Critical dependency manager supply chain vulnerabilities have exposed millions and millions of devices to arbitrary malware for the better part of decade.

The company is urging users running vulnerable versions to patch CVE-2024-5655 immediately, to avoid CI/CD malfeasance.

With many popular apps, users must hand over personal information to prove their identity, and the big downside is they have no control over how that information gets processed and stored.

Wireless service providers prioritize uptime and lag time, occasionally at the cost of security, allowing attackers to take advantage, steal data, and worse.

As cybersecurity's cat-and-mouse game starts to look more like Tom and Jerry, attackers develop a method for undermining Android app security with no obvious fix.

For a while, the botnet spread but did essentially nothing. All the malicious payloads came well after.

Government ministries keep falling victim to relatively standard-fare cyber-espionage attacks, like this latest campaign with hazy Chinese links.

The old, but newly disclosed, vulnerability is buried deep inside personal computers, servers, and mobile devices, and their supply chains, making remediation a headache.

A trio of bugs could allow hackers to escalate privileges and remotely execute code on virtual machines deployed across cloud environments.

Pakistani hackers are spying (▀̿Ĺ̯▀̿ ̿) on the highly sensitive organizations in India by using emojis (Ծ_Ծ) as malicious commands (⚆ᗝ⚆) and the old Dirty Pipe Linux flaw.

A model can be perfectly innocent, yet still dangerous if the means by which it's packed and unpacked are tainted.

A new month, a new high-risk Ivanti bug for attackers to exploit — this time, an SQL injection issue in its centralized endpoint manager.

Against a backdrop of political conflict, a years-long cyber-espionage campaign in South Asia is coming to light.

Face scans stored like passwords inevitably will be compromised, like passwords are. But there's a crucial difference between the two that organizations can rely on when their manufacturers fail.

In response to recent public outcry, Recall is getting new security accouterments. Will that be enough to quell concerns?

The pro-Ukranian group has upgraded its infection chain, with credentials, strategic info on commercial pilots, or billion-dollar designs as the possible prizes.

Attackers are taking advantage of misconfigured containers to deploy cryptocurrency mining software.

"Operation Crimson Palace" performed specialized tasks in a broader cyberattack chain, likely under the watch of a single organization.

A new group of hackers is encrypting data in virtual machines, leaving ransom notes, and calling it a day.

As always, Russian APTs are hoping to foment unrest by stoking existing societal divides and fears, this time around the Olympics and EU politics; and, concerns remain around physical disruption.

Most of the operations were feckless efforts with little impact, but they illustrate how AI is changing the game for inauthentic content on both the adversary and defense sides.

Stealthy ad fraud rings turn legitimate marketing into spam at a large scale, creating 200M+ bid requests daily.

North Korea's newest threat actor uses every trick in the nation-state APT playbook, and most of cybercrime's tricks, too. It also developed a whole video game company to hide malware.

Using VPNs as an initial access vector is ironic, given that security is the very reason enterprises employ them in the first place.

Microsoft researchers discover an old-timey scam with a facelift for the cloud era: hacking retailers' portals to make it rain gift cards.

One of China's biggest espionage operations owes its success to longstanding Microsoft Exchange bugs, open source tools, and old malware.

Mandiant warns that defenders must rethink how to thwart Chinese cyber-espionage groups now using professional "infrastructure-as-a-service" operational relay box networks of virtual private servers as well as hijacked smart devices and routers.

Scarred Manticore is the smart, sophisticated one. But when Iran needs something destroyed, it hands the keys over to Void Manticore.

An on-by-default endpoint in ubiquitous logging service Fluent Bit contains an oversight that hackers can toy with to rattle most any cloud environment.

A number of serious Windows bugs still haven't made their way into criminal circles, but that won't remain the case forever — and time is running short before ZDI releases exploit details.

Thankfully, GE ultrasounds aren't Internet-facing. Exploiting most of the bugs to cause serious damage to patients would require physical device access.

Cybercriminals are trafficking Docusign assets that allow for easy extortion and business email compromise.

Scattered Spider is as active as ever, despite authorities claiming that they're close to nailing its members.

Ransomware groups have always created problems for their victims that only they could solve. Black Basta is taking that core idea in a creative, new direction.

CISA's agreement is voluntary and, frankly, basic. Signatories say that's a good thing.

F5 customers should patch immediately, though even that won't protect them from every problem with their networked devices.

Iran follows in Russia's disinformation footsteps but with a different, more economical, and potentially higher-impact model.

MITRE's hackers made use of at least five different Web shells and backdoors as part of their attack chain.

As Verizon Business redefines "supply chain breach," it could either help organizations address third-party risk holistically or just conflate and confuse.

The space agency needs to implement stricter policies and standards when it comes to its cybersecurity practices, but doing so the wrong way would put machinery at risk, a federal review found.

Organizations can go a long way toward preventing spoofing attacks by changing one basic parameter in their DNS settings.

Weaponizing Microsoft's own services for command-and-control is simple and costless, and it helps attackers better avoid detection.

A recent campaign targeting Middle Eastern government organizations plays standard detection tools like a fiddle. With cyberattackers getting more creative, defenders must start keeping pace.

USBs have something the newest, hottest attack techniques lack: the ability to bridge air gaps.

While other professions are making up ground, cybersecurity still lags behind in female representation, thanks to a lack of respect and inclusion.

Hackers can influence voters with media and breach campaigns, or try tampering with votes. Or they can combine these tactics to even greater effect.

Mobile malware-as-a-service operators are upping their game by automatically churning out hundreds of unique samples on a whim.