Hot stuff - Security Ticks

Threat actors are scanning your environment, even if you’re not

Don't miss, Hot stuff, News, Outpost24 / SecurityTicks

Threat actors are scanning your environment, even if you’re not 2025-04-28 at 08:32 By Zeljka Zorz In a world where organizations’ digital footprint is constantly changing and attackers regularly capitalize on security failings in exposed IT assets, making the effort to minimize your external attack surface is a no-brainer. The goal is simple: Make your […]

React to this headline:

Threat actors are scanning your environment, even if you’re not Read More »

Rack Ruby vulnerability could reveal secrets to attackers (CVE-2025-27610)

Don't miss, Hot stuff, News, OPSWAT, Ruby, security update, vulnerability, web application security / SecurityTicks

Rack Ruby vulnerability could reveal secrets to attackers (CVE-2025-27610) 2025-04-25 at 12:39 By Zeljka Zorz Researchers have uncovered three serious vulnerabilities in Rack, a server interface used by most Ruby web app frameworks (Ruby on Rails, Sinatra, Hanami, Roda, and others). Two of the flaws – CVE-2025-25184 and CVE-2025-27111 – could allow attackers to manipulate

React to this headline:

Rack Ruby vulnerability could reveal secrets to attackers (CVE-2025-27610) Read More »

Critical Commvault RCE vulnerability fixed, PoC available (CVE-2025-34028)

backup, Commvault, Data Protection, Don't miss, Hot stuff, News, PoC, vulnerability, WatchTowr / SecurityTicks

Critical Commvault RCE vulnerability fixed, PoC available (CVE-2025-34028) 2025-04-24 at 15:35 By Zeljka Zorz If your organization is using Commvault Command Center for your data protection, backup creation, configuration and restoration needs, you should check whether your on-premise installation has been upgraded to patch a critical vulnerability (CVE-2025-34028) that could allow unauthenticated remote code execution.

React to this headline:

Critical Commvault RCE vulnerability fixed, PoC available (CVE-2025-34028) Read More »

Understanding 2024 cyber attack trends

cloud security, cyberattacks, Don't miss, Hot stuff, Insider Threat, Mandiant, News, Ransomware, tips, trends / SecurityTicks

Understanding 2024 cyber attack trends 2025-04-24 at 13:04 By Zeljka Zorz Mandiant has released the M-Trends 2025 report, which outlines global cyber attack trends based on their own incident response engagements from 2024. Key trends and insights In 2024, Mandiant handled more incidents in the financial sector than in any other industry: 17.4%. Other popular

React to this headline:

Understanding 2024 cyber attack trends Read More »

Coaching AI agents: Why your next security hire might be an algorithm

Artificial Intelligence, cybersecurity, Don't miss, Dropzone AI, Expert analysis, Expert corner, Hot stuff, News, opinion, SOC / SecurityTicks

Coaching AI agents: Why your next security hire might be an algorithm 2025-04-24 at 08:31 By Help Net Security Security teams are drowning in alerts. The sheer volume of threats, suspicious activity, and false positives makes it nearly impossible for analysts to investigate everything effectively. Enter agentic AI, capable of completing hundreds of tasks simultaneously

React to this headline:

Coaching AI agents: Why your next security hire might be an algorithm Read More »

Released: MITRE ATT&CK v17.0, now with ESXi attack TTPs

attack lifecycle, attack tools, Don't miss, ESXi, Hot stuff, Incident Response, MITRE, MITRE ATT&CK, News, threat modeling / SecurityTicks

Released: MITRE ATT&CK v17.0, now with ESXi attack TTPs 2025-04-23 at 16:13 By Zeljka Zorz MITRE has released the latest version of its ATT&CK framework, which now also includes a new section (“matrix”) to cover the tactics, techniques and procedures (TTPs) used to target VMware ESXi hypervisors. About MITRE ATT&CK MITRE ATT&CK is a regularly

React to this headline:

Released: MITRE ATT&CK v17.0, now with ESXi attack TTPs Read More »

Attackers phish OAuth codes, take over Microsoft 365 accounts

account hijacking, APT, Don't miss, government-backed attacks, Hot stuff, Microsoft 365, News, OAuth, phishing, Volexity / SecurityTicks

Attackers phish OAuth codes, take over Microsoft 365 accounts 2025-04-23 at 13:36 By Zeljka Zorz Suspected Russian threat actors are using OAuth-based phishing attacks to get targets to grant them access to their Microsoft 365 (M365) accounts. “The primary tactics observed involve the attacker requesting victim’s supply Microsoft Authorization codes, which grant the attacker with

React to this headline:

Attackers phish OAuth codes, take over Microsoft 365 accounts Read More »

When confusion becomes a weapon: How cybercriminals exploit economic turmoil

cyber resilience, cybercriminals, cybersecurity, Don't miss, Expert analysis, Expert corner, Fortra, Hot stuff, News, opinion, social engineering / SecurityTicks

When confusion becomes a weapon: How cybercriminals exploit economic turmoil 2025-04-23 at 09:02 By Help Net Security It begins with a simple notification: “Markets in Free Fall.” Within moments, the headlines multiply: new tariffs, emergency actions, plummeting consumer confidence. Across boardrooms and break rooms, anxiety ripples at every level. People begin refreshing inboxes and apps

React to this headline:

When confusion becomes a weapon: How cybercriminals exploit economic turmoil Read More »

PoC exploit for critical Erlang/OTP SSH bug is public (CVE-2025-32433)

Arctic Wolf Networks, Don't miss, exploit, Horizon3.ai, Hot stuff, News, Platform Security, PoC, ProDefense, Ruhr University Bochum, SSH, vulnerability / SecurityTicks

PoC exploit for critical Erlang/OTP SSH bug is public (CVE-2025-32433) 2025-04-22 at 15:48 By Zeljka Zorz There are now several public proof-of-concept (PoC) exploits for a maximum-severity vulnerability in the Erlang/OTP SSH server (CVE-2025-32433) unveiled last week. “All users running an SSH server based on the Erlang/OTP SSH library are likely to be affected by

React to this headline:

PoC exploit for critical Erlang/OTP SSH bug is public (CVE-2025-32433) Read More »

The legal blind spot of shadow IT

Auvik Networks, CISO, cybersecurity, Data Protection, data security, Don't miss, Features, Hot stuff, how-to, JumpCloud, News, shadow IT, strategy, tips / SecurityTicks

The legal blind spot of shadow IT 2025-04-22 at 09:36 By Mirko Zorz Shadow IT isn’t just a security risk, it’s a legal one. When teams use unsanctioned tools, they can trigger compliance violations, expose sensitive data, or break contracts. Let’s look at where the legal landmines are and what CISOs can do to stay

React to this headline:

The legal blind spot of shadow IT Read More »

Email security, simplified: How PowerDMARC makes DMARC easy

DMARC, Don't miss, Hot stuff, News, PowerDMARC, RSAC 2025 / SecurityTicks

Email security, simplified: How PowerDMARC makes DMARC easy 2025-04-22 at 08:40 By Mirko Zorz Email is still the top way attackers get into organizations. Now, big players like Google, Yahoo, and Microsoft are cracking down. They’re starting to require email authentication, specifically DMARC. For many companies, this means it’s no longer optional. PowerDMARC helps organizations

React to this headline:

Email security, simplified: How PowerDMARC makes DMARC easy Read More »

The Zoom attack you didn’t see coming

Cryptocurrency, cybercrime, Don't miss, Hot stuff, Malware, News, scams, social engineering, Trail of Bits, Zoom / SecurityTicks

The Zoom attack you didn’t see coming 2025-04-18 at 17:02 By Zeljka Zorz Did you know that when participating in a Zoom call, you can grant permission to other participants to control your computer remotely? While this feature may come in handy when dealing with trusted family, friends and colleagues, threat actors have started abusing

React to this headline:

The Zoom attack you didn’t see coming Read More »

Sonicwall SMA100 vulnerability exploited by attackers (CVE-2021-20035)

CISA, Don't miss, Hot stuff, News, SMBs, SonicWall, vulnerability / SecurityTicks

Sonicwall SMA100 vulnerability exploited by attackers (CVE-2021-20035) 2025-04-18 at 14:47 By Zeljka Zorz CVE-2021-20035, an old vulnerability affecting Sonicwall Secure Mobile Access (SMA) 100 series appliances, is being exploited by attackers. Sonicwall confirmed it by updating the original security advisory to reflect the new state of play, and by changing the description of the vulnerability

React to this headline:

Sonicwall SMA100 vulnerability exploited by attackers (CVE-2021-20035) Read More »

The UK’s phone theft crisis is a wake-up call for digital security

authentication, cybersecurity, Don't miss, Expert analysis, Expert corner, Hot stuff, mobile security, News, Nuke From Orbit, opinion, smartphones, theft, UK / SecurityTicks

The UK’s phone theft crisis is a wake-up call for digital security 2025-04-18 at 09:02 By Help Net Security Phone theft is now commonplace in London. The Met Police recently revealed that it seizes 1,000 stolen phones weekly as it cracks down on organized criminal networks driving the £50 million trade. Nationally, cases have doubled

React to this headline:

The UK’s phone theft crisis is a wake-up call for digital security Read More »

Securing digital products under the Cyber Resilience Act

Codific, Compliance, cybersecurity, data, Data Protection, Don't miss, EU, Features, Hot stuff, News, opinion, regulation, vulnerability management / SecurityTicks

Securing digital products under the Cyber Resilience Act 2025-04-18 at 08:37 By Mirko Zorz In this Help Net Security interview, Dr. Dag Flachet, co-founder at Codific, explains what the Cyber Resilience Act (CRA) means for companies and how it compares to GDPR in terms of regulatory complexity and impact on organizations. He discusses the technical

React to this headline:

Securing digital products under the Cyber Resilience Act Read More »

SafeLine Bot Management: Self-hosted alternative to Cloudflare

bot, cybersecurity, Don't miss, Hot stuff, News, SafePoint, traffic monitoring / SecurityTicks

SafeLine Bot Management: Self-hosted alternative to Cloudflare 2025-04-17 at 16:52 By Help Net Security Modern websites are under constant pressure from automated traffic: scraping, credential stuffing, inventory hoarding, and other malicious bot behaviors. While Cloudflare Bot Management is a powerful cloud-native solution that leverages massive data and machine learning, not every organization wants to rely

React to this headline:

SafeLine Bot Management: Self-hosted alternative to Cloudflare Read More »

Windows NTLM vulnerability exploited in multiple attack campaigns (CVE-2025-24054)

0patch, APT, Check Point, Don't miss, enterprise, exploit, Government, HarfangLab, Hot stuff, News, phishing, vulnerability, Windows / SecurityTicks

Windows NTLM vulnerability exploited in multiple attack campaigns (CVE-2025-24054) 2025-04-17 at 16:52 By Zeljka Zorz CVE-2025-24054, a Windows NTLM hash disclosure vulnerability that Microsoft has issued patches for last month, has been leveraged by threat actors in campaigns targeting government and private institutions in Poland and Romania. “Active exploitation in the wild has been observed

React to this headline:

Windows NTLM vulnerability exploited in multiple attack campaigns (CVE-2025-24054) Read More »

Apple plugs zero-days holes used in targeted iPhone attacks (CVE-2025-31200, CVE-2025-31201)

0-day, apple, APT, Don't miss, Google, Hot stuff, iOS, iPad, macOS, News, security update / SecurityTicks

Apple plugs zero-days holes used in targeted iPhone attacks (CVE-2025-31200, CVE-2025-31201) 2025-04-17 at 12:02 By Zeljka Zorz Apple has released emergency security updates for iOS/iPadOS, macOS, tvOS and visionOS that fix two zero-day vulnerabilities (CVE-2025-31200, CVE-2025-31201) that have been exploited “in an extremely sophisticated attack against specific targeted individuals on iOS.” CVE-2025-31200 and CVE-2025-31201 CVE-2025-31200

React to this headline:

Apple plugs zero-days holes used in targeted iPhone attacks (CVE-2025-31200, CVE-2025-31201) Read More »

When AI agents go rogue, the fallout hits the enterprise

Artificial Intelligence, AutoRABIT, CXO, cybersecurity, Don't miss, Features, Hot stuff, LLMs, News, SOC, strategy, tips / SecurityTicks

When AI agents go rogue, the fallout hits the enterprise 2025-04-17 at 08:45 By Mirko Zorz In this Help Net Security interview, Jason Lord, CTO at AutoRABIT, discusses the cybersecurity risks posed by AI agents integrated into real-world systems. Issues like hallucinations, prompt injections, and embedded biases can turn these systems into vulnerable targets. Lord

React to this headline:

When AI agents go rogue, the fallout hits the enterprise Read More »

Cozy Bear targets EU diplomats with wine-tasting invites (again)

backdoor, cyber espionage, Don't miss, EU, Hot stuff, News, phishing, Russian Federation / SecurityTicks

Cozy Bear targets EU diplomats with wine-tasting invites (again) 2025-04-16 at 17:40 By Zeljka Zorz APT29 (aka Cozy Bear, aka Midnight Blizzard) is, once again, targeting European diplomats with fake invitations to wine-tasting events, Check Point researchers have shared. Cozy Bear uses wine-tastings and dinners as a lure In early 2024, Zscaler flagged a low-volume

React to this headline:

Cozy Bear targets EU diplomats with wine-tasting invites (again) Read More »