kid

joined 1 year ago
MODERATOR OF
cybersecurity
sorted by: new top controversial old
6
Oracle Appears to Admit Breach of 2 'Obsolete' Servers (www.darkreading.com)
 

The database company said its Oracle Cloud Infrastructure (OCI) was not involved in the breach. And at least one law firm seeking damages is already on the case.

6
Hackers target SSRF bugs in EC2-hosted sites to steal AWS credentials (www.bleepingcomputer.com)
13
Google fixes two actively exploited zero-day vulnerabilities in Android (www.malwarebytes.com)
9
CISA Warns of CentreStack's Hard-Coded MachineKey Vulnerability Enabling RCE Attacks (thehackernews.com)
4
Hackers Claim Magento Breach via Third-Party, Leak CRM Data of 700K Users (hackread.com)
2
Hacker Claims WooCommerce Data Breach, Selling 4m User Records (hackread.com)
8
17,000,000 GrubHub passwords and other data exposed, hackers claim (cybernews.com)
7
Ransomware Attacks Hit All-Time High as Payoffs Dwindle (www.infosecurity-magazine.com)
3
Microsoft April 2025 Patch Tuesday - SANS Internet Storm Center (isc.sans.edu)
 

This month, Microsoft has released patches addressing a total of 125 vulnerabilities. Among these, 11 are classified as critical, highlighting the potential for significant impact if exploited. Notably, one vulnerability is currently being exploited in the wild, underscoring the importance of timely updates. While no vulnerabilities were disclosed prior to this patch release, the comprehensive updates aim to fortify systems against a range of threats, including remote code execution and privilege escalation. Users are encouraged to apply these patches promptly to enhance their security posture.

9
WhatsApp flaw can let attackers run malicious code on Windows PCs (www.bleepingcomputer.com)
2
Fastly DDoS Attack Insights helps reveal and explain the unfolding of a DDoS attack - Help Net Security (www.helpnetsecurity.com)
9
Hackers lurked in Treasury OCC’s systems since June 2023 breach (www.bleepingcomputer.com)
Pay, fight, or stall? The dilemma of ransomware negotiations - Help Net Security in c/[email protected]
[–] [email protected] 2 points 3 weeks ago (1 children)

Leak extortion is the main issue nowadays, not covered by backups, I'm afraid.

DeepSeek found to be sharing user data with TikTok parent company ByteDance in c/[email protected]
How to scan PDF files for malware? in c/[email protected]
[–] [email protected] 4 points 1 month ago

I didn't know about that tool. Apparently, it is a CDR, which I like very much. I'm not aware of any good open-source implementations.

[Patched 09/02/25] Leaking the email of any YouTube user for $10,000 in c/[email protected]
[–] [email protected] 9 points 1 month ago (1 children)

Very nice approach!

Some points about the article:

Nature of the Vulnerability: The vulnerability is a security flaw that allows leaking the email associated with a YouTube channel by exploiting endpoints from both YouTube and Google Pixel Recorder.

Impact: It allows an attacker to obtain the email associated with any YouTube channel, which can lead to phishing attacks, privacy invasion, and other malicious activities. This potentially affects all YouTube users who own a channel.

Fix Status: The vulnerability has been fixed by Google. Both parts of the exploit were resolved by 02/09/2025, and the report was disclosed on 02/12/2025.

Proton Mail still down as Proton recovers from worldwide outage in c/[email protected]
[–] [email protected] 51 points 3 months ago

Apparently was not related to a cyber attack, as stated in status page (https://status.proton.me/)

We have resolved all service outages, and the situation has been stable for some time. We have identified the root cause of the problem, implemented a fix, and are now monitoring the results. Jan 09, 2025 - 19:27 CET

Researcher Details CVE-2024-44131 - A Critical TCC Bypass in macOS and iOS in c/[email protected]
Deloitte UK Hacked - Brain Cipher Group Claim to Have Stolen 1 TB of Data in c/[email protected]
[–] [email protected] 1 points 4 months ago (1 children)

For now, the threat actor is just claiming that they hacked BT. No prove whatsoever. Groups usually post a sample of the data when they claim a victim, but that is not the case, for now.

Deloitte UK Hacked - Brain Cipher Group Claim to Have Stolen 1 TB of Data in c/[email protected]
[–] [email protected] 4 points 4 months ago

If you are asking if the main attack vector was phishing, they are not clear on that:

According to statements released by Brain Cipher, they have exploited critical weaknesses within Deloitte UK’s cybersecurity infrastructure.

Good Projects for People Getting Started in Cybersec in c/[email protected]
[–] [email protected] 3 points 4 months ago

Welcome! I dont know you background, but I would suggest get into selfhosting. There are several projects related to cybersecurity, fun and useful. Ex: MISP, Pihole, The Hive.

FortiGate admins report active exploitation 0-day. Vendor isn’t talking. in c/[email protected]
Russian RomCom Attacks Target Ukrainian Government with New SingleCamper RAT Variant in c/[email protected]
[–] [email protected] -1 points 5 months ago

That's why I don't use Kaspersky :)

Russian RomCom Attacks Target Ukrainian Government with New SingleCamper RAT Variant in c/[email protected]
[–] [email protected] -1 points 5 months ago (2 children)

In my opinion, you will always be at the mercy of a government in this context: US, China, Russia. In the end it's a matter of choosing which one. FOSS maybe a little less, but in the end it's almost the same. That's my view, of course. That doesn't mean you can't give them a hard time ;)

view more: next ›