News

What 50 companies got wrong about cloud identity security

cloud security, Compliance, cybersecurity, identity, News, report, Unosecur /

What 50 companies got wrong about cloud identity security 2025-07-25 at 08:07 By Anamarija Pogorelec Most organizations still miss basic identity security controls in the cloud, leaving them exposed to breaches, audit failures, and compliance violations. A new midyear benchmark from Unosecur found that nearly every company scanned had at least one high-risk issue, with […]

What 50 companies got wrong about cloud identity security Read More »

Six months into DORA, most financial firms are still not ready

Censuswide, Compliance, cyber risk, EU, Europe, Government, News, regulation, Veeam Software /

Six months into DORA, most financial firms are still not ready 2025-07-25 at 07:57 By Help Net Security It’s been six months since the EU’s Digital Operational Resilience Act (DORA) came into effect, but a new Censuswide survey shows that nearly all financial services organizations in EMEA still feel unprepared. An overwhelming 96% of respondents

Six months into DORA, most financial firms are still not ready Read More »

New infosec products of the week: July 25, 2025

Akeyless, Bitdefender, Malwarebytes, ManageEngine, News, PlexTrac, Seemplicity /

New infosec products of the week: July 25, 2025 2025-07-25 at 07:02 By Sinisa Markovic Here’s a look at the most interesting products from the past week, featuring releases from Akeyless, Bitdefender, Malwarebytes, ManageEngine, PlexTrac, and Seemplicity. PlexTrac Workflow Automation Engine enhancements accelerate time to remediation PlexTrac launched enhanced Workflow Automation Engine, a major product

New infosec products of the week: July 25, 2025 Read More »

Storm-2603 spotted deploying ransomware on exploited SharePoint servers

0-day, Check Point, Don't miss, exploit, Hot stuff, Microsoft, News, SANS ISC, SharePoint, vulnerability /

Storm-2603 spotted deploying ransomware on exploited SharePoint servers 2025-07-24 at 19:03 By Zeljka Zorz One of the groups that, in the past few weeks, has been exploiting vulnerabilities in on-prem SharePoint installation has been observed deploying Warlock ransomware, Microsoft shared on Wednesday. First attack spotted on July 7th On Saturday, Microsoft announced that attackers have

Storm-2603 spotted deploying ransomware on exploited SharePoint servers Read More »

Sonicwall fixes critical flaw in SMA appliances, urges customers to check for compromise (CVE-2025-40599)

Don't miss, Google Cloud, Hot stuff, News, SonicWall, vulnerability /

Sonicwall fixes critical flaw in SMA appliances, urges customers to check for compromise (CVE-2025-40599) 2025-07-24 at 13:19 By Zeljka Zorz Sonicwall is asking customers running specific Secure Mobile Access (SMA) 100 Series devices to patch a newly uncovered vulnerability (CVE-2025-40599) as soon as possible. “While there is currently no evidence that this vulnerability is being

Sonicwall fixes critical flaw in SMA appliances, urges customers to check for compromise (CVE-2025-40599) Read More »

Why outsourcing cybersecurity is rising in the Adriatic region

CISO, cybersecurity, cybersecurity talent, Don't miss, EU, Exclusive Networks, Features, Hot stuff, News, regulation, skill development, training /

Why outsourcing cybersecurity is rising in the Adriatic region 2025-07-24 at 11:57 By Mirko Zorz In this Help Net Security interview, Aleksandar Stančin, Board Member Adriatics, Exclusive Networks, discusses the state of cybersecurity in the Adriatic region. He talks about how local markets often lag behind EU regulations, despite facing threats comparable to those in

Why outsourcing cybersecurity is rising in the Adriatic region Read More »

Autoswagger: Open-source tool to expose hidden API authorization flaws

API security, cybersecurity, Don't miss, GitHub, Intruder, News, open source, software /

Autoswagger: Open-source tool to expose hidden API authorization flaws 2025-07-24 at 11:57 By Help Net Security Autoswagger is a free, open-source tool that scans OpenAPI-documented APIs for broken authorization vulnerabilities. These flaws are still common, even at large enterprises with mature security teams, and are especially dangerous because they can be exploited with little technical

Autoswagger: Open-source tool to expose hidden API authorization flaws Read More »

Most data breaches have unknown causes as transparency continues to fall

cybersecurity, data breach, identity protection, Identity Theft Resource Center, News, report /

Most data breaches have unknown causes as transparency continues to fall 2025-07-24 at 11:57 By Help Net Security The Identity Theft Resource Center (ITRC) reports 1,732 publicly disclosed data breaches in H1 2025, marking a 5% increase over the same period in 2024. The ITRC could track a record number of compromises in 2025 if

Most data breaches have unknown causes as transparency continues to fall Read More »

Your app is under attack every 3 minutes

Application Security, attacks, Contrast Security, cybersecurity, News, report /

Your app is under attack every 3 minutes 2025-07-24 at 11:57 By Help Net Security Application-layer attacks have become one of the most common and consequential methods adversaries use to gain access and compromise organizations, according to Contrast Security. These attacks target the custom code, APIs, and logic that power applications, often slipping past detection

Your app is under attack every 3 minutes Read More »

In-the-wild Exploitation of CVE-2025-53770 and CVE-2025-53771: Technical Details and Mitigation Strategies

News, Security Research, Trustwave Rapid Response /

In-the-wild Exploitation of CVE-2025-53770 and CVE-2025-53771: Technical Details and Mitigation Strategies 2025-07-24 at 00:23 By Pauline Bolaños Two critical zero-day vulnerabilities in the Microsoft SharePoint Server environment, CVE-2025-53770 (9.8 CVSS score) and CVE-2025-53771 (6.5 CVSS score), are being actively exploited by threat actors to compromise vulnerable on-premises SharePoint servers. This article is an excerpt from

In-the-wild Exploitation of CVE-2025-53770 and CVE-2025-53771: Technical Details and Mitigation Strategies Read More »

Microsoft rolls out Windows 11 “quick recovery” feature

automation, consumer, Don't miss, enterprise, Hot stuff, News, SMBs, Windows /

Microsoft rolls out Windows 11 “quick recovery” feature 2025-07-23 at 18:31 By Zeljka Zorz With the latest Windows 11 update, Microsoft is saying goodbye to the infamous “Blue Screen of Death” and has enabled the quick machine recovery feature by default for Home users. “For nearly four decades, the blue screen shown during an unexpected

Microsoft rolls out Windows 11 “quick recovery” feature Read More »

Mastermind behind Russian-speaking cybercrime hub arrested in Ukraine

arrest, cybercrime, Europol, News, Russian Federation, Ukraine /

Mastermind behind Russian-speaking cybercrime hub arrested in Ukraine 2025-07-23 at 17:34 By Sinisa Markovic The suspected administrator of xss.is, one of the world’s most influential Russian-speaking cybercrime forums, was arrested in Kyiv, Ukraine, on 22 July. The takedown followed a long-running investigation led by the French Police and Paris Prosecutor, in close cooperation with Ukrainian

Mastermind behind Russian-speaking cybercrime hub arrested in Ukraine Read More »

Maximum severity Cisco ISE vulnerabilities exploited by attackers

access control, Cisco, Don't miss, Hot stuff, identity services, News, vulnerability /

Maximum severity Cisco ISE vulnerabilities exploited by attackers 2025-07-23 at 16:20 By Zeljka Zorz One or more vulnerabilities affecting Cisco Identity Services Engine (ISE) are being exploited in the wild, Cisco has confirmed by updating the security advisory for the flaws. About the vulnerabilities The three vulnerabilities affect Cisco’s Identity Services Engine (ISE) – a

Maximum severity Cisco ISE vulnerabilities exploited by attackers Read More »

Phishing campaign targets U.S. Department of Education’s G5 portal

BforeAI, cybercrime, Don't miss, Government, News, phishing, scams, USA /

Phishing campaign targets U.S. Department of Education’s G5 portal 2025-07-23 at 13:04 By Anamarija Pogorelec A new phishing campaign is targeting users of the U.S. Department of Education’s G5 portal, a site used by educational institutions and vendors to manage grants and federal education funding. Threat researchers at BforeAI uncovered a cluster of lookalike domains

Phishing campaign targets U.S. Department of Education’s G5 portal Read More »

Cervantes: Open-source, collaborative platform for pentesters and red teams

cybersecurity, Don't miss, GitHub, News, open source, OWASP, penetration testing, red team, software /

Cervantes: Open-source, collaborative platform for pentesters and red teams 2025-07-23 at 08:31 By Mirko Zorz Cervantes is an open-source collaborative platform built for pentesters and red teams. It offers a centralized workspace to manage projects, clients, vulnerabilities, and reports, all in one place. By streamlining data organization and team coordination, it helps reduce the time

Cervantes: Open-source, collaborative platform for pentesters and red teams Read More »

Phishing simulations: What works and what doesn’t

cybersecurity, Don't miss, Ironscales, News, phishing, strategy /

Phishing simulations: What works and what doesn’t 2025-07-23 at 08:31 By Sinisa Markovic Phishing is one of the oldest and most effective scams used by cybercriminals. No one is immune to them, not even internet security experts, as seen in the case of Troy Hunt, who recently fell for a phishing email. Before AI became

Phishing simulations: What works and what doesn’t Read More »

Ports are getting smarter and more hackable

attacks, China, CISO, critical infrastructure, cybersecurity, Don't miss, Government, Hacktivism, Iran, maritime industry, NATO, News, Russian Federation, strategy, threats, tips /

Ports are getting smarter and more hackable 2025-07-23 at 08:31 By Sinisa Markovic A new policy brief from NATO’s Cooperative Cyber Defence Centre of Excellence (CCDCOE) warns that critical port infrastructure, responsible for 80 percent of global trade, is increasingly under attack by threat actors tied to Russia, Iran, and China. These ports are essential

Ports are getting smarter and more hackable Read More »

The fraud trends shaping 2025: Pressure builds on online retailers

cyber risk, cybersecurity, Forter, fraud, News, PwC, report, Retail, Risk Management /

The fraud trends shaping 2025: Pressure builds on online retailers 2025-07-23 at 07:12 By Anamarija Pogorelec Fraud is growing faster than revenue in eCommerce. That’s one of the first things PwC and Forter point out in their new report, and it’s a wake-up call for online retailers. Fraud is rising faster than ever Right now,

The fraud trends shaping 2025: Pressure builds on online retailers Read More »

Microsoft pins on-prem SharePoint attacks on Chinese threat actors

Check Point, China, Don't miss, exploit, Eye Security, Hot stuff, News, Palo Alto Networks, Rapid7, SentinelOne, SharePoint, Trend Micro, vulnerability /

Microsoft pins on-prem SharePoint attacks on Chinese threat actors 2025-07-22 at 18:54 By Zeljka Zorz As Microsoft continues to update its customer guidance for protecting on-prem SharePoint servers against the latest in-the-wild attacks, more security firms have begun sharing details about the ones they have detected. Most intriguingly, Check Point Research says that they observed

Microsoft pins on-prem SharePoint attacks on Chinese threat actors Read More »

Scroll to Top