A Mirai-like botnet has started exploiting a critical-severity vulnerability in discontinued Zyxel NAS products.

The post Recent Zyxel NAS Vulnerability Exploited by Botnet appeared first on SecurityWeek.

CoinStats says North Korean hackers drained $2 million in virtual assets from 1,590 cryptocurrency wallets.

The post Hackers Steal Over $2 Million in Cryptocurrency From CoinStats Wallets appeared first on SecurityWeek.

Five WordPress plugins were injected with malicious code that creates a new administrative account.

The post Several Plugins Compromised in WordPress Supply Chain Attack  appeared first on SecurityWeek.

Google has released a Chrome security update to resolve four high-severity use-after-free vulnerabilities.

The post Chrome 126 Update Patches Memory Safety Bugs appeared first on SecurityWeek.

LivaNova USA says the personal and medical information of 130,000 individuals was compromised in an October 2023 data breach.

The post LivaNova USA Discloses Data Breach Impacting 130,000 Individuals appeared first on SecurityWeek.

The US has announced charges against four Vietnamese nationals for hacking businesses and causing $71 million in losses.

The post Vietnamese Members of FIN9 Hacking Group Charged in US appeared first on SecurityWeek.

The Los Angeles County Department of Health Services discloses a data breach caused by push notification spamming attack.

The post Push Notification Fatigue Leads to LA County Health Department Data Breach appeared first on SecurityWeek.

A hacker claims to have stolen the information of 30 million users from TEG subsidiary Ticketek.

The post Hacker Claims Theft of 30M User Records From Australia Ticketing Company TEG appeared first on SecurityWeek.

Santander US is notifying over 12,000 employees that their personal information was compromised in a data breach.

The post Santander Employee Data Breach Linked to Snowflake Attack appeared first on SecurityWeek.

Threat actors are exploiting a recent path traversal vulnerability in SolarWinds Serv-U using public PoC code.

The post Recent SolarWinds Serv-U Vulnerability Exploited in the Wild appeared first on SecurityWeek.

CISA says CFATS program data was likely accessed after an Ivanti Connect Secure appliance was hacked in January.

The post Personal and Chemical Facility Information Potentially Accessed in CISA Hack appeared first on SecurityWeek.

A years-long espionage campaign has targeted telecoms companies in Asia with tools associated with Chinese groups.

The post Cyber Assault on Asian Telecoms Traced to Chinese State Hackers appeared first on SecurityWeek.

Pomerium raises $13.75 million in Series A funding for dynamic user identity verification and access management platform.

The post Access Management Startup Pomerium Raises $13.75 Million appeared first on SecurityWeek.

LockBit appears to once again be the most active ransomware group, but experts believe the hackers may just be inflating their numbers. 

The post LockBit Ransomware Again Most Active – Real Attack Surge or Smokescreen? appeared first on SecurityWeek.

A threat actor targeting Chinese-speaking victims has been using the SquidLoader malware loader in recent attacks.

The post Highly Evasive SquidLoader Malware Targets China appeared first on SecurityWeek.

Atlassian has released Confluence, Crucible, and Jira updates to address multiple high-severity vulnerabilities.

The post Atlassian Patches High-Severity Vulnerabilities in Confluence, Crucible, Jira appeared first on SecurityWeek.

National passenger railroad company Amtrak is notifying customers that hackers have breached their Guest Rewards Accounts.

The post Amtrak Says Guest Rewards Accounts Hacked in Credential Stuffing Attacks appeared first on SecurityWeek.

Government agencies in the US, New Zealand, and Canada have published new guidance on improving network security.

The post US, Allies Publish Guidance on Securing Network Access appeared first on SecurityWeek.

Google has released a Chrome 126 security update with six fixes, including four for externally reported high-severity flaws.

The post Chrome 126 Update Patches Vulnerability Exploited at Hacking Competition appeared first on SecurityWeek.

Sagar Steven Singh and Nicholas Ceraolo pleaded guilty to hacking a database maintained by a US federal law enforcement agency.

The post Two Men Plead Guilty to Hacking Law Enforcement Database for Doxing appeared first on SecurityWeek.

The BadSpace backdoor is being distributed via drive-by attacks involving infected websites and JavaScript downloaders.

The post New BadSpace Backdoor Deployed in Drive-By Attacks appeared first on SecurityWeek.

China-linked threat actor Velvet Ant leveraged a legacy F5 BIG-IP appliance for three-year access to a victim’s network.

The post Chinese Hackers Leveraged Legacy F5 BIG-IP Appliance for Persistence appeared first on SecurityWeek.

Blackbaud was ordered to pay $6.75 million to the California Attorney General’s Office over the 2020 data breach.

The post Blackbaud Settles With California for $6.75 Million Over 2020 Data Breach appeared first on SecurityWeek.

The US cybersecurity agency CISA has conducted a tabletop exercise with the private sector focused on AI cyber incident response.

The post CISA Conducts First AI Cyber Incident Response Exercise appeared first on SecurityWeek.

Keytronic confirms that personal information was compromised after a ransomware group leaked allegedly stolen data.

The post Keytronic Says Personal Information Stolen in Ransomware Attack appeared first on SecurityWeek.

The LA County’s Department of Public Health says the personal information of 200,000 was compromised in a data breach.

The post 200,000 Impacted by Data Breach at Los Angeles County Public Health Agency appeared first on SecurityWeek.

Nigerian national Ebuka Raphael Umeti was convicted in the US for operating a business email compromise (BEC) scheme.

The post Nigerian Faces Prison in US After BEC Fraud Conviction appeared first on SecurityWeek.

Security researchers at Cisco Talos and Volexity flag two Pakistani espionage campaigns targeting Indian government entities.

The post Pakistani Threat Actors Caught Targeting Indian Gov Entities appeared first on SecurityWeek.

Ascension says patient information was stolen in an early-May ransomware attack that involved an employee downloading malware.

The post Ascension Says Personal, Health Information Stolen in Ransomware Attack appeared first on SecurityWeek.

CISA urges federal agencies to apply mitigations for an exploited Progress Telerik vulnerability as soon as possible.

The post CISA Warns of Progress Telerik Vulnerability Exploitation appeared first on SecurityWeek.

YesWeHack has raised more than $52 million to date to build and market a crowdsourced vulnerability reporting platform.

The post French Bug Bounty Platform YesWeHack Raises $28 Million appeared first on SecurityWeek.

Protect AI warns of a dozen critical vulnerabilities in open source AI/ML tools reported via its bug bounty program.

The post Easily Exploitable Critical Vulnerabilities Found in Open Source AI/ML Tools appeared first on SecurityWeek.

Life360 says hackers attempted to extort it after stealing personal information from a Tile customer support platform.

The post Life360 Says Personal Information Stolen From Tile Customer Support Platform appeared first on SecurityWeek.

The City of Cleveland says emergency services, utilities, and airport are unaffected by a recent cyberattack.

The post City of Cleveland Scrambling to Restore Systems Following Cyberattack appeared first on SecurityWeek.

Microsoft’s June 2024 Patch Tuesday updates resolve a zero-click Outlook vulnerability leading to remote code execution.

The post Microsoft Patches Zero-Click Outlook Vulnerability That Could Soon Be Exploited appeared first on SecurityWeek.

Fortinet has patched multiple vulnerabilities in FortiOS, including a high-severity code execution security flaw.

The post Fortinet Patches Code Execution Vulnerability in FortiOS appeared first on SecurityWeek.

Google and Mozilla have released patches for 21 and 15 vulnerabilities in Chrome and Firefox, respectively.

The post Chrome 126, Firefox 127 Patch High-Severity Vulnerabilities appeared first on SecurityWeek.

The TellYouThePass ransomware gang started exploiting a recent code execution flaw in PHP days after public disclosure.

The post Ransomware Group Exploits PHP Vulnerability Days After Disclosure appeared first on SecurityWeek.

UK authorities have arrested two individuals for allegedly using a homemade mobile antenna to send mass text messages.

The post Two Arrested in UK for Smishing Campaign Powered by Homemade SMS Blaster  appeared first on SecurityWeek.

Redfox Security warns of multiple vulnerabilities in Netgear WNR614 routers discontinued three years ago.

The post Multiple Vulnerabilities Plague Discontinued Netgear WNR614 Routers appeared first on SecurityWeek.

SAP has released 10 new security notes on June 2024 Security Patch Day, including two addressing high-severity vulnerabilities.

The post SAP Patches High-Severity Vulnerabilities in Financial Consolidation, NetWeaver appeared first on SecurityWeek.

Arm warns that CVE-2024-4610, a Mali GPU kernel driver vulnerability addressed two years ago, is exploited in attacks.

The post Arm Warns of Exploited Kernel Driver Vulnerability appeared first on SecurityWeek.

Mandiant says a financially motivated threat actor has compromised hundreds of Snowflake instances using customer credentials stolen via infostealer malware that infected non-Snowflake owned systems.

The post Snowflake Attacks: Mandiant Links Data Breaches to Infostealer Infections appeared first on SecurityWeek.

A critical vulnerability in the PyTorch distributed RPC framework could be exploited for remote code execution.

The post Critical PyTorch Vulnerability Can Lead to Sensitive AI Data Theft appeared first on SecurityWeek.

PHP has released patches for CVE-2024-4577, a critical vulnerability that could lead to arbitrary code execution on remote servers.

The post PHP Patches Critical Remote Code Execution Vulnerability appeared first on SecurityWeek.

Nvidia patches multiple high-severity vulnerabilities in GPU display drivers and virtual GPU software.

The post Nvidia Patches High-Severity GPU Driver Vulnerabilities appeared first on SecurityWeek.

The FCC proposes that broadband providers plan for BGP security and provide quarterly reports on implemented risk mitigations.

The post FCC Proposes BGP Security Reporting for Broadband Providers appeared first on SecurityWeek.

AI-powered MDR startup AirMDR has raised $5 million in seed funding from Foundation Capital and Storm Ventures.

The post AirMDR Raises $5 Million for AI-Powered Managed Detection and Response appeared first on SecurityWeek.

SolarWinds has released patches for high-severity vulnerabilities in Serv-U and the SolarWinds Platform.

The post SolarWinds Patches High-Severity Vulnerability Reported by NATO Pentester appeared first on SecurityWeek.