Jane Frankland

APRIL 15, 2025

One of my friends, Greg van der Gaast tells this great story that perfectly illustrates one of the biggest challenges we face in cybersecurity today. It goes something like this… “Imagine someone who loves coffee. They have a fantastic coffee shop just steps from their home, serving the best lattes and espressos in town. But instead of strolling over to enjoy this local gem, they hop in their car and drive miles away for an average cup from a chain caf.

Risk 100

Risk Technology Cybersecurity Security Awareness 100

Schneier on Security

APRIL 16, 2025

Mitre’s CVE’s program—which provides common naming and other informational resources about cybersecurity vulnerabilities—was about to be cancelled , as the US Department of Homeland Security failed to renew the contact. It was funded for eleven more months at the last minute. This is a big deal. The CVE program is one of those pieces of common infrastructure that everyone benefits from.

CSO 322

CSO Government Software Cybersecurity 322

Adam Shostack

APRIL 15, 2025

CVE funding is apparently not being renewed. I havent been operationally involved for a long time and Im sorry for what the team is going through. Im not alone in having strong feelings, and I want to talk about some of the original use cases that informed us as we set up the system. (You might also enjoy my thoughts on 25 Years of CVE for some context.

Government 200

Government Malware 200

The Last Watchdog

APRIL 16, 2025

Palo Alto, Calif, Apr. 16, 2025, CyberNewswire — SquareX researchers Jeswin Mathai and Audrey Adeline will be disclosing a new class of data exfiltration techniques at BSides San Francisco 2025. Titled Data Splicing Attacks: Breaking Enterprise DLP from the Inside Out , the talk will demonstrate multiple data splicing techniques that will allow attackers to exfiltrate any sensitive file or clipboard data, completely bypassing major Data Loss Protection (DLP) vendors listed by Gartner by ex

Architecture 147

Architecture Ransomware Data breaches Education 147

Speaker: Erroll Amacker

Automation is transforming finance but without strong financial oversight it can introduce more risk than reward. From missed discrepancies to strained vendor relationships, accounts payable automation needs a human touch to deliver lasting value. This session is your playbook to get automation right. We’ll explore how to balance speed with control, boost decision-making through human-machine collaboration, and unlock ROI with fewer errors, stronger fraud prevention, and smoother operations.

Risk

Javvad Malik

APRIL 15, 2025

You’re so busy climbing the corporate ladder that you can’t spare five minutes to ring mum and dad. But fear not! For a mere 24.90 a month, you can now hire a silicon-based impersonator to pretend it cares about your parents’ day. Welcome to inTouch Family, the service that lets you tick “filial piety” off your to-do list without all that pesky human interaction.

Technology 165

Technology Media Authentication 165

Schneier on Security

APRIL 14, 2025

The Wall Street Journal has the story : Chinese officials acknowledged in a secret December meeting that Beijing was behind a widespread series of alarming cyberattacks on U.S. infrastructure, according to people familiar with the matter, underscoring how hostilities between the two superpowers are continuing to escalate. The Chinese delegation linked years of intrusions into computer networks at U.S. ports, water utilities, airports and other targets, to increasing U.S. policy support for Taiwa

Hacking 266

Hacking 266

Malwarebytes

APRIL 16, 2025

If you sometimes feel that the internet isn’t the same vibrant place it used to be, you’re not alone. New research suggests that most of the traffic traversing the network isn’t human at all. Bots (software programs that interact with web sites) have been ubiquitous for years. But in its 2025 Bad Bot Report , application security company Imperva claimed this is the first time traffic from bots became more prevalent than human traffic.

Internet 144

Internet Internet Passwords Artificial Intelligence 144

The Last Watchdog

APRIL 15, 2025

Last Friday morning, April 11, I was making my way home from NTT Researchs Upgrade 2025 innovation conference in San Francisco, when it struck me that were at a watershed moment. I was reflecting on NTTs newly launched Physics of Artificial Intelligence Lab when a GeekWire article crossed my LinkedIn feed, touting a seemingly parallel initiative by Amazon.

Artificial Intelligence 147

Artificial Intelligence Engineering Retail Government 147

Schneier on Security

APRIL 17, 2025

Discord is testing the feature: “We’re currently running tests in select regions to age-gate access to certain spaces or user settings,” a spokesperson for Discord said in a statement. “The information shared to power the age verification method is only used for the one-time age verification process and is not stored by Discord or our vendor.

Hacking 215

Hacking Media 215

Security Affairs

APRIL 16, 2025

Cheap Chinese Android phones ship with trojanized WhatsApp and Telegram clones hiding crypto clippers, active since June 2024. Since June 2024, Doctor Web researchers found cheap Android phones preloaded with fake WhatsApp and Telegram apps designed to steal crypto via clipping. These clippers swap copied wallet addresses with the attackers own. The campaign targeted low-end phones mimicking famous models, using altered system info to trick users.

Malware 131

Malware Manufacturing Mobile Spyware 131

Advertisement

Many cybersecurity awareness platforms offer massive content libraries, yet they fail to enhance employees’ cyber resilience. Without structured, engaging, and personalized training, employees struggle to retain and apply key cybersecurity principles. Phished.io explains why organizations should focus on interactive, scenario-based learning rather than overwhelming employees with excessive content.

Cyber threats

Malwarebytes

APRIL 16, 2025

In a new version of the old Hello pervert emails, scammers are relying on classic email spoofing techniques to try and convince victims that they have lost control of their email account and computer systems. Email spoofing basically comes down to sending emails with a false sender address, a method in use in various ways by scammers. Obviously, pretending to be someone else can have its advantages, especially if that someone else holds a position of power or trust with regards to the receiver

Accountability 125

Accountability Scams Passwords Phishing 125

The Last Watchdog

APRIL 16, 2025

Just hours before it was set to expire on April 16, the federal contract funding MITREs stewardship of the CVE (Common Vulnerabilities and Exposures) program was given a temporary extension by CISA. Related: Brian Krebs’ take on MITRE funding expiring This averted an immediate shutdown, but it didnt solve the underlying problem. Far from it. The system that underpins vulnerability disclosurethe nervous system of cybersecurity risk managementis showing signs of structural fatigue.

Architecture 130

Architecture Risk Cybersecurity Internet 130

Jane Frankland

APRIL 18, 2025

Imagine building a house on sand or precariously stacking blocks in a game of Jenga. No matter how carefully you place the materials or how advanced the tools you use, the structure is doomed to collapse without a strong, stable foundation. This is the state of cybersecurity today. Organisations invest heavily in governance, risk, and compliance (GRC) and risk management efforts while neglecting foundational elements like leadership and culture.

Cybersecurity 130

Cybersecurity Technology Risk Security Awareness 130

Security Affairs

APRIL 13, 2025

China admitted in a secret meeting with U.S. officials that it conducted Volt Typhoon cyberattacks on U.S. infrastructure, WSJ reports. China reportedly admitted in a secret meeting with U.S. officials that it carried out cyberattacks on U.S. infrastructure, linked to the Volt Typhoon campaign. According to the Wall Street Journal, at a December Geneva summit, Chinese officials indirectly admitted to Volt Typhoon cyberattacks on U.S. infrastructure, reportedly linked to U.S.

Hacking 132

Hacking Manufacturing Education Government 132

Advertisement

The DHS compliance audit clock is ticking on Zero Trust. Government agencies can no longer ignore or delay their Zero Trust initiatives. During this virtual panel discussion—featuring Kelly Fuller Gordon, Founder and CEO of RisX, Chris Wild, Zero Trust subject matter expert at Zermount, Inc., and Principal of Cybersecurity Practice at Eliassen Group, Trey Gannon—you’ll gain a detailed understanding of the Federal Zero Trust mandate, its requirements, milestones, and deadlines.

Cybersecurity

Tech Republic Security

APRIL 15, 2025

A Gartner distinguished VP analyst offers TechRepublic readers advice about which early-stage technologies that will define the future of business systems to prioritize.

Technology 133

Technology Artificial Intelligence Big data Marketing 133

Malwarebytes

APRIL 15, 2025

The Hertz Corporation, on behalf of Hertz, Dollar, and Thrifty brands, is sending breach notifications to customers who may have had their name, contact information, driver’s license, andin rare casesSocial Security Number exposed in a data breach. The car rental giants data was stolen in a ransomware attack leveraging a vulnerability in Cleo file sharing products.

Data breaches 109

Data breaches Ransomware Passwords B2B 109

Duo's Security Blog

APRIL 17, 2025

As many a podcast host will tell you, its about time you used a consumer or personal Virtual Private Network (VPN). VPNs have become commonplace, serving various purposes from the noble, like protecting an individuals digital footprint, to the dubious, like accessing geo-restricted content. However, personal VPNs present a hidden threat when misused by attackers to obfuscate their location, posing significant security risks to organizations.

VPN 108

VPN Risk Cybersecurity 108

Security Affairs

APRIL 13, 2025

Cell C, one of the biggest telecom providers in South Africa confirms a data breach following a 2024 cyberattack. Cell C is the fourth-largest mobile network operator in South Africa, , after Vodacom, MTN, and Telkom. The company founded in 2001 offers prepaid and postpaid mobile plans, data bundles and internet services, fiber broadband, roaming and international calling, SIM-only plans and device deals.

Data breaches 131

Data breaches Unstructured Data Identity Theft Healthcare 131

Advertisement

Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.

Passwords

Security Boulevard

APRIL 16, 2025

These are interesting times: U.S. government funding for the Common Vulnerabilities and Exposures program expires April 16. The post MITRE Crisis: CVE Cash Ends TODAY CISA says No Lapse appeared first on Security Boulevard.

Government 115

Government Data privacy Technology IoT 115

Malwarebytes

APRIL 14, 2025

In a new update for the guide concerning CVE-2025-21204 Microsoft told users they need the new inetpub folder for protection. As part of Aprils patch Tuesday updates, Microsoft released a patch to a link following flaw in the Windows Update Stack. Applying the patch creates a new %systemdrive%inetpub folder on the device. Users who noticed the new folder asked questions because they were concerned about its origin and purpose.

Internet 110

Internet Internet Authentication Accountability 110

SecureWorld News

APRIL 16, 2025

Big AI runs on big hardware. And right now, that hardware is GPUsrented, stacked, and spinning 24/7 across cloud infrastructure nobody double-checks until something breaks. Everyone's focused on what LLMs say and dobut not where they live or how they're trained. That backend? It's a mess. And it's wide open. This is the blind spot in modern cybersecurity, as not many of us are aware of how important GPUs are for AI.

Architecture 94

Architecture Artificial Intelligence Passwords Risk 94

Security Affairs

APRIL 17, 2025

Microsoft warns of a malvertising campaign using Node.js to deliver info-stealing malware via fake crypto trading sites like Binance and TradingView. Microsoft has observed Node.js increasingly used in malware campaigns since October 2024, including an ongoing crypto-themed malvertising attack as of April 2025. Threat actors are increasingly using Node.js to deploy malware, shifting from traditional scripts like Python or PHP.

Social Engineering 118

Social Engineering Malware Cryptocurrency Engineering 118

Speaker: Sierre Lindgren

Fraud is a battle that every organization must face – it’s no longer a question of “if” but “when.” Every organization is a potential target for fraud, and the finance department is often the bullseye. From cleverly disguised emails to fraudulent payment requests, the tactics of cybercriminals are advancing rapidly. Drawing insights from real-world cases and industry expertise, we’ll explore the vulnerabilities in your processes and how to fortify them effectively.

Scams

SecureList

APRIL 17, 2025

Day after day, threat actors create new malware to use in cyberattacks. Each of these new implants is developed in its own way, and as a result gets its own destiny while the use of some malware families is reported for decades, information about others disappears after days, months or several years. We observed the latter situation with an implant that we dubbed MysterySnail RAT.

Malware 94

Malware Encryption Architecture Engineering 94

Malwarebytes

APRIL 17, 2025

Apple has released a security update for iOS and iPadOS to patch two zero-day vulnerabilities which are reported to already have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS. Both vulnerabilities allowed an attacker to bypass the memory protections that would normally stop someone from running malicious code.

Authentication 105

Authentication Software Mobile Media 105

Security Boulevard

APRIL 15, 2025

MITREs CVE program has been an important pillar in cybersecurity for over two decades. The lack of certainty surrounding the future of the CVE program creates great uncertainty about how newly discovered vulnerabilities will be cataloged. Background On April 15, reports circulated that the contract for funding the Common Vulnerabilities and Exposures (CVE) program along with other related programs, such as Common Weakness Enumeration (CWE), would be expiring on April 16.

Cybersecurity 98

Cybersecurity Media Technology Risk 98

Security Affairs

APRIL 17, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SonicWall SMA100 Appliance flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a SonicWall SMA100 Appliance flaw, tracked as CVE-2021-20035 , to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is an OS Command Injection Vulnerability in the SMA100 management interface.

Authentication 112

Authentication Hacking Cybersecurity Risk 112

Advertisement

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

Software

Penetration Testing

APRIL 12, 2025

AhnLab Security intelligence Center (ASEC) has revealed a cyberattack campaign where Arabic-speaking attackers are distributing ViperSoftX malware, targeting The post ViperSoftX Malware: Arabic-Speaking Attackers Exploit PowerShell in New Cyberattack Campaign appeared first on Daily CyberSecurity.

Malware 110

Malware Security Intelligence Cybersecurity Software 110

Schneier on Security

APRIL 15, 2025

As AI coding assistants invent nonexistent software libraries to download and use, enterprising attackers create and upload libraries with those names—laced with malware, of course.

Malware 251

Malware Software 251

Malwarebytes

APRIL 18, 2025

Text scams alone cost US citizens at least $470 million in 2024, according to new data from the US Federal Trade Commission (FTC). Because many scams go unreported, though, this dollar amount might be considerably more. The FTC illustrated this with a graph comparing the reported losses to the number of reports. Graph courtesy of FTC This demonstrates that not only the damage per reported incident went up considerably, but also the total amount of damage.

Scams 108

Scams Mobile Wireless Retail 108

Security Affairs

APRIL 17, 2025

Apple released emergency updates to fix iOS, iPadOS & macOS vulnerabilities actively exploited in sophisticated attacks. Apple released outofband security updates to address two vulnerabilities, tracked as CVE-2025-31200 and CVE-2025-31201, impacting iOS, iPadOS & macOS. The company confirmed that the flaws have been exploited in a small number of extremely sophisticated attacks against iOS targets.

Surveillance 121

Surveillance Media Authentication Hacking 121

Advertisement

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!