Penetration Testing

NOVEMBER 24, 2024

A high-severity vulnerability (CVE-2024-11477) has been discovered in the popular file archiver 7-Zip, potentially allowing attackers to execute malicious code on vulnerable systems. The flaw, identified by Nicholas Zubrisky of... The post CVE-2024-11477: 7-Zip Vulnerability Allows Remote Code Execution, Update Now!

Cybersecurity 145

Cybersecurity 145

Penetration Testing

OCTOBER 23, 2024

Fortinet has issued a security advisory for its FortiManager platform, addressing a critical vulnerability—CVE-2024-47575—which has been actively exploited in the wild. arises from a... The post Fortinet Warns of Actively Exploited Flaw in FortiManager: CVE-2024-47575 (CVSS 9.8) This vulnerability, rated at CVSS 9.8,

Cybersecurity 133

Cybersecurity 133

Penetration Testing

OCTOBER 20, 2024

The vulnerability, tracked as CVE-2024-30090 and assigned a CVSS score of 7.0, could... The post Microsoft Windows Flaw: CVE-2024-30090 PoC Exploit Published, Posing SYSTEM Privilege Threat appeared first on Cybersecurity News.

Cybersecurity 144

Cybersecurity 144

Security Affairs

NOVEMBER 12, 2024

Microsoft Patch Tuesday security updates for November 2024 addressed 89 vulnerabilities, including two actively exploited zero-day flaws. CVE-2024-49039 : A Windows Task Scheduler privilege escalation flaw allows AppContainer escape, enabling low-privileged users to run code at Medium integrity. Immediate patching is recommended.

Internet 128

Internet Internet Hacking Data breaches 128

Penetration Testing

DECEMBER 8, 2024

A critical use-after-free vulnerability, identified as CVE-2024-38193, has been discovered in the afd.sys Windows driver. poses a significant threat to Windows systems,... The post Windows Zero-Day Vulnerability CVE-2024-38193 Exploited in the Wild: PoC Published appeared first on Cybersecurity News.

Cybersecurity 145

Cybersecurity 145

Security Affairs

JUNE 9, 2025

A new variant of the Mirai botnet exploits CVE-2024-3721 to target DVR systems, using a new infection method. Researchers from Russian cybersecurity firm Kaspersky discovered a new variant of the Mirai botnet that exploits a command injection vulnerability ( CVE-2024-3721 ) in TBK DVR-4104 and DVR-4216 digital video recording devices.

IoT 137

IoT Firmware Malware Architecture 137

Penetration Testing

NOVEMBER 14, 2024

A critical security vulnerability, CVE-2024-52301, has been identified in the Laravel framework, a popular web application framework known for its elegant syntax and comprehensive toolset for building robust applications.

Cybersecurity 145

Cybersecurity 145

Penetration Testing

NOVEMBER 19, 2024

CVE-2024-47533 exposes Cobbler servers to unauthorized access and control, enabling attackers to manipulate system configurations.

Cybersecurity 133

Cybersecurity 133

Penetration Testing

DECEMBER 22, 2024

The Apache Software Foundation recently released a critical security update to address a remote code execution (RCE) vulnerability in Apache Tomcat, identified as CVE-2024-56337.

Software 141

Software Cybersecurity 141

Penetration Testing

JUNE 7, 2025

A new Mirai botnet variant is exploiting CVE-2024-3721 to infect vulnerable DVRs. Learn how this sophisticated attack works and if your surveillance system is at risk.

Surveillance 121

Surveillance Risk DDOS IoT 121

Penetration Testing

OCTOBER 30, 2024

In a thrilling showdown at the recent Pwn2Own Ireland 2024 hacking competition, white hat hackers YingMuo (@YingMuo), in collaboration with the DEVCORE Internship Program, successfully exploited a critical zero-day vulnerability... The post CVE-2024-50387: Critical QNAP Flaw Exploited in Hacking Contest, Patch Now!

Hacking 129

Hacking Cybersecurity 129

Penetration Testing

OCTOBER 27, 2024

The SonicWall Capture Labs Threat Research Team has published an in-depth analysis of CVE-2024-38812, a critical heap-overflow vulnerability found in VMware vCenter Server.

Cybersecurity 141

Cybersecurity 141

Security Affairs

JANUARY 3, 2025

Experts warn of a new PoC exploit, LDAPNightmare, that targets a Windows LDAP flaw (CVE-2024-49113), causing crashes & reboots. The vulnerability CVE-2024-49113 (CVSS score of 7.5), namedLDAPNightmare, is a Windows Lightweight Directory Access Protocol (LDAP) Denial of Service flaw that was discovered by the researcher Yuki Chen.

DNS 125

DNS Internet Internet Hacking 125

Penetration Testing

DECEMBER 31, 2024

A security researcher published a proof-of-concept (PoC) exploit for CVE-2024-21182, a critical vulnerability in Oracle WebLogic Server. Rated at CVSS 7.5,

Cybersecurity 122

Cybersecurity 122

Security Affairs

OCTOBER 22, 2024

VMware failed to fully address a remote code execution flaw, tracked as CVE-2024-38812 (CVSS score: 9.8), in its vCenter Server platform. In September, Broadcom released security updates to the vulnerability CVE-2024-38812. During the 2024 Matrix Cup hacking contest in China, zbl & srs of team TZL demonstrated the vulnerability.

Hacking 141

Hacking Government Software Information Security 141

Penetration Testing

DECEMBER 3, 2024

One of these... The post CVE-2024-42448 (CVSS 9.9): Critical RCE Vulnerability in Veeam VSPC appeared first on Cybersecurity News. Veeam Software, a prominent provider of backup and disaster recovery solutions, has released urgent security updates to address two critical vulnerabilities in its Service Provider Console (VSPC).

Backups 138

Backups Software Cybersecurity 138

Penetration Testing

NOVEMBER 15, 2024

A critical vulnerability (CVE-2024-49369) has been discovered in Icinga 2, a... The post CVE-2024-49369 (CVSS 9.8): Critical Flaw in Icinga 2 Allows for Impersonation and RCE appeared first on Cybersecurity News.

Cybersecurity 131

Cybersecurity 131

SecureList

MARCH 3, 2025

The statistics for previous years may differ from earlier publications due to a data and methodology revision implemented in 2024. The year in figures According to Kaspersky Security Network, in 2024: A total of 33.3 The year’s trends In 2024, cybercriminals launched a monthly average of 2.8 A total of 1.1

Mobile 117

Mobile Malware Adware Banking 117

Penetration Testing

NOVEMBER 25, 2024

The vulnerability, identified as... The post Palo Alto Networks Warns of GlobalProtect App Flaw with Public Exploit Code (CVE-2024-5921) appeared first on Cybersecurity News.

Software 137

Software Cybersecurity 137

We Live Security

MAY 19, 2025

This issue of the ESET APT Activity Report reviews notable activities of APT group that were documented by ESET researchers from October 2024 until March 2025.

122

122

The Last Watchdog

DECEMBER 5, 2024

5, 2024, CyberNewswire — One Identity proudly announces it has been named a winner in the Hot Company: Privileged Access Management (PAM) category in the 12th annual Cyber Defense Awards by Cyber Defense Magazine (CDM), the industrys leading information security magazine. Alisa Viejo, Calif.,

InfoSec 130

InfoSec Cyber Risk CISO Cybersecurity 130

Security Affairs

MARCH 10, 2025

Threat actors exploit PHP flaw CVE-2024-4577 for remote code execution. GreyNoise researchers warn of a large-scale exploitation of a critical vulnerability, tracked as CVE-2024-4577 (CVSS 9.8), in PHP. The flaw CVE-2024-4577 (CVSS score: 9.8) Over 1,000 attacks detected globally. is a PHP-CGI OS Command Injection Vulnerability.

DDOS 103

DDOS Security Intelligence Hacking Malware 103

Google Security

MARCH 7, 2025

Posted by Dirk Ghmann In 2024, our Vulnerability Reward Program confirmed the ongoing value of engaging with the security research community to make Google and its products safer. Chrome Chrome did some remodeling in 2024 as we updated our reward amounts and structure to incentivize deeper research. million in total.

Mobile 103

Mobile Hacking Engineering Technology 103

Penetration Testing

JANUARY 20, 2025

Security researcher Joward has published an in-depth analysis and Proof of Concept (PoC) exploit for a critical vulnerability, The post TP-Link Vulnerability: PoC Exploit for CVE-2024-54887 Reveals Remote Code Execution Risks appeared first on Cybersecurity News.

Risk 145

Risk Cybersecurity 145

Security Affairs

APRIL 29, 2025

Google tracked 75 zero-day flaws exploited in 2024, down from 98 in 2023, according to its Threat Intelligence Group’s latest analysis. In 2024, Google tracked 75 exploited zero-day vulnerabilities, down from 98 in 2023 but up from 63 in 2022. In 2024, over half of zero-days enabled remote code execution or privilege escalation.

Surveillance 109

Surveillance Mobile Software Hacking 109

Security Affairs

JANUARY 15, 2025

Microsoft disclosed details of a now-patched macOS flaw, tracked as CVE-2024-44243 (CVSS score: 5.5), that allows attackers with “root” access to bypass System Integrity Protection ( SIP ). SIP in macOS safeguards the system by blocking the execution of unauthorized code.

Malware 112

Malware Hacking Information Security 112

Security Affairs

FEBRUARY 16, 2025

Russia-linked group Storm-2372 used the device code phishing technique since Aug 2024 to steal login tokens from governments, NGOs, and industries. ” reads the report published by Microsoft Threat Intelligence. “Microsoft assesses with medium confidence that Storm-2372 aligns with Russian interests, victimology, and tradecraft.”

Phishing 115

Phishing Authentication Telecommunications Accountability 115

Penetration Testing

APRIL 24, 2025

A newly disclosed vulnerability in Apples proprietary libAppleArchive library, tracked as CVE-2024-27876, enables attackers to achieve arbitrary file The post CVE-2024-2787: Apple Archive Flaw Enables Arbitrary File Write and Gatekeeper Bypass, PoC Releases appeared first on Daily CyberSecurity.

Cybersecurity 110

Cybersecurity 110

Krebs on Security

OCTOBER 30, 2024

Change Healthcare says it has notified approximately 100 million Americans that their personal, financial and healthcare records may have been stolen in a February 2024 ransomware attack that caused the largest ever known data breach of protected health information. A post about the Change breach from RansomHub on April 8, 2024.

Healthcare 300

Healthcare Insurance Computers and Electronics Data breaches 300

Schneier on Security

MARCH 25, 2025

This person received an Apple threat notification in November 2024, but no WhatsApp notification. Our analysis showed an attempt to infect the device with novel spyware in June 2024. We shared details with Apple, who confirmed they had patched the attack in iOS 18. Other Surveillance Tech Deployed Against The Same Italian Cluster.

Spyware 219

Spyware Surveillance Technology 219

Krebs on Security

DECEMBER 29, 2024

Maybe it’s indelicate to celebrate the birthday of a cybercrime blog that mostly publishes bad news, but happily many of 2024’s most engrossing security stories were about bad things happening to bad guys. In case you missed any of them, here’s a recap of 2024’s most-read stories.

Scams 241

Scams Cybercrime Cryptocurrency Social Engineering 241

Krebs on Security

DECEMBER 3, 2024

Phishing attacks increased nearly 40 percent in the year ending August 2024, with much of that growth concentrated at a small number of new generic top-level domains (gTLDs) — such as.shop ,top ,xyz — that attract scammers with rock-bottom prices and no meaningful registration requirements, new research finds.

Cybercrime 300

Cybercrime Phishing Accountability Internet 300

Krebs on Security

MAY 29, 2025

“Americans lose billions of dollars annually to these cyber scams, with revenues generated from these crimes rising to record levels in 2024,” reads a statement from the U.S. In May 2024, KrebsOnSecurity published a deep dive on Stark Industries Solutions that found much of the malicious traffic traversing Starks network (e.g.

Scams 224

Scams Internet Internet Cybercrime 224

Krebs on Security

JANUARY 14, 2025

was also credited with discovering a flaw in the December 2024 Patch Tuesday release ( CVE-2024-49142 ). Tracked as CVE-2025-21186 , CVE-2025-21366 , and CVE-2025-21395 , these are remote code execution bugs that are exploitable if an attacker convinces a target to download and run a malicious file through social engineering.

Artificial Intelligence 290

Artificial Intelligence Social Engineering Encryption Internet 290

Krebs on Security

FEBRUARY 11, 2025

Tenable senior staff research engineer Satnam Narang noted that since 2022, there have been nine elevation of privilege vulnerabilities in this same Windows component — three each year — including one in 2024 that was exploited in the wild as a zero day (CVE-2024-38193).

Artificial Intelligence 213

Artificial Intelligence Engineering Software Internet 213

Adam Shostack

JANUARY 2, 2025

A less busy month in appsec, AI, and regulation, but still interesting stories Im going to kick off with two interesting engineering stories. First, the Washington Post reports on how Officials studied Baltimore bridge risks but didnt prepare for ship strike that discusses the challenges of securing bridges against modern cargo ships.

Engineering 130

Engineering Software Cybersecurity Risk 130

Adam Shostack

JANUARY 2, 2025

A busy month in appsec, AI, and regulation. Breaking: Alec Muffett reports that Ross Anderson has passed away. Ross was a giant of the field and Im shocked. Regulation The White House released a report on memory safe languages. Stop, read those words again. Press release , technical report.)

Software 130

Software Advertising Hacking 130