The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical security flaw impacting Oracle Identity Manager to its Known Exploited Vulnerabilities (KEV) […]
Matrix Push C2 Uses Browser Notifications for Fileless, Cross-Platform Phishing Attacks
Bad actors are leveraging browser notifications as a vector for phishing attacks to distribute malicious links by means of a new command-and-control (C2) platform called […]
CrowdStrike fired insider for sharing internal info with hacking group
Cybersecurity company CrowdStrike fired a “suspicious insider” last month, according to a report from TechCrunch. The terminated worker allegedly provided information about the company’s internal […]
FCC reversal removes federal cyber safeguards targeting telecom weaknesses post-Salt Typhoon attacks
The US federal government is rolling back mandates intended to protect critical infrastructure following the widespread Salt Typhoon attacks. The Federal Communication Commission (FCC) has […]
Cloudflare’s One-Stop-Shop Convenience Takes Down Global Digital Economy
Even the most advanced systems like Cloudflare can fall victim to software issues and become a global point of failure, Dr. David Utzke argues, adding […]
Deja Vu: Salesforce Customers Hacked Again, Via Gainsight
In a repeat of similar attacks during the summer, threat actors affiliated with the ShinyHunters extortion group used a third-party application to steal organizations’ Salesforce […]
Hack the Hackers: 6 Laws for Staying Ahead of the Attackers
A new security framework responds to a shift in attackers’ tactics, one that allows them to infiltrate enterprises ‘silently’ through their own policies. The original […]
LINE Messaging Bugs Open Asian Users to Cyber Espionage
In a potential gift to geopolitical adversaries, the encrypted messaging app uses a leaky custom protocol that allows message replays, impersonation attacks, and sensitive information […]
ENISA becomes CVE Program Root, strengthening Europe’s vulnerability management framework
The European Union Agency for Cybersecurity (ENISA) has been officially designated as a Program Root in the global Common Vulnerabilities and Exposures (CVE) Program. It […]
From code to boardroom: A GenAI GRC approach to supply chain risk
I know the pressure chief information security officers face right now. We spent years hardening our own perimeter, then a few more managing the third-party […]