Latest Cybersecurity News and Articles
29 January 2025
The North Korean threat actor known as the Lazarus Group has been observed leveraging a "web-based administrative platform" to oversee its command-and-control (C2) infrastructure, giving the adversary the ability to centrally supervise all aspects of their campaigns.
"Each C2 server hosted a web-based administrative platform, built with a React application and a Node.js API," SecurityScorecard's
29 January 2025
GreyNoise reports active exploitation of a newly discovered zero-day vulnerability in Zyxel CPE devices. There are no patches available.
The post New Zyxel Zero-Day Under Attack, No Patch Available appeared first on SecurityWeek.
29 January 2025
Oligo Security has raised $50 million in Series B funding for its application detection and response (ADR) platform.
The post Oligo Raises $50M to Tackle Application Detection and Response appeared first on SecurityWeek.
29 January 2025
What threats do security leaders need to worry about? Answer this question and more with Corey Nachreiner, CISO at WatchGuard.
29 January 2025
Cyber experts delve into DeepSeek, the Chinese artificial intelligence model.
29 January 2025
New CPU side-channel attacks named SLAP and FLOP can be exploited to remotely steal data from Apple mobile and desktop devices.
The post New SLAP and FLOP CPU Attacks Expose Data From Apple Computers, Phones appeared first on SecurityWeek.
29 January 2025
The Mirai-based Aquabot botnet has been targeting a vulnerability in Mitel SIP phones for which a proof-of-concept (PoC) exploit exists.
The post Aquabot Botnet Targeting Vulnerable Mitel Phones appeared first on SecurityWeek.
29 January 2025
An account takeover vulnerability has been discovered in a popular online travel service.
29 January 2025
Engineering firm Smiths Group has disclosed a cyberattack that forced it to take some systems offline and activate business continuity plans.
The post Smiths Group Scrambling to Restore Systems Following Cyberattack appeared first on SecurityWeek.
29 January 2025
Curious about the buzz around AI in cybersecurity? Wonder if it's just a shiny new toy in the tech world or a serious game changer? Let's unpack this together in a not-to-be-missed webinar that goes beyond the hype to explore the real impact of AI on cybersecurity.
Join Ravid Circus, a seasoned pro in cybersecurity and AI, as we peel back the layers of AI in cybersecurity through a revealing
29 January 2025
Rockwell Automation has released six new security advisories to inform customers about several critical and high-severity vulnerabilities.
The post Rockwell Patches Critical, High-Severity Vulnerabilities in Several Products appeared first on SecurityWeek.
29 January 2025
Artificial intelligence is upending cybersecurity. It is used by adversaries in their attacks, and by defenders in their defense.
The post Cyber Insights 2025: Artificial Intelligence appeared first on SecurityWeek.
29 January 2025
A team of security researchers from Georgia Institute of Technology and Ruhr University Bochum has demonstrated two new side-channel attacks targeting Apple silicon that could be exploited to leak sensitive information from web browsers like Safari and Google Chrome.
The attacks have been codenamed Data Speculation Attacks via Load Address Prediction on Apple Silicon (SLAP) and Breaking the
29 January 2025
Threat actors have been exploiting SimpleHelp remote access software shortly after the disclosure of three vulnerabilities.
The post SimpleHelp Remote Access Software Exploited in Attacks appeared first on SecurityWeek.
29 January 2025
Ransomware attacks have reached an unprecedented scale in the healthcare sector, exposing vulnerabilities that put millions at risk. Recently, UnitedHealth revealed that 190 million Americans had their personal and healthcare data stolen during the Change Healthcare ransomware attack, a figure that nearly doubles the previously disclosed total.
This breach shows just how deeply ransomware
29 January 2025
A critical security flaw has been disclosed in the Cacti open-source network monitoring and fault management framework that could allow an authenticated attacker to achieve remote code execution on susceptible instances.
The flaw, tracked as CVE-2025-22604, carries a CVSS score of 9.1 out of a maximum of 10.0.
"Due to a flaw in the multi-line SNMP result parser, authenticated users can inject
29 January 2025
Frenos, a company that has developed an autonomous OT security assessment platform, has raised $3.88 million in seed funding.
The post Frenos Raises $3.88M in Seed Funding for OT Security Assessment Platform appeared first on SecurityWeek.
29 January 2025
The advanced persistent threat (APT) group known as UAC-0063 has been observed leveraging legitimate documents obtained by infiltrating one victim to attack another target with the goal of delivering a known malware dubbed HATVIBE.
"This research focuses on completing the picture of UAC-0063's operations, particularly documenting their expansion beyond their initial focus on Central Asia,
29 January 2025
Broadcom has alerted of a high-severity security flaw in VMware Avi Load Balancer that could be weaponized by malicious actors to gain entrenched database access.
The vulnerability, tracked as CVE-2025-22217 (CVSS score: 8.6), has been described as an unauthenticated blind SQL injection.
"A malicious user with network access may be able to use specially crafted SQL queries to gain database
29 January 2025
Cybersecurity researchers are warning that a critical zero-day vulnerability impacting Zyxel CPE Series devices is seeing active exploitation attempts in the wild.
"Attackers can leverage this vulnerability to execute arbitrary commands on affected devices, leading to complete system compromise, data exfiltration, or network infiltration," GreyNoise researcher Glenn Thorpe said in an alert