CyberNews WordPress, one of the most popular content management systems (CMS) on the web, has introduced a new security feature designed to prevent high-risk plugin updates from causing harm. The company’s latest move aims to protect users from potential vulnerabilities by automating the review process for plugin updates before they are distributed to millions of websites. … Read more
A highly sophisticated cyber attack has compromised no less than 13 organizations across six countries, with hackers exploiting a critical vulnerability in a popular open-source platform. The malicious campaign, attributed to the Red Heron threat actor, leverages an remote code execution (RCE) weakness in Gitea, a widely-used web-based Git repository manager. The scale and scope … Read more
A Critical Flaw in Telegram Desktop Exposes Users’ Private Messages A recently discovered vulnerability in the popular messaging app Telegram Desktop has left users vulnerable to a sophisticated attack that can exfiltrate their private messages. The flaw, which affects version 2.9 of the desktop client, allows an attacker to inject malicious JavaScript code into the … Read more
A notorious attacker has breached the security of Thailand’s leading telecommunications provider, 3BB, using a sophisticated backdoor exploit that granted them root access and allowed them to target subscriber credentials. The attack highlights the risks associated with Internet of Things (IoT) devices and underscores the importance of robust cybersecurity measures in protecting sensitive data. The … Read more
A devastating new attack has been discovered that exploits vulnerabilities in Intel’s TDX (Trusted Domain Extensions) and AMD’s SEV-SNP (Secure Encrypted Virtualization-System-wide Network Processor) confidential computing features. Dubbed DDRop, this sophisticated assault bypasses critical security measures designed to safeguard sensitive data, leaving organizations vulnerable to unprecedented breaches. The DDRop attack targets the memory encryption mechanisms … Read more
A High-Stakes Game of Cat and Mouse: China and US Lock Horns over AI Development The world’s two superpowers are engaged in a heated debate over artificial intelligence, with each side accusing the other of trying to undermine their progress. The latest salvo comes from China, which has reacted strongly to a call by Anthropic … Read more
**Google Workspace Breaches: The Hidden Threat of Malicious OAuth Apps** A new wave of cyber threats is emerging, targeting Google Workspace environments with a sophisticated tactic that doesn’t require exploiting vulnerabilities or stealing passwords. Instead, attackers are using social engineering and malicious OAuth applications to gain unauthorized access to sensitive data. On September 23rd, CyberNews.work … Read more
As the pace of software updates accelerates, IT teams are facing an impossible task: keeping up with the constant stream of new vulnerabilities and patches while minimizing downtime and avoiding security risks. The result is a perfect storm of pressure and compromise, where trade-offs are made between speed and safety. But there’s a better way … Read more
A growing number of individuals and organizations have fallen victim to a sophisticated type of attack, where artificial intelligence (AI) is used to exploit previously unknown vulnerabilities in identity exposure. This has led to the emergence of “active attack paths,” which can be triggered by seemingly innocuous events. As our reliance on AI-driven systems grows, … Read more
Identity exposure has become a ticking time bomb for organizations, with hackers exploiting vulnerabilities to gain unauthorized access. In recent weeks, a series of high-profile breaches has highlighted the alarming trend of identity exposure being used as a launchpad for active attacks. Let’s take a closer look at the stories that have emerged and what … Read more