News - Security Ticks

Salesloft Drift data breach: Investigation reveals how attackers got in

credentials, data theft, Don't miss, Hot stuff, Mandiant, News, Salesforce, Salesloft, supply chain compromise / SecurityTicks

Salesloft Drift data breach: Investigation reveals how attackers got in 2025-09-08 at 14:33 By Zeljka Zorz The attack that resulted in the Salesloft Drift data breach started with the compromise of the company’s GitHub account, Salesloft confirmed this weekend. Supply chain compromise On August 26, the company publicly revealed that earlier that month, a threat […]

Salesloft Drift data breach: Investigation reveals how attackers got in Read More »

Linux Kernel Runtime Guard hits 1.0.0 with major updates and broader support

Linux, News, open source, software, system hardening / SecurityTicks

Linux Kernel Runtime Guard hits 1.0.0 with major updates and broader support 2025-09-08 at 09:52 By Sinisa Markovic The Linux Kernel Runtime Guard (LKRG) is a kernel module that checks the Linux kernel while it’s running. It looks for signs of tampering and tries to catch attempts to exploit security flaws in the kernel. Because […]

Linux Kernel Runtime Guard hits 1.0.0 with major updates and broader support Read More »

Cybersecurity research is getting new ethics rules, here’s what you need to know

conferences, cybersecurity, Don't miss, Features, guide, Hot stuff, how-to, News, research, tips / SecurityTicks

Cybersecurity research is getting new ethics rules, here’s what you need to know 2025-09-08 at 09:01 By Mirko Zorz Top cybersecurity conferences are introducing new rules that require researchers to formally address ethics in their work. Starting with the 2026 USENIX Security Symposium, all submissions must include a stakeholder-based ethics analysis. Other major venues such […]

Cybersecurity research is getting new ethics rules, here’s what you need to know Read More »

InterceptSuite: Open-source network traffic interception tool

cybersecurity, Don't miss, GitHub, network, News, open source, software / SecurityTicks

InterceptSuite: Open-source network traffic interception tool 2025-09-08 at 08:34 By Mirko Zorz InterceptSuite is an open-source, cross-platform network traffic interception tool designed for TLS/SSL inspection, analysis, and manipulation at the network level. “InterceptSuite is designed primarily for non-HTTP protocols, although it does support HTTP/1 and HTTP/2. It offers support for databases, SMTP, and custom protocols, […]

InterceptSuite: Open-source network traffic interception tool Read More »

Cyber defense cannot be democratized

Artificial Intelligence, attacks, cyber resilience, cybersecurity, DevOps, Don't miss, Expert analysis, Expert corner, Hot stuff, News, opinion, SkyHawk Security / SecurityTicks

Cyber defense cannot be democratized 2025-09-08 at 08:14 By Help Net Security The democratization of AI has fundamentally lowered the barrier for threat actors, creating a bigger pool of people who can carry out sophisticated attacks. The so-called democratization of security, on the other hand, has resulted in chaos. The problem In an earnest attempt […]

Cyber defense cannot be democratized Read More »

Identity management was hard, AI made it harder

Artificial Intelligence, automation, CISO, data security, identity management, News, report, SailPoint, survey / SecurityTicks

Identity management was hard, AI made it harder 2025-09-08 at 07:33 By Anamarija Pogorelec Identity security is becoming a core part of cybersecurity operations, but many organizations are falling behind. A new report from SailPoint shows that as AI-driven identities and machine accounts grow, most security teams are not prepared to manage them at scale. […]

Identity management was hard, AI made it harder Read More »

AI moves fast, but data security must move faster

Artificial Intelligence, data security, generative AI, News, report, survey, Thales / SecurityTicks

AI moves fast, but data security must move faster 2025-09-08 at 07:03 By Anamarija Pogorelec Generative AI is showing up everywhere in the enterprise, from customer service chatbots to marketing campaigns. It promises speed and innovation, but it also brings new and unfamiliar security risks. As companies rush to adopt these tools, many are discovering […]

AI moves fast, but data security must move faster Read More »

Week in review: Several companies affected by the Salesloft Drift breach, Sitecore 0-day vulnerability

News, Week in review / SecurityTicks

Week in review: Several companies affected by the Salesloft Drift breach, Sitecore 0-day vulnerability 2025-09-07 at 11:04 By Help Net Security Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Zscaler, Palo Alto Networks, SpyCloud among the affected by Salesloft Drift breach In the wake of last week’s revelation […]

Week in review: Several companies affected by the Salesloft Drift breach, Sitecore 0-day vulnerability Read More »

Attackers are exploiting critical SAP S/4HANA vulnerability (CVE-2025-42957)

Don't miss, enterprise, Hot stuff, NCSC-NL, News, SAP, SAP security, SecurityBridge, vulnerability / SecurityTicks

Attackers are exploiting critical SAP S/4HANA vulnerability (CVE-2025-42957) 2025-09-05 at 15:03 By Zeljka Zorz A critical vulnerability (CVE-2025-42957) in SAP S/4HANA enterprise resource planning software is being exploited by attackers “to a limited extent”, the Dutch National Cyber Security Center (NCSC NL) has warned on Friday. Their alert seems to be based on a report […]

Attackers are exploiting critical SAP S/4HANA vulnerability (CVE-2025-42957) Read More »

Stealthy attack serves poisoned web pages only to AI agents

agentic AI, AI, Don't miss, Hot stuff, JFrog, News, prompt injection, research / SecurityTicks

Stealthy attack serves poisoned web pages only to AI agents 2025-09-05 at 14:30 By Zeljka Zorz AI agents can be tricked into covertly performing malicious actions by websites that are hidden from regular users’ view, JFrog AI architect Shaked Zychlinski has found. This novel approach allows attackers to inject prompts / instructions into these autonomous […]

Stealthy attack serves poisoned web pages only to AI agents Read More »

September 2025 Patch Tuesday forecast: The CVE matrix

Adobe, apple, Don't miss, Expert analysis, Google, Hot stuff, Ivanti, Microsoft, Mozilla, News, Patch Tuesday / SecurityTicks

September 2025 Patch Tuesday forecast: The CVE matrix 2025-09-05 at 10:18 By Help Net Security We work in an industry driven by Common Vulnerabilities and Exposures (CVE). Each security update released by myriad vendors addresses some flaw in software that could be exploited and those flaws that are publicly acknowledged are assigned a CVE designator […]

September 2025 Patch Tuesday forecast: The CVE matrix Read More »

How to reclaim control over your online shopping data

CCPA, cyber risk, cybersecurity, Data Protection, data security, DataGrail, EU, Europe, GDPR, LOKKER, News, online shopping, Privacy, regulation / SecurityTicks

How to reclaim control over your online shopping data 2025-09-05 at 09:33 By Sinisa Markovic Online shopping is convenient, saves time, and everything is just a click away. But how often do we stop to think about what happens to the data we leave behind, or the risks that might come with it? Where shopping […]

How to reclaim control over your online shopping data Read More »

File security risks rise as insiders, malware, and AI challenges converge

cyber risk, cybersecurity, Data leak, data security, News, OPSWAT, Ponemon Institute, report, survey / SecurityTicks

File security risks rise as insiders, malware, and AI challenges converge 2025-09-05 at 08:42 By Anamarija Pogorelec Breaches tied to file access are happening often, and the costs add up quickly. Many organizations have faced multiple file-related incidents over the last two years, with financial losses stretching into the millions. The fallout often includes stolen […]

File security risks rise as insiders, malware, and AI challenges converge Read More »

Smart ways CISOs can do more with less

BlackLine, CISO, News, security ROI, strategy, tips, Video / SecurityTicks

Smart ways CISOs can do more with less 2025-09-05 at 08:05 By Help Net Security In this Help Net Security video, Jill Knesek, CISO at BlackLine, shares practical strategies for CISOs navigating tighter budgets. From maximizing existing tools and vendor partnerships to leveraging AI and making smart investments, she offers actionable advice for maintaining strong […]

Smart ways CISOs can do more with less Read More »

Connected cars are smart, convenient, and open to cyberattacks

connected cars, cybersecurity, hardware, Internet of Things, News, report, RunSafe Security, survey / SecurityTicks

Connected cars are smart, convenient, and open to cyberattacks 2025-09-05 at 07:32 By Sinisa Markovic Consumers are concerned about vulnerabilities in their vehicles, which directly impacts purchasing behavior and brand loyalty, according to RunSafe Security. Vehicles now run on over 100 million lines of code, which is more than most fighter jets, but they often […]

Connected cars are smart, convenient, and open to cyberattacks Read More »

CyberFlex: Flexible Pen testing as a Service with EASM

Don't miss, Hot stuff, News, Outpost24, Video / SecurityTicks

CyberFlex: Flexible Pen testing as a Service with EASM 2025-09-04 at 16:58 By Help Net Security About CyberFlex CyberFlex is an Outpost24 solution that combines the strengths of its Pen-testing-as-a-Service (PTaaS) and External Attack Surface Management (EASM) solutions. Customers benefit from continuous coverage of their entire attack application attack surface, while enjoying a flexible consumption model. […]

CyberFlex: Flexible Pen testing as a Service with EASM Read More »

Google fixes actively exploited Android vulnerabilities (CVE-2025-48543, CVE-2025-38352)

Android, Don't miss, Google, Hot stuff, Motorola Solutions, News, Samsung, security update, vulnerability / SecurityTicks

Google fixes actively exploited Android vulnerabilities (CVE-2025-48543, CVE-2025-38352) 2025-09-04 at 16:58 By Zeljka Zorz Google has provided fixes for over 100 Android vulnerabilities, including CVE-2025-48543 and CVE-2025-38352, which “may be under limited, targeted exploitation.” Among the fixed flaws is also CVE-2025-48539, a critical vulnerability in the System component that “could lead to remote (proximal/adjacent) code […]

Google fixes actively exploited Android vulnerabilities (CVE-2025-48543, CVE-2025-38352) Read More »

macOS vulnerability allowed Keychain and iOS app decryption without a password

apple, conferences, CVE, cybersecurity, Don't miss, Hot stuff, macOS, News, security update, vulnerability / SecurityTicks

macOS vulnerability allowed Keychain and iOS app decryption without a password 2025-09-04 at 15:41 By Mirko Zorz Today at Nullcon Berlin, a researcher disclosed a macOS vulnerability that allowed attackers to read the memory of any process, even with System Integrity Protection (SIP) enabled. The issue, tracked as CVE-2025-24204, stems from Apple mistakenly granting the […]

macOS vulnerability allowed Keychain and iOS app decryption without a password Read More »

Sitecore zero-day vulnerability exploited by attackers (CVE-2025-53690)

0-day, Don't miss, enterprise, Hot stuff, Mandiant, News, Sitecore, SMBs / SecurityTicks

Sitecore zero-day vulnerability exploited by attackers (CVE-2025-53690) 2025-09-04 at 14:48 By Zeljka Zorz A threat actor is leveraging a zero-day vulnerability (CVE-2025-53690) and an exposed sample ASP.NET machine key to breach internet-facing, on-premises deployments of several Sitecore solutions, Mandiant has revealed. About CVE-2025-53690 CVE-2025-53690 is a ViewState deserialization vulnerability that affects any version of Sitecore […]

Sitecore zero-day vulnerability exploited by attackers (CVE-2025-53690) Read More »