Semperis has unveiled a novel attack technique named Silver SAML, capable of circumventing protection in identification systems. Silver SAML enables the utilization of SAML to initiate attacks from the identity provider’s side (such as...
Two Chinese hacking factions, known as UNC5325 and UNC3886, breached the security systems of software developed by Ivanti, which is deployed for safeguarding Virtual Private Networks (VPN). Mandiant experts discovered that UNC5325 exploited a...
Information has surfaced online that internet-connected 3D printers by Anycubic have been hacked to alert users to a critical vulnerability within the devices. The hacker added a file named “hacked_machine_readme.gcode,” which typically contains instructions...
North Korean hackers from the Lazarus group exploited a vulnerability in the Windows AppLocker driver to gain kernel-level access and disable security measures, avoiding detection. Avast analysts identified and reported the hackers’ activities to...
Cybersecurity firm HiddenLayer has uncovered a vulnerability in the Safetensors conversion service by Hugging Face, which permits an attacker to intercept AI models uploaded by users, thereby compromising the supply chain. According to HiddenLayer’s...
Cybercriminal groups Black Basta and Bl00dy have joined the mass attacks on vulnerable ScreenConnect servers, targeting all users who have not yet updated their systems. A fix for the critical authentication bypass vulnerability (CVE-2024-1709)...
Cybercriminals are exploiting an obsolete content management system (CMS) editor, discontinued 14 years ago, to manipulate search results and direct users to malicious or fraudulent websites. The primary strategy of these malefactors involves the...
Recently, a group of hackers from China, known as the “8220 Gang,” has significantly intensified their assaults on cloud infrastructure, targeting both Linux and Windows users with the aim of illicit cryptocurrency mining. The...
Up to 97,000 Exchange servers may be susceptible to a critical vulnerability designated as CVE-2024-21410, a subject we broached several days ago. This flaw permits unauthenticated remote attackers to execute NTLM Relay attacks on...
ESET, a cybersecurity firm, recently addressed a vulnerability across several of its antivirus products for the Windows operating system. The flaw, designated CVE-2024-0353 and rated 7.8 on the CVSS scale, pertains to the potential...
A recent investigation into the firmware of Pulse Secure devices by Ivanti has illuminated profound security vulnerabilities within software supply chains. Specialists at Eclypsium uncovered numerous vulnerabilities, showcasing the complexity of safeguarding such software...
In a recent security update, Microsoft disclosed a critical vulnerability in the Exchange Server that had been actively exploited in the wild before its remediation on February Patch Tuesday. The vulnerability, tracked as CVE-2024-21410...
Microsoft has issued a warning to users about a critical vulnerability in its Office suite that permits unauthorized malefactors to execute malicious code. The vulnerability, uncovered by Check Point, has been designated CVE-2024-21413. It...
As part of its routine security update on Patch Tuesday, Microsoft rectified a vulnerability in SmartScreen that was actively exploited by hackers to disseminate the remote access trojan DarkMe. Let us delve deeper into...
Researchers at Aqua Security have uncovered a critical flaw that enables malefactors to compromise systems running Linux. This vulnerability pertains to the exploitation of the “command-not-found” utility integrated within the Ubuntu distribution, which assists...
In the latest Patch Tuesday update released by Microsoft in February 2024, a total of 73 vulnerabilities in the company’s software were addressed, including two zero-day vulnerabilities that were actively being exploited by malefactors,...
