⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
HashiCorp, Veeam, and Django have patched 11 vulnerabilities, including a critical cross-tenant flaw in Terraform MCP Server (CVSS 10.0) and an unauthenticated credential theft in Veeam Service Provider Console (CVSS 9.5). The flaws are not yet exploited, but operators should update to the latest versions to mitigate risks.
This article outlines a 72-hour timeline of a credential-based attack, showing how a single stolen password can lead to a full breach. It emphasizes that attackers quickly escalate from initial access to data exfiltration and ransomware.
This article details the 72-hour attack lifecycle from initial credential theft to ransomware deployment. It highlights that critical phases like lateral movement occur between hours 36-60.
This article explains how AI-driven phishing renders traditional blocklists ineffective because attackers rapidly create and dismantle infrastructure. It notes that phishing kits have evolved with AI-assisted development and criminal PhaaS kits.
This article reports a wave of cyberattacks on water systems across multiple U.S. states, likely linked to Iranian hackers. The attacks disrupt operational technology, causing boil water advisories and flooding.
This article reports on the NullReceiver technique, a refinement of the EtherHiding method that hides C2 IP addresses within Ethereum transfer recipient addresses. The technique was found in two malicious npm packages, which have been downloaded hundreds of times and are linked to North Korean threat actors.