Hot stuff

A new approach to blockchain spam: Local reputation over global rules

blockchain, cybersecurity, Don't miss, Ethereum, Features, Hot stuff, News, research, spam /

A new approach to blockchain spam: Local reputation over global rules 2025-10-17 at 10:18 By Mirko Zorz Spam has long been a nuisance in blockchain networks, clogging transaction queues and driving up fees. A new research paper from Delft University of Technology introduces a decentralized solution called STARVESPAM that could help nodes in permissionless blockchains […]

A new approach to blockchain spam: Local reputation over global rules Read More »

“Perfect” Adobe Experience Manager vulnerability is being exploited (CVE-2025-54253)

Adobe, CISA, Don't miss, exploit, Hot stuff, News, security update, vulnerability /

“Perfect” Adobe Experience Manager vulnerability is being exploited (CVE-2025-54253) 2025-10-16 at 19:52 By Zeljka Zorz CISA has added CVE-2025-54253, a misconfiguration vulnerability in Adobe Experience Manager (AEM) Forms on Java Enterprise Edition (JEE), to its Known Exploited Vulnerabilities catalog, thus warning of detected in-the-wild exploitation. Adobe fixed the vulnerability in August 2025, along with CVE-2025-54254,

“Perfect” Adobe Experience Manager vulnerability is being exploited (CVE-2025-54253) Read More »

When trusted AI connections turn hostile

Anaconda, Artificial Intelligence, cybersecurity, Don't miss, Features, Hot stuff, LLMs, News, research /

When trusted AI connections turn hostile 2025-10-16 at 09:02 By Mirko Zorz Researchers have revealed a new security blind spot in how LLM applications connect to external systems. Their study shows that malicious Model Context Protocol (MCP) servers can quietly take control of hosts, manipulate LLM behavior, and deceive users, all while staying undetected by

When trusted AI connections turn hostile Read More »

Identifying risky candidates: Practical steps for security leaders

cybersecurity, Don't miss, Expert analysis, Expert corner, Hot stuff, identity verification, Insider Threat, News, Nisos, opinion, strategy /

Identifying risky candidates: Practical steps for security leaders 2025-10-16 at 08:32 By Help Net Security Effective insider threat defense begins with candidate vetting. Background checks and reference calls can confirm elements of an applicant’s history, but they rarely surface the deeper risks that can turn into costly problems down the line. Identity verification, credential validation,

Identifying risky candidates: Practical steps for security leaders Read More »

F5 data breach: “Nation-state” attackers stole BIG-IP source code, vulnerability info

CrowdStrike, data breach, data theft, Don't miss, F5 Networks, Hot stuff, IOActive, Mandiant, NCC Group, NCSC, networking, News, source code /

F5 data breach: “Nation-state” attackers stole BIG-IP source code, vulnerability info 2025-10-15 at 18:39 By Zeljka Zorz US tech company F5 has suffered a breach, and the attackers made off with source code of and vulnerability information related to its BIG-IP family of networking and security products, the company confirmed today. BIG-IP vulnerabilities are often

F5 data breach: “Nation-state” attackers stole BIG-IP source code, vulnerability info Read More »

Microsoft patches three zero-days actively exploited by attackers

0patch, Don't miss, drivers, Hot stuff, Immersive, Microsoft, Microsoft Exchange, MS Office, News, Patch Tuesday, Tenable, Trend Micro, Windows /

Microsoft patches three zero-days actively exploited by attackers 2025-10-15 at 13:18 By Zeljka Zorz On October 2025 Patch Tuesday, Microsoft released fixes for 175+ vulnerabilities, including three zero-days under active attack: CVE-2025-24990, CVE-2025-59230, and CVE-2025-47827. The actively exploited vulnerabilities are an unusual mix CVE-2025-24990 is in the third-party driver (ltmdm64.sys) for the software-based Agere Modem,

Microsoft patches three zero-days actively exploited by attackers Read More »

Building trust in AI-powered security operations

Artificial Intelligence, cybersecurity, Don't miss, Hot stuff, News, Splunk, threat detection, Video /

Building trust in AI-powered security operations 2025-10-15 at 08:22 By Help Net Security In this Help Net Security video, James Hodge, VP, Global Specialist Organisation at Splunk, explores the transformative role of AI in cybersecurity threat detection. He explains how AI’s ability to process vast amounts of data and detect anomalies faster than humans is

Building trust in AI-powered security operations Read More »

What if your privacy tools could learn as they go?

Countly, data security, Don't miss, Features, framework, healthcare, Hot stuff, News, Privacy, research /

What if your privacy tools could learn as they go? 2025-10-14 at 11:49 By Mirko Zorz A new academic study proposes a way to design privacy mechanisms that can make use of prior knowledge about how data is distributed, even when that information is incomplete. The method allows privacy guarantees to stay mathematically sound while

What if your privacy tools could learn as they go? Read More »

What Chat Control means for your privacy

Compliance, Don't miss, Europe, Features, Government, Hot stuff, News, Privacy, regulation, scanning, surveillance, Wire /

What Chat Control means for your privacy 2025-10-14 at 08:00 By Mirko Zorz The EU’s proposed Chat Control (CSAM Regulation) aims to combat child sexual abuse material by requiring digital platforms to detect, report, and remove illegal content, including grooming behaviors. Cybersecurity experts warn that such measures could undermine encryption, create new attack surfaces, and

What Chat Control means for your privacy Read More »

Security validation: The key to maximizing ROI from security investments

cyber resilience, cybersecurity, Don't miss, Hot stuff, investment, Mastercard, News, Picus Security, security ROI /

Security validation: The key to maximizing ROI from security investments 2025-10-14 at 08:00 By Help Net Security Every sizable organization invests heavily in firewalls, SIEMs, EDRs, and countless other technologies that form the backbone of a modern enterprise’s cyber defenses. Yet despite these significant investments, attackers continue to exploit misconfigurations, untested rules, and hidden dependencies

Security validation: The key to maximizing ROI from security investments Read More »

Building a healthcare cybersecurity strategy that works

Artificial Intelligence, cybersecurity, Don't miss, Features, healthcare, Hot stuff, News, Ochsner Health, regulation, strategy /

Building a healthcare cybersecurity strategy that works 2025-10-13 at 09:41 By Mirko Zorz In this Help Net Security interview, Wayman Cummings, CISO at Ochsner Health, talks about building a healthcare cybersecurity strategy, even when resources are tight. He explains how focusing on areas like vulnerability management and network segmentation can make the biggest difference. Cummings

Building a healthcare cybersecurity strategy that works Read More »

The five-minute guide to OT cyber resilience

critical infrastructure, cyber resilience, cybersecurity, Don't miss, e2e-assure, Hot stuff, ICS/SCADA, News, remote access, Video /

The five-minute guide to OT cyber resilience 2025-10-13 at 08:19 By Help Net Security In this Help Net Security video, Rob Demain, CEO of e2e-assure, explains the essentials of OT cybersecurity resilience. He discusses the importance of understanding remote access points, supply chain connections, and the need for specialized sensors to monitor OT networks that

The five-minute guide to OT cyber resilience Read More »

Another remotely exploitable Oracle EBS vulnerability requires your attention (CVE-2025-61884)

CVE, Don't miss, Hot stuff, News, Oracle, vulnerability /

Another remotely exploitable Oracle EBS vulnerability requires your attention (CVE-2025-61884) 2025-10-12 at 13:18 By Zeljka Zorz Oracle has revealed the existence of yet another remotely exploitable Oracle E-Business Suite vulnerability (CVE-2025-61884). About CVE-2025-61884 CVE-2025-61884 is a vulnerability in the Runtime user interface in the Oracle Configurator product of Oracle E-Business Suite (EBS). Like CVE-2025-61882 before

Another remotely exploitable Oracle EBS vulnerability requires your attention (CVE-2025-61884) Read More »

Apple offers $2 million for zero-click exploit chains

apple, bug bounty, Don't miss, Hot stuff, News /

Apple offers $2 million for zero-click exploit chains 2025-10-10 at 16:16 By Zeljka Zorz Apple bug bounty program’s categories are expanding and rewards are rising, and zero-click exploit chains may now earn researchers up to $2 million. “Our bonus system, providing additional rewards for Lockdown Mode bypasses and vulnerabilities discovered in beta software, can more

Apple offers $2 million for zero-click exploit chains Read More »

Attackers are exploiting Gladinet CentreStack, Triofox vulnerability with no patch (CVE-2025-11371)

0-day, Don't miss, enterprise, file-sharing, Gladinet, Hot stuff, MSP, News, remote access, SMBs /

Attackers are exploiting Gladinet CentreStack, Triofox vulnerability with no patch (CVE-2025-11371) 2025-10-10 at 13:40 By Zeljka Zorz CVE-2025-11371, a unauthenticated Local File Inclusion vulnerability in Gladinet CentreStack and Triofox file-sharing and remote access platforms, is being exploited by attackers in the wild. While Gladinet is aware of the vulnerability and of its active exploitation, a

Attackers are exploiting Gladinet CentreStack, Triofox vulnerability with no patch (CVE-2025-11371) Read More »

October 2025 Patch Tuesday forecast: The end of a decade with Microsoft

Adobe, apple, Don't miss, Expert analysis, Google, Hot stuff, Ivanti, Microsoft, Mozilla, News, Patch Tuesday /

October 2025 Patch Tuesday forecast: The end of a decade with Microsoft 2025-10-10 at 09:33 By Help Net Security A lot of classic software is reaching end-of-life (EOL) this month. Windows 10, Office 2016 and Exchange Server 2016 have survived after nearly a decade of service. Not far behind, after six years in existence, comes

October 2025 Patch Tuesday forecast: The end of a decade with Microsoft Read More »

From theory to training: Lessons in making NICE usable

CISA, CISO, CXO, cybersecurity, Daon, Don't miss, Features, framework, Hot stuff, News, NICE, research, Risk Management, SMBs, strategy, tips /

From theory to training: Lessons in making NICE usable 2025-10-10 at 09:02 By Mirko Zorz SMBs may not have big budgets, but they are on the receiving end of many cyberattacks. A new study from Cleveland State University looked at how these companies could train staff without getting lost in the thousands of skills and

From theory to training: Lessons in making NICE usable Read More »

Securing agentic AI with intent-based permissions

access management, agentic AI, cybersecurity, Don't miss, Expert analysis, Expert corner, Hot stuff, identity management, News, opinion, Token Security, zero trust /

Securing agentic AI with intent-based permissions 2025-10-10 at 08:31 By Help Net Security When seatbelts were first introduced, cars were relatively slow and a seatbelt was enough to keep drivers safe in most accidents. But as vehicles became more powerful, automakers had to add airbags, crumple zones, and (eventually) adaptive driver assistance systems that anticipate

Securing agentic AI with intent-based permissions Read More »

Legit tools, illicit uses: Velociraptor, Nezha turned against victims

APT, attack tools, Cisco, Don't miss, Hot stuff, Huntress, News, open source, Ransomware, Sophos /

Legit tools, illicit uses: Velociraptor, Nezha turned against victims 2025-10-09 at 19:19 By Zeljka Zorz Threat actors are using an increasing variety of commercial and open-source products to carry out their attacks: according to researchers, Velociraptor and Nezha are the latest additions to their attack toolbox. Velociraptor misuse A suspected China-based ransomware threat actor has

Legit tools, illicit uses: Velociraptor, Nezha turned against victims Read More »

Attackers compromised ALL SonicWall firewall configuration backup files

backup, cloud security, Don't miss, enterprise, firewall, Hot stuff, Mandiant, News, SMBs, SonicWall /

Attackers compromised ALL SonicWall firewall configuration backup files 2025-10-09 at 15:41 By Zeljka Zorz The attackers who brute-forced their way into SonicWall’s firewall cloud backup service accessed configuration backup files of all customers who have used the service, SonicWall stated on Wednesday, following the conclusion of a Mandiant-supported investigation into the incident. Early reports suggested

Attackers compromised ALL SonicWall firewall configuration backup files Read More »

Scroll to Top