speaking people lacks cohesion, is rife with infighting and doesn’t have a data leak site, … Read More “Scattered Spider weaves web of social-engineered destruction – CyberScoop” »
In an underworld fueled by infamy and money that leaves a trail of human misery in its wake, the unbound collective colloquially known as Scattered Spider deviates from many norms in cybercrime. The cunning threat group composed of young, native English-speaking people lacks cohesion, is rife with infighting and doesn’t have a data leak site, … Read More “Scattered Spider weaves web of social-engineered destruction – CyberScoop” »
Cybersecurity researchers have disclosed a malicious campaign that leverages search engine optimization (SEO) poisoning techniques to deliver a known malware loader called Oyster (aka Broomstick or CleanUpLoader). The malvertising activity, per Arctic Wolf, promotes fake websites hosting trojanized versions of legitimate tools like PuTTY and WinSCP, aiming to trick software professionals – Read More – … Read More “SEO Poisoning Campaign Targets 8,500+ SMB Users with Malware Disguised as AI Tools – The Hacker News” »
This month could barely have started any worse for some financial institutions in Brazil. Approximately US $140 million was stolen from the reserve accounts of six financial institutions after a cyber attack hit a service provider. Read more in my article on the Hot for Security blog. – Read More – Graham Cluley
Iran-aligned BladedFeline group has been observed targeting the government of Iraq and KRG with advanced malware – Read More –
SatanLock ransomware gang shuts down after weeks of attacks and plans to leak stolen victim data. Group linked to Babuk-Bjorka and GD Lockersec families. – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
The tax and spending bill Congress sent to President Donald Trump and that he signed into law over the holiday weekend contains hundreds of millions of dollars for cybersecurity, with a heavy emphasis on military-related spending. The biggest single pot of money under the “One Big Beautiful Bill” would be for Cyber Command, a $250 … Read More “GOP domestic policy bill includes hundreds of millions for military cyber – CyberScoop” »
Vulnerability research company WatchTowr published a detection analysis for the Citrix Blled 2 flaw – Read More –
The days when a telephone was just a device to make phone calls are long gone. Nowadays, almost everybody has a smartphone with the capability to use it as a camera, game console, map, casino, and much more. If you need some portable functionality – Read More – News and Events Feed by Topic
The days when a telephone was just a device to make phone calls are long gone. Nowadays, almost everybody has a smartphone with the capability to use it as a camera, game console, map, casino, and much more. If you need some portable functionality – Read More – News and Events Feed by Topic
When JPMorgan Chase CISO Patrick Opet published an open letter to software suppliers in April, he wasn’t just raising concerns — he was sounding an alarm. The numbers from the 2025 Verizon Data Breach Investigations Report should make every security leader lose sleep: 30% of breaches now involve third-party components, doubling from last year. But … Read More “The dual reality of AI-augmented development: innovation and risk – CyberScoop” »
When JPMorgan Chase CISO Patrick Opet published an open letter to software suppliers in April, he wasn’t just raising concerns — he was sounding an alarm. The numbers from the 2025 Verizon Data Breach Investigations Report should make every security leader lose sleep: 30% of breaches now involve third-party components, doubling from last year. But … Read More “The dual reality of AI-augmented development: innovation and risk – CyberScoop” »
Cybersecurity researchers have observed a 156% increase in credential theft incidents between 2024 and Q1 2025 – Read More –
Qantas said it is currently validating the contact, and has informed law enforcement – Read More –
Check Point has discovered over 1000 suspicious domains registered in the run-up to Amazon Prime Day – Read More –
Dr.Web reports Android malware surge in Q2 with adware, banking trojans and crypto theft hidden in fake apps, firmware and spyware targeting users. – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Distributor Ingram Micro says it has found ransomware on its internal systems – Read More –
A hacking group with ties other than Pakistan has been found targeting Indian government organizations with a modified variant of a remote access trojan (RAT) called DRAT. The activity has been attributed by Recorded Future’s Insikt Group to a threat actor tracked as TAG-140, which it said overlaps with SideCopy, an adversarial collective assessed to … Read More “TAG-140 Deploys DRAT V2 RAT, Targeting Indian Government, Defense, and Rail Sectors – The Hacker News” »
In our connected world today, data breaches pose a constant threat. Companies in every industry face the challenge to… The post The Real Cost of Breaches: A Data-Driven Perspective appeared first on JISA Softech Pvt Ltd. – Read More – JISA Softech Pvt Ltd
Cybersecurity threats have emerged so quickly that most companies struggle to keep up and executives are often the… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Threat actors are weaponizing exposed Java Debug Wire Protocol (JDWP) interfaces to obtain code execution capabilities and deploy cryptocurrency miners on compromised hosts. “The attacker used a modified version of XMRig with a hard-“coded configuration, allowing them to avoid suspicious command-line arguments that are often flagged by defenders,” Wiz researchers Yaara Shriki and Gili – … Read More “Alert: Exposed JDWP Interfaces Lead to Crypto Mining, Hpingbot Targets SSH for DDoS – The Hacker News” »
Taiwan’s National Security Bureau (NSB) has warned that China-developed applications like RedNote (aka Xiaohongshu), Weibo, TikTok, WeChat, and Baidu Cloud pose security risks due to excessive data collection and data transfer to China. The alert comes following an inspection of these apps carried out in coordination with the Ministry of Justice Investigation Bureau (MJIB) and … Read More “Taiwan NSB Alerts Public on Data Risks from TikTok, Weibo, and RedNote Over China Ties – The Hacker News” »
Another scummy stalkerware app has spilled its guts, revealing the details of its 62,000 users – and data from thousands of victims’ infected devices. – Read More – Graham Cluley
Nothing says “Holiday Weekend” like a mysterious IT outage. – Read More – Graham Cluley
Cybersecurity researchers have shed light on a previously undocumented threat actor called NightEagle (aka APT-Q-95) that has been observed targeting Microsoft Exchange servers as a part of a zero-day exploit chain designed to target government, defense, and technology sectors in China. According to QiAnXin’s RedDrip Team, the threat actor has been active since 2023 and … Read More “NightEagle APT Exploits Microsoft Exchange Flaw to Target China’s Military and Tech Sectors – The Hacker News” »
In May 2025, the U.S. government sanctioned a Chinese national for operating a cloud provider linked to the majority of virtual currency investment scam websites reported to the FBI. But a new report finds the accused continues to operate a slew of established accounts at American tech companies — including Facebook, Github, PayPal and Twitter/X. … Read More “Big Tech’s Mixed Response to U.S. Treasury Sanctions – Krebs on Security” »
Some admins of Hunters International are now part of the encryption-less cyber extortion group World Leaks – Read More –
The notorious Hunters International ransomware-as-a-service operation has announced that it has shut down, in a message posted on its dark web leak site. In a statement on its extortion site, the ransomware group says that it has not only “decided to close the Hunters International project” but is also offering free decryption tools to its … Read More “Hunters International ransomware group shuts down – but will it regroup under a new guise? – Graham Cluley” »
Effective onboarding is essential in fast-paced hospitality, with high turnover rates and a multitude of expectations as the… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Hunters International ransomware gang closes after 55 confirmed and 199 unconfirmed cyberattacks. Read about its rebrand to World… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Cisco fixes critical root credential vulnerability in Unified CM rated CVSS 10 urging users to patch now to stop remote admin takeovers. – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Taiwan warned that popular Chinese-owned apps, including TikTok and Weibo, are harvesting personal data and sending it back to servers in China – Read More –
Cybersecurity researchers have disclosed two security flaws in the Sudo command-line utility for Linux and Unix-like operating systems that could enable local attackers to escalate their privileges to root on susceptible machines. A brief description of the vulnerabilities is below – CVE-2025-32462 (CVSS score: 2.8) – Sudo before 1.9.17p1, when used with a sudoers file … Read More “Critical Sudo Vulnerabilities Let Local Users Gain Root Access on Linux, Impacting Major Distros – The Hacker News” »
Generative AI is changing how businesses work, learn, and innovate. But beneath the surface, something dangerous is happening. AI agents and custom GenAI workflows are creating new, hidden ways for sensitive enterprise data to leak—and most teams don’t even realize it. If you’re building, deploying, or managing AI systems, now is the time to ask: … Read More “Your AI Agents Might Be Leaking Data — Watch this Webinar to Learn How to Stop It – The Hacker News” »
The EU’s Quantum Strategy includes plans to develop secure quantum communication infrastructure across the region – Read More –
Google has been ordered by a court in the U.S. state of California to pay $314 million over charges that it misused Android device users’ cellular data when they were idle to passively send information to the company. The verdict marks an end to a legal class-action complaint that was originally filed in August 2019. … Read More “Google Ordered to Pay $314M for Misusing Android Users’ Cellular Data Without Permission – The Hacker News” »
