Funding uncertainty may spell the end of MITRE’s CVE program 2025-04-16 at 14:56 By Zeljka Zorz The future of the Common Vulnerabilities and Exposures (CVE) program hangs in the balance: MITRE, the not-for-profit US organization that runs it, could lose the US federal funding that helps them maintain it. But others have been waiting in […]
Funding uncertainty may spell the end of MITRE’s CVE program Read More »
When companies merge, so do their cyber threats 2025-04-16 at 09:13 By Mirko Zorz For CISOs, mergers and acquisitions (M&A) bring both potential and risk. These deals can drive growth, but they also open the door to serious cybersecurity threats that may derail the transaction. Strong due diligence, smart risk planning, and a shared security […]
When companies merge, so do their cyber threats Read More »
Strategic AI readiness for cybersecurity: From hype to reality 2025-04-16 at 08:34 By Help Net Security AI readiness in cybersecurity involves more than just possessing the latest tools and technologies; it is a strategic necessity. Many companies could encounter serious repercussions, such as increased volumes of advanced cyber threats, if they fail to exploit AI […]
Strategic AI readiness for cybersecurity: From hype to reality Read More »
Attack Flow: Learn how cyber adversaries combine and sequence offensive techniques 2025-04-16 at 08:01 By Help Net Security MITRE’s Attack Flow project aims to translate complex cyber operations into a structured language. By describing how adversaries sequence and combine offensive techniques to reach their objectives, Attack Flow offers defenders, analysts, and decision-makers a tool to […]
Attack Flow: Learn how cyber adversaries combine and sequence offensive techniques Read More »
The future of authentication: Why passwordless is the way forward 2025-04-16 at 07:35 By Sinisa Markovic By now, most CISOs agree: passwords are the weakest link in the authentication chain. They’re easy to guess, hard to manage, and constantly reused. Even the most complex password policies don’t stop phishing or credential stuffing. That’s why passwordless […]
The future of authentication: Why passwordless is the way forward Read More »
Browser extensions make nearly every employee a potential attack vector 2025-04-16 at 07:12 By Help Net Security Despite being present on virtually every employee’s browser, extensions are rarely monitored by security teams or controlled by IT, according to LayerX. Most extensions have access to sensitive data 99% of enterprise users have at least one extension […]
Browser extensions make nearly every employee a potential attack vector Read More »
Hertz data breach: Customers in US, EU, UK, Australia and Canada affected 2025-04-15 at 17:21 By Zeljka Zorz American car rental company Hertz has suffered a data breach linked to last year’s exploitation of Cleo zero-day vulnerabilities by a ransomware gang. The breach resulted in information of an unknown number of customers of Hertz and […]
Hertz data breach: Customers in US, EU, UK, Australia and Canada affected Read More »
Critical flaws fixed in Nagios Log Server 2025-04-15 at 13:47 By Zeljka Zorz The Nagios Security Team has fixed three critical vulnerabilities affecting popular enterprise log management and analysis platform Nagios Log Server. About the flaws The vulnerabilities, discovered and reported by security researchers Seth Kraft and Alex Tisdale, include: 1. A stored XSS vulnerability […]
Critical flaws fixed in Nagios Log Server Read More »
Why shorter SSL/TLS certificate lifespans matter 2025-04-15 at 09:31 By Help Net Security Digital certificates are the unsung heroes of the internet, silently verifying that the websites, apps, and services you use are legit and your data is safe. For years, we’ve leaned on certificates with maximum validity term stretching for months and, in some […]
Why shorter SSL/TLS certificate lifespans matter Read More »
Cybercriminal groups embrace corporate structures to scale, sustain operations 2025-04-15 at 08:33 By Mirko Zorz In this Help Net Security interview, Sandy Kronenberg, CEO of Netarx, discusses how cybercriminal groups are adopting corporate structures and employee incentives to scale operations, retain talent, and evade detection. He covers the strategic collaborations behind major attacks, business-like parallels, […]
Cybercriminal groups embrace corporate structures to scale, sustain operations Read More »
94% of firms say pentesting is essential, but few are doing it right 2025-04-15 at 08:05 By Help Net Security Organizations are fixing less than half of all exploitable vulnerabilities, with just 21% of GenAI app flaws being resolved, according to Cobalt. Big firms take longer to fix pentest issues 94% of firms view pentesting […]
94% of firms say pentesting is essential, but few are doing it right Read More »
Chief Legal Officers step up in cybersecurity oversight 2025-04-15 at 07:42 By Help Net Security In this Help Net Security video, Jennifer Chen, Executive Director of the Association of Corporate Counsel (ACC) Foundation, discusses how globally, Chief Legal Officers (CLOs) are becoming integral leaders in cybersecurity strategy, holding leadership positions, and frequently reporting cybersecurity strategies […]
Chief Legal Officers step up in cybersecurity oversight Read More »
Cybersecurity jobs available right now: April 15, 2025 2025-04-15 at 07:05 By Anamarija Pogorelec CISO Department of Justice | Australia | On-site – View job details As a CISO, you will be responsible for developing and implementing a cyber security strategy as well as establishing and maintaining the organisation’s strategic enterprise-wide information and cyber security […]
Cybersecurity jobs available right now: April 15, 2025 Read More »
Package hallucination: LLMs may deliver malicious code to careless devs 2025-04-14 at 15:46 By Zeljka Zorz LLMs’ tendency to “hallucinate” code packages that don’t exist could become the basis for a new type of supply chain attack dubbed “slopsquatting” (courtesy of Seth Larson, Security Developer-in-Residence at the Python Software Foundation). A known occurrence Many software […]
Package hallucination: LLMs may deliver malicious code to careless devs Read More »
The quiet data breach hiding in AI workflows 2025-04-14 at 08:30 By Mirko Zorz As AI becomes embedded in daily business workflows, the risk of data exposure increases. Prompt leaks are not rare exceptions. They are a natural outcome of how employees use large language models. CISOs cannot treat this as a secondary concern. To […]
The quiet data breach hiding in AI workflows Read More »
Tirreno: Open-source fraud prevention platform 2025-04-14 at 08:01 By Mirko Zorz Tirreno is an open-source fraud prevention platform designed as a universal analytics tool to monitor online platforms, web applications, SaaS products, digital communities, mobile apps, intranets, and e-commerce websites. “Our aim is to liberate online fraud protection technologies, making them widely available for organizations […]
Tirreno: Open-source fraud prevention platform Read More »
Sector by sector: How data breaches are wrecking bottom lines 2025-04-14 at 07:35 By Anamarija Pogorelec Data breaches are rising across industries, hitting healthcare, finance, and retail especially hard. The damage goes beyond lost data, as it’s financial, operational, and reputational. The post Sector by sector: How data breaches are wrecking bottom lines appeared first […]
Sector by sector: How data breaches are wrecking bottom lines Read More »
Organizations can’t afford to be non-compliant 2025-04-14 at 07:01 By Help Net Security Non-compliance can cost organizations 2.71 times more than maintaining compliance programs, according to Secureframe. That’s because non-compliance can result in business disruption, productivity losses, fines, penalties, and settlement costs, among other factors that come with a hefty price tag. Even data breaches […]
Organizations can’t afford to be non-compliant Read More »
Week in review: Microsoft patches exploited Windows CLFS 0-day, WinRAR MotW bypass flaw fixed 2025-04-13 at 11:02 By Help Net Security Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Microsoft fixes actively exploited Windows CLFS zero-day (CVE-2025-29824) April 2025 Patch Tuesday is here, and Microsoft has delivered fixes […]
Hackers exploit old FortiGate vulnerabilities, use symlink trick to retain limited access to patched devices 2025-04-11 at 21:05 By Zeljka Zorz A threat actor that has been using known old FortiOS vulnerabilities to breach FortiGate devices for years has also been leveraging a clever trick to maintain undetected read-only access to them after the original […]