CyberNews Federal Agencies Given Three Days to Mitigate Critical Vulnerabilities Exploited by Hackers The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning to federal agencies, alerting them to a trio of critical vulnerabilities being actively exploited by hackers. The flaws affect IBM’s Langflow visual framework for building AI agents, N-able’s remote monitoring … Read more
A sophisticated cyberattack campaign has been uncovered, targeting US companies with a novel exploit that leverages Microsoft’s authentication mechanisms against its own security protocols. Dubbed “Kali365,” this attack vector takes advantage of vulnerabilities in Microsoft Azure Active Directory (Azure AD), allowing attackers to gain elevated privileges and traverse organizational boundaries. At the core of Kali365 … Read more
A newly discovered vulnerability in Linux kernel components, known as OVSwrap, has left many organizations vulnerable to a potentially devastating attack. The flaw, which affects systems running Open vSwitch (OVS), allows local users to gain root privileges on affected systems, essentially giving them free rein over the network. The OVS system is used for virtual … Read more
A New Wave of Sophisticated Attacks Uses npm Packages and Ethereum Recipient Addresses to Exfiltrate Sensitive Data Cybersecurity researchers have uncovered a novel attack vector that leverages the popular npm package manager to deliver sophisticated malware. The malicious code, disguised as legitimate packages, has been found to contain a clever mechanism for exfiltrating sensitive data … Read more
A trio of high-severity vulnerabilities, including a critical cross-tenant bug with a perfect 10.0 CVSS score, has been disclosed in popular software tools Veeam, Terraform MCP, and Django. These flaws could allow attackers to breach sensitive systems, compromising user identities and data. The most severe vulnerability affects Veeam Backup & Replication, a widely used backup … Read more
A Major Breach in Open VSX: 77 Malicious Extensions Exploiting Developer Data Exposed Open VSX, a popular open-source software framework for Visual Studio Code (VS Code), has suffered a significant security breach. The platform’s administrators have removed 77 malicious extensions from its repository after discovering that they were secretly exfiltrating sensitive developer data. This incident … Read more
Security Breach Exposes n8n API Tokens, Putting Live Instances at Risk of Credential Theft A shocking security lapse has been discovered in live instances of n8n, a popular workflow automation platform. An investigation revealed that sensitive API tokens, used for authentication and authorization, had been leaked, putting thousands of users’ data at risk. The exposed … Read more
Cybersecurity Researchers Sound Alarm Over Critical Gitea Vulnerability A critical security flaw in the popular open-source Git repository manager, Gitea, has been uncovered, allowing unauthenticated attackers to read server files on vulnerable systems. The vulnerability, discovered by cybersecurity researchers, affects organizations using Gitea for version control and collaboration. The issue lies in how Gitea processes … Read more
**Highly Sensitive Data Leaked by Kali365, Putting US Companies in Jeopardy** A disturbing trend has emerged in the world of cybersecurity, as a sophisticated threat actor, known as Kali365, has been using Microsoft authentication protocols against unsuspecting US companies. The group’s tactics have left many wondering if their most sensitive data is secure. Kali365’s modus … Read more
A Critical Linux Kernel Flaw Exposes Systems to Root Exploitation via Open vSwitch Researchers have discovered a critical vulnerability in the Open vSwitch (OVS) kernel module, allowing local users with access to the network interface to gain root privileges on affected systems. This flaw, dubbed OVSwrap, has significant implications for any organization using Linux-based infrastructure … Read more