CyberNews A Zero-Day SQL Injection Vulnerability in Metabase Cloud Threatens Widespread Consequences A critical vulnerability has been discovered in Metabase Cloud, a business analytics platform used by numerous organizations worldwide. The zero-day SQL injection flaw allows attackers to gain remote administrator access to affected instances, compromising sensitive data and potentially leading to further attacks on downstream … Read more
Sophisticated iPhone exploit chains once limited to nation-states are spreading rapidly to organized cybercrime groups, posing a significant threat to global security. Two advanced iOS exploit chains, Coruna and DarkSword, have been making headlines in recent months due to their complex nature and widespread adoption. Initially used by nation-state actors and commercial surveillance vendors, these … Read more
The Patch Gap: Why Traditional Vulnerability Management Won’t Cut It in Today’s Threat Landscape Imagine being told that, on average, it takes just four hours for attackers to exploit a newly discovered vulnerability after it’s publicly disclosed. Sounds alarming? That’s exactly what’s happening right now. The rate at which vulnerabilities are being exploited has increased … Read more
A critical zero-day vulnerability has been discovered in the Metabase Cloud business-analytics platform, allowing malicious attackers to gain remote administrator access and potentially compromise downstream organizations. The maximum-severity flaw, which has not yet been assigned a CVE identifier, affects versions 1.58 of the platform and above. According to an advisory posted on GitHub by Metabase, … Read more
Cyberattacks on US Water Systems Continue to Spread, with Iran Suspected as Culprit A wave of cyberattacks targeting water and wastewater systems has been sweeping across the United States, leaving a trail of vulnerable industrial controllers in its wake. At least a dozen states have reported attacks, with the latest victims including Alabama and New … Read more
A Second Polish Energy Plant Falls Victim to Sophisticated Cyber Attackers, Exposing a Novel Attack Path Last year’s devastating cyber attacks on Poland’s energy sector have revealed an alarming new threat vector. A small combined heat-and-power (CHP) plant in Poland was compromised by hackers who exploited a private Access Point Name (APN) network, demonstrating a … Read more
Cyberattacks on US Water Systems Widen, with Iran Suspected Behind the Threats A growing number of states across the US have fallen victim to a wave of cyberattacks targeting their water and wastewater systems. The attacks, which have been linked to Iranian threat actors, have exposed weaknesses in the country’s critical infrastructure, leaving experts warning … Read more
Security researchers at Tenet have unveiled a new attack technique that exploits identity governance gaps in AI agents, allowing attackers to manipulate and hijack these systems with alarming ease. The technique, dubbed “GhostJacking,” works by tricking AI agents into executing malicious commands using seemingly legitimate instructions hidden within trusted data sources. This can include security … Read more
A member of the notorious online cybercrime collective “The Com” has been sentenced to two years in prison for blackmail and sextortion offenses against nearly 120 victims worldwide. Justin Swaddle, known by several aliases on social media platforms, was arrested in October 2023 and pleaded guilty to multiple child sexual abuse offenses at Leeds Crown … Read more
A Devastating Supply-Chain Hack Hits WordPress Admins through BdThemes Plugins A sophisticated threat actor has exploited a vulnerability in the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, to create rogue admin accounts on thousands of websites. The attack, which was first detected by WordPress security firm Defiant on August 7, has … Read more