Blahalla

Google, Meta, Microsoft Among Signatories of Pact to Combat Scams

www.securityweek.com · 7 months ago

false

LeakNet ransomware uses ClickFix, Deno runtime in stealthy attacks

www.bleepingcomputer.com · 7 months ago

The LeakNet ransomware group is now utilizing the ClickFix social engineering technique to gain initial access to corporate networks. Attackers are leveraging the legitimate Deno runtime for JavaScript and TypeScript to execute malicious payloads directly in system memory, minimizing detection and forensic evidence. This "bring your own runtime" tactic allows the ransomware to bypass security filters and appear as normal developer activity. Following initial execution, LeakNet employs techniques like DLL sideloading and credential discovery for post-exploitation actions.

Microsoft shares fix for Windows C: drive access issues on Samsung PCs

www.bleepingcomputer.com · 7 months ago

Microsoft and Samsung are addressing access issues on the C: drive affecting some Samsung laptops running Windows 11. The problems stem from the Samsung Galaxy Connect app, which has been temporarily removed from the Microsoft Store and subsequently updated. A 29-step process is available for users to restore standard Windows permissions, returning drive ownership to Windows. Microsoft has also released out-of-band updates to resolve a Bluetooth issue and security vulnerabilities in the Routing and Remote Access Service.

AI is Everywhere, But CISOs are Still Securing It with Yesterday's Skills and Tools, Study Finds

thehackernews.com · 7 months ago

false

AWS Bedrock’s ‘isolated’ sandbox comes with a DNS escape hatch

www.csoonline.com · 7 months ago

Researchers discovered a vulnerability in AWS Bedrock AgentCore’s “Sandbox” mode that allows attackers to bypass isolation boundaries through DNS queries. The sandbox, intended to provide isolated AI workflows, permits outbound DNS requests, enabling attackers to exfiltrate data and execute commands by encoding information within DNS responses. AWS initially attempted a fix but subsequently reverted it, deeming the behavior an intended functionality and updating documentation instead. Security teams are advised to inventory AgentCore instances and consider migrating to VPC mode, with a CVSS score of 7.5 assigned to the issue.

New Windows 11 hotpatch fixes Bluetooth device visibility issue

www.bleepingcomputer.com · 7 months ago

Microsoft has released an out-of-band hotpatch to address a Bluetooth device visibility issue on Windows 11 Enterprise devices. Affected systems may experience difficulties in seeing or adding Bluetooth devices, despite them being connected and working correctly. A previous hotpatch, KB5084597, resolved three high-severity vulnerabilities in the Windows Routing and Remote Access Service, potentially allowing for remote code execution. These hotpatches apply fixes by patching running processes and files, and are distinct from standard Windows updates.

Microsoft Launches AI-Driven Troubleshooting for Purview Data Lifecycle Tools

gbhackers.com · 7 months ago

false

CISA Flags Year-Old Wing FTP Vulnerability as Exploited

www.securityweek.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has issued a warning about a vulnerability in Wing FTP Server. This medium-severity flaw, tracked as CVE-2025-47813, can expose the application's installation path. A second, critical-severity vulnerability, CVE-2025-47812, allows for remote code execution and has been actively exploited. Federal agencies are urged to apply the available patch, version 7.4.4, by March 30.

Microsoft: Enabling Teams Meeting add-in breaks Outlook Classic

www.bleepingcomputer.com · 7 months ago

Microsoft is addressing an issue where enabling the Microsoft Teams Meeting Add-in can make the classic Outlook email client unusable. The problem is linked to a previous version of Outlook, and users are advised to update Outlook or perform an Online Repair as a temporary fix. Microsoft is also investigating connection problems with Gmail and Yahoo accounts, and recently resolved issues related to encrypted emails and an Exchange Online outage. EX1254044, EX1253275

Angular XSS Vulnerability Threatens Thousands of Web Applications

gbhackers.com · 7 months ago

A high-severity Cross-Site Scripting vulnerability, CVE-2026-32635, has been found in Angular, affecting versions 17.0.0 through 22.0.0-next.2. The flaw bypasses Angular’s sanitization mechanisms when developers combine internationalization features with sensitive HTML attributes. Successful exploitation can lead to session hijacking, data exfiltration, and unauthorized actions. Security patches are available for versions 21.2.4, 20.3.18, and 19.2.20, and workarounds include blocking untrusted input and manually sanitizing attributes.

AI, APIs and DDoS Collide in New Era of Coordinated Cyberattacks

www.securityweek.com · 7 months ago

New research indicates a significant shift in cyberattack strategies, with layer 7 DDoS attacks increasing while layer 3 and 4 attacks scale. Attackers are converging web application attacks, API abuse, bot activity, and DDoS into coordinated campaigns. API attacks are rising, fueled by the growing use of agentic AI and shadow AI, making them difficult to detect and contributing to a 73% increase in web attack volume. The ransomware group Qilin has expanded its capabilities to include DDoS attacks.

Glassworm Malware Infects Popular React Native npm Packages

gbhackers.com · 7 months ago

A supply chain attack compromised two popular React Native npm packages, AstrOOnauta’s react-native-async-storage and @react-native-seoul/cli, briefly turning them into vehicles for Windows credential-stealing malware. Malicious code was introduced between package versions, with compromised versions published on March 16, 2026. The attack uses a preinstall hook to execute a script that fetches and runs a second-stage payload, and the malware selectively avoids systems with Russian locales. The final payload steals credentials from crypto wallets, browser extensions, npm, and GitHub, and establishes persistence on Windows systems.

South Korean Police Accidentally Post Cryptocurrency Wallet Password

www.schneier.com · 7 months ago

South Korea’s National Tax Service mistakenly revealed the recovery phrase for a seized cryptocurrency wallet during a public announcement. The inadvertent disclosure allowed an unauthorized party to steal approximately 4.8 million dollars worth of Pre-Retogeum tokens. The wallet contained digital assets valued at around 5.6 million dollars, confiscated from tax evaders. The compromised assets were stored in a Ledger cold wallet.

Open, Closed and Broken: Prompt Fuzzing Finds LLMs Still Fragile Across Open and Closed Models

unit42.paloaltonetworks.com · 7 months ago

Researchers have discovered that Large Language Models, both open-source and proprietary, are vulnerable to "prompt jailbreaking," where attackers bypass safety measures through subtle prompt modifications. These automated evasion techniques can be surprisingly successful, highlighting that closed-source models are not inherently more secure. The findings emphasize the need for continuous adversarial testing, layered security controls, and treating user input as untrusted. Organizations using LLMs should implement security-by-design principles and proactive monitoring to mitigate these risks.

Konni Deploys EndRAT Through Phishing, Uses KakaoTalk to Propagate Malware

thehackernews.com · 7 months ago

North Korean threat actors, identified as Konni, are using phishing emails disguised as notices to compromise victims and gain access to their KakaoTalk desktop applications. Once inside, the attackers distribute malware to specific contacts, effectively using victims as intermediaries for further attacks. The malware, known as EndRAT, allows remote control of infected systems and is delivered through a malicious shortcut file that downloads and executes the payload. Attackers have also dropped other RAT families, such as RftRAT and RemcosRAT, suggesting a targeted and sophisticated operation.

Packagist Themes Deliver Trojanized jQuery in OphimCMS Supply Chain Attack

gbhackers.com · 7 months ago

A supply chain attack has compromised six Composer packages on Packagist, specifically themes designed for the Vietnamese OphimCMS platform. These malicious themes, disguised as legitimate assets, bundle trojanized JavaScript, primarily jQuery, to redirect users, steal data, inject ads, and evade analysis. The affected packages are ophimcms/theme-dy, theme-mtyy, theme-rrdyw, theme-pcc, theme-motchill, and theme-legend. The attack redirects mobile users to gambling and adult sites via infrastructure linked to FUNNULL Technology Inc., a sanctioned entity, and impacts approximately 2,750 installations.

A journalist reported a missile strike. Then came the death threats.

www.washingtonpost.com · 7 months ago

A journalist received threatening messages after reporting on an Iranian missile strike. The messages demanded he alter his story to benefit online gamblers seeking payouts. The reporter was given a deadline to make the changes or face consequences. The messages were sent via WhatsApp.

CISA Issues Alert on Wing FTP Server Vulnerability Used in Attacks

gbhackers.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has issued a warning about a critical vulnerability in the Wing FTP Server. This flaw, identified as CVE-2025-47813, allows attackers to expose sensitive system information through an information disclosure vulnerability when processing oversized user inputs. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, indicating active exploitation in attacks. Network administrators are urged to apply security patches, follow mitigation guidance, or discontinue use of the server by March 30, 2026.

WebFiling Flaw at UK Companies House Exposed Director Data for Months

gbhackers.com · 7 months ago

The UK Companies House recently experienced a significant security vulnerability within its WebFiling service, impacting sensitive director data. The flaw, introduced in October 2025 and discovered in March 2026, allowed authenticated users to view and potentially alter private company details. While not accessible to the general public, the authorization bypass exposed personal information and risked fraudulent filings, though data scraping and password compromise were prevented. Companies House has launched an investigation, notified relevant agencies, and is contacting registered companies to review their records.

Hackers Leverage Safe Links and URL Rewriting to Evade Detection

gbhackers.com · 7 months ago

Cybercriminals are increasingly exploiting URL rewriting services, initially designed as a security measure, to evade detection in phishing campaigns. Attackers are creating “pre-wrapped” safe links, chaining multiple rewriting services together to obscure the true destination of malicious links, complicating analysis and bypassing traditional security checks. Phishing-as-a-service platforms like Tycoon2FA and Sneaky2FA are utilizing these techniques, employing adversary-in-the-middle architectures to steal credentials and session cookies even when multi-factor authentication is enabled. Organizations should focus on behavioral detection, layered security controls, and user education to combat this evolving threat.

Payload ransomware hits Windows and ESXi with Babuk-style encryption

gbhackers.com · 7 months ago

A new ransomware operation called Payload is rapidly emerging, targeting both Windows and VMware ESXi environments. The group has been active since February 17, 2026, and has already impacted organizations in sectors like healthcare, energy, and telecom across multiple countries. Payload uses a Babuk-style encryption scheme with Curve25519 ECDH and ChaCha20, along with aggressive anti-forensics and a double-extortion model, including data theft and public shaming. The ransomware employs distinct techniques, such as appending a unique footer to encrypted files and using a specific mutex name, for identification.

Runtime: The new frontier of AI agent security

www.csoonline.com · 7 months ago

Security leaders are increasingly concerned about the behavior of AI agents operating within enterprise networks, noting incidents like an AI assistant deleting an employee's inbox and an agent disrupting an AWS service. Traditional security measures focused on prevention are proving insufficient as agents gain real permissions and autonomy. Experts recommend runtime security, which involves continuously monitoring agent behavior, and prioritizing agent inventory to understand which AI systems are active and what they are doing. Existing endpoint detection and response tools can be adapted to track AI agent activity and enforce specific policies based on agent type.

Researchers Uncover Ways to Decrypt Palo Alto Cortex XDR BIOC Rules for Evasion

gbhackers.com · 7 months ago

Researchers have identified a method to decrypt Palo Alto Networks Cortex XDR Behavioral Indicators of Compromise, or BIOC, rules, allowing attackers to bypass behavioral detections. The rules were encrypted using an AES-256-CBC algorithm with a static key, enabling decryption through analysis of the agent's content update process. Once decrypted, researchers found a global whitelist rule that allowed attackers to exclude processes from detection by appending a specific string to command-line arguments. Palo Alto Networks has released a patch, version 9.1, to address the vulnerability and recommends updating content update versions to 2160 or higher.

Malicious NPM Packages Spread PylangGhost RAT in Supply Chain Attack

gbhackers.com · 7 months ago

Malicious npm packages have been identified distributing the PylangGhost remote access trojan, linking to North Korean actors. The packages, react-refresh-update versions 1.0.1 through 1.0.4 and @jaime9008/math-service versions 1.0.1 through 1.0.2, initially appeared benign but were later weaponized. These packages contain a hidden JavaScript loader that retrieves and executes the PylangGhost RAT, which allows for full remote control and credential theft. Organizations should remove the affected packages, block communication with suspicious domains, and implement stricter dependency management practices.

Hackers Abuse Trusted Websites in New Attacks on Microsoft Teams Users

gbhackers.com · 7 months ago

Cybercriminals are exploiting trusted websites, particularly WordPress infrastructure, to launch phishing campaigns targeting Microsoft Teams, Xfinity, and UAE Pass users. Attackers use deceptive emails containing urgent lures, such as fake voicemail notifications or shared document alerts, to redirect victims to convincing fake login pages hosted on compromised sites. This multi-step process utilizes intermediary tracking domains and hides payloads within legitimate website directories to evade security scans and steal user credentials. Security professionals should block indicators of compromise including crsons[.]net/wp-includes/js/tinymce/~, crsons[.]net/wp-includes/cgi/UAE%20PASS.htm, afghantarin[.]com/afghantarin/admin/waitme/~, medinex[.]in/includes/bin/index[.]php, cabinetzeukeng[.]net/config/[.]bin/voicemail, and rnedinex[.]com.

LiveChat Support Tools Abused in SaaS Phishing Scheme

gbhackers.com · 7 months ago

Cybercriminals are using the LiveChat platform, a customer support service, in a new phishing campaign to steal sensitive data. Attackers send phishing emails impersonating companies like PayPal and Amazon, directing victims to LiveChat pages designed to look like legitimate support portals. Through live chat interactions, attackers gather personal information, financial details, and multi-factor authentication codes, bypassing security measures and enabling account takeovers. Security experts recommend user education and layered security controls to combat this increasingly sophisticated phishing tactic.

CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths

thehackernews.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has added a vulnerability affecting Wing FTP to its list of actively exploited vulnerabilities. This flaw, CVE-2025-47813, exposes the installation path of the application and has a CVSS score of 4.3. A separate, critical vulnerability, CVE-2025-47812 with a CVSS score of 10.0, allows for remote code execution and is also currently being exploited. Federal agencies are urged to update to version 7.4.4 or later by March 30, 2026.

New CondiBot Variant and ‘Monaco’ Miner Target More Network Devices

gbhackers.com · 7 months ago

Cybercriminals are increasingly targeting network devices like routers, firewalls, and VPNs to establish a foothold and maintain persistence. A new variant of the CondiBot botnet, alongside the "Monaco" cryptominer, demonstrates this shift, impacting a broader range of devices beyond just Fortinet platforms. The CondiBot malware utilizes multiple payload delivery methods and disables reboot utilities, while Monaco brute-forces SSH credentials using a list of weak passwords to mine Monero. These campaigns highlight a critical visibility gap in network device monitoring and a need for organizations to treat these devices as critical endpoints.

CISA Alerts Users to Exploited Chrome 0-Day Flaws

gbhackers.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has issued a warning about two critical zero-day vulnerabilities actively being exploited. One flaw, CVE-2026-3909, is located in the Skia graphics engine, allowing attackers to trigger memory access through a crafted webpage, impacting Chrome OS, Android, and applications using Flutter. The second vulnerability, CVE-2026-3910, resides in the Chromium V8 JavaScript engine, potentially enabling code execution within a restricted sandbox, affecting browsers like Microsoft Edge and Opera. Federal agencies must patch these vulnerabilities by March 27, 2026, and users are advised to avoid clicking unverified links.

Stryker Targeted by Large-Scale Wiper Attack, Tens of Thousands of Devices Lost

gbhackers.com · 7 months ago

Global medical technology company Stryker experienced a significant cybersecurity incident on March 11, 2026, leading to the remote wiping of thousands of corporate devices. A pro-Iranian hacktivist group called Handala claimed responsibility, alleging they wiped over 200,000 systems and exfiltrated 50 terabytes of data. The attackers exploited Stryker’s Microsoft Intune environment to issue factory reset commands, but Stryker confirmed its medical devices and connected health platforms remain safe and operational. The company has implemented business continuity measures, including disconnecting devices from networks and conducting security reviews.

Last Week in Security (LWiS) - 2026-03-16

blog.badsectorlabs.com · 7 months ago

Security researchers have developed several new techniques and tools this week. A new company, Armadin, is focused on offensive cybersecurity operations, while Iran-backed hackers reportedly used device management software to wipe medical devices. Researchers demonstrated a technique called RegPwn, exploiting CVE-2026-24291 for local privilege escalation, and released a buffer overflow exploit for GNU Inetutils telnetd. New tools include llmchainhunter for Java deserialization gadget chain finding, Phantom for.NET assembly execution, and doublepulsar-rs, a reflective loader in Rust.

Was ist ein Keylogger?

www.csoonline.com · 7 months ago

Es gibt Keylogger, Überwachungssoftware, die Tastatureingaben aufzeichnet und die gesammelten Daten an Dritte übermittelt, und sie werden sowohl von Cyberkriminellen zur Entwendung von Anmeldedaten und Finanzinformationen als auch legitim für Troubleshooting, Nutzerforschung und staatliche Überwachung eingesetzt. Keylogger können hardware- oder softwarebasiert sein, bis hin zu mobilen Varianten, die auch Anrufdaten, Screenshots, Standort und Mikrofon oder Kamera erfassen, und sie gelangen über infizierte Domains, manipulierte Apps, Phishing, infizierte USB‑Geräte oder physische Eingriffe auf Systeme. Um Keylogger zu erkennen und zu entfernen, werden Überwachung von Prozessen und Datenverkehr, aktuelle Viren‑ und Anti‑Rootkit‑Lösungen, spezielle Anti‑Keylogger‑Tools, virtuelle Tastaturen, das Deaktivieren von Autostart externer Medien sowie strikte Richtlinien und Mehr‑Faktor‑Authentifizierung empfohlen.

China-Nexus Hackers Skulk in Southeast Asian Military Orgs for Years

www.darkreading.com · 7 months ago

Researchers have uncovered a years-long cyberespionage campaign targeting military organizations in Southeast Asia. The activity, attributed with moderate confidence to Chinese state-sponsored actors and tracked as CL-STA-1087, involved the theft of specific military intelligence and used novel tools like the AppleChris and MemFun backdoors, along with a customized credential-stealing tool. Attackers employed evasion tactics such as delayed execution and timestomping, utilizing legitimate services like Pastebin and Dropbox for command and control. Security experts recommend restricting access to unapproved services and implementing robust monitoring to detect malicious activity.

BIGO Ads Deploys C2-Style Infrastructure to Survive Domain Bans. Here's the Decrypted Config.

www.buchodi.com · 7 months ago

A security researcher has identified a complex ad network infrastructure used by BIGO Ads, a platform operated by JOYY Inc. The network utilizes AES encryption, hardcoded keys, and servers distributed across Alibaba, Yandex, and Google to maintain operation despite domain blocking. This setup incorporates deceptive domain names and domain fronting, mirroring techniques associated with command and control infrastructure. The detailed configuration settings guide the ad system in retrieving data, delivering ads, and managing requests.

Nvidia Debuts New A.I. Product at GTC Developer Conference

www.nytimes.com · 7 months ago

false

How to Apply VXLAN-GBP Encapsulation to PCAP Files Using PacketSmith

blog.netomize.ca · 7 months ago

false

Boggy Serpens Threat Assessment

unit42.paloaltonetworks.com · 7 months ago

Boggy Serpens, attributed to Iran’s Ministry of Intelligence and Security and also known as MuddyWater, conducts cyberespionage against diplomatic and critical infrastructure across the Middle East and beyond. The group relies on refined social engineering and hijacked legitimate accounts to bypass filters, operates a custom mass email orchestration platform, and carried out four distinct waves of targeted phishing against a UAE energy and marine company between August 16, 2025 and February 11, 2026. Its tooling has evolved to include AI-assisted malware development and Rust-based implants such as BlackBeard, newly observed families called GhostBackDoor and Nuso, and command and control techniques that use HTTP status codes and the Telegram API to maintain stealthy persistence. Campaigns emphasize long-term access through custom persistence mechanisms and credential compromise, and defenders are advised to watch for blurred or document lures that prompt Enable Content, internally styled documents, and signs of account hijacking.

Instagram Users Urged to Save Encrypted DMs Before Feature Disappears

www.techrepublic.com · 7 months ago

false

Microsoft Issues Emergency Patch for Critical Windows 11 RRAS Vulnerabilities

www.techrepublic.com · 7 months ago

Microsoft has released an emergency security update for Windows 11 to address critical vulnerabilities within the Routing and Remote Access Service, or RRAS. These flaws, tracked as CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111, could allow attackers to execute code or disrupt service operations if a user connects to a malicious server. The update is delivered as a hotpatch, eliminating the need for a system restart. Organizations are advised to apply the patch, restrict access to RRAS management tools, and implement additional security measures to mitigate risk.

GlassWorm Malware Evolves to Hide in Dependencies

www.darkreading.com · 7 months ago

The GlassWorm malware campaign has expanded to infect dozens of Open VSX software packages, targeting developers and spreading through compromised extensions. Attackers now use a technique called transitive loader delivery, embedding malicious code within extension dependencies to evade detection and broaden their reach. The malware impersonates popular extensions and inflates download counts to appear trustworthy, stealing credentials and data like NPM, GitHub, and cryptocurrency wallet information. Security researchers recommend auditing extensions and reviewing installation chains to combat this evolving threat.

Inside Olympic Cybersecurity: Lessons From Paris 2024 to Milan Cortina 2026

www.darkreading.com · 7 months ago

false

How Trump Drove a Wedge Between Florida Republicans Over A.I.

www.nytimes.com · 7 months ago

false

GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos

thehackernews.com · 7 months ago

A new malware campaign, codenamed ForceMemo, is exploiting stolen GitHub tokens to inject malicious code into hundreds of Python repositories. Attackers compromise developer systems with GlassWorm malware, steal GitHub tokens, and then force-push altered code into files like setup.py. The malware checks for a Russian locale and, if not found, retrieves additional payloads from a Solana wallet to steal cryptocurrency and data. This technique rewrites git history and leaves no trace in GitHub’s user interface.

Android 17 Leaks Reveal Major Redesign, AI Features, and Privacy Upgrades

www.techrepublic.com · 7 months ago

false

Stryker attack wiped tens of thousands of devices, no malware needed

www.bleepingcomputer.com · 7 months ago

A cyberattack targeted medical technology company Stryker, impacting its internal Microsoft environment and remotely wiping tens of thousands of employee devices. The Handala hacktivist group, believed to be linked to Iran, claimed responsibility for wiping systems and stealing data, though no data exfiltration was confirmed. Attackers exploited administrator accounts to use Intune wipe commands, affecting nearly 80,000 devices. The company emphasizes that its medical devices and products remain safe, and restoration efforts are underway to resume order and shipping services.

Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization

unit42.paloaltonetworks.com · 7 months ago

Iranian state-aligned cyber actors have evolved their tactics over the past decade, moving from deploying custom malware like Shamoon and ZeroCleare to increasingly relying on living-off-the-land techniques and identity abuse. Recent attacks, such as those attributed to Void Manticore and the Handala Hack Team, involve compromising privileged identities to remotely wipe devices using legitimate management tools. This shift bypasses traditional endpoint detection and response systems, allowing for rapid and widespread disruption without deploying custom malware. Security teams are advised to prioritize identity resilience and implement measures such as strict conditional access and privileged identity management.

Qihoo 360's AI Product Leaked the Platform's SSL Key, Issued by Its Own CA Banned for Fraud

blog.barrack.ai · 7 months ago

A security failure at Qihoo 360 has exposed a wildcard SSL private key within the installer for its AI assistant, 360 Security Lobster. This leak, issued by WoTrus CA, enables malicious actors to impersonate services and potentially hijack user sessions for the myclaw.360.cn platform and the open-source AI agent framework OpenClaw. The incident underscores a significant security lapse within Qihoo 360, which has a history of security controversies and ties to the Chinese military. The certificate has not been revoked and Qihoo 360 has not publicly addressed the situation.

Industrial Systems Under Siege: 77% of OT Environments Suffer Cyber Breaches

www.techrepublic.com · 7 months ago

A recent survey reveals significant cybersecurity vulnerabilities within operational technology environments. Seventy-seven percent of organizations experienced a security compromise resulting in data loss or operational disruption in the past year, with four percent reporting ten or more attacks. Fifty-two percent anticipate a cyber exploit within the next year, and organizations average over a month to detect incidents and seven months to recover. Experts cite malicious insiders, third-party mistakes, and denial-of-service attacks as top threats.

CISA flags Wing FTP Server flaw as actively exploited in attacks

www.bleepingcomputer.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency is urging organizations to address a vulnerability in Wing FTP Server that is currently being exploited. This flaw, identified as CVE-2025-47813, allows attackers with limited privileges to discover the installation path of the software. Other vulnerabilities, CVE-2025-47812, a remote code execution bug, and CVE-2025-27889, an information disclosure flaw, were also patched in May 2025. Federal agencies have been given a two-week deadline to implement fixes, and all organizations are encouraged to patch their systems immediately.

Free parking in Russia after Distributed Denial-of-Service attack knocks city’s parking system offline

www.bitdefender.com · 7 months ago

A large-scale Distributed Denial-of-Service attack recently disrupted the automated parking system in Perm, Russia. The attack overwhelmed payment processing systems, leading city officials to forgive parking fees between March 10th and 13th. The incident forced the shutdown of the permparking.ru portal and other related services. Authorities are working to restore the system, which uses vulnerable technologies that have previously attracted cybercriminals.