CyberNews

Malware Can Abuse Windows Hello for Business Keys, Giving Hackers Persistent Access to Microsoft Entra ID A chilling security flaw has been discovered in Microsoft’s Windows Hello for Business feature, which allows hackers to gain persistent access to users’ Entra ID credentials. This vulnerability could potentially give attackers a backdoor into sensitive areas of an … Read more

A newly discovered vulnerability in WordPress could allow attackers to execute malicious PHP code on a vulnerable website, highlighting the ongoing threat of pre-authentication (pre-auth) cross-site scripting (XSS) attacks. The issue, which affects all versions of WordPress prior to 6.0.3, has been patched by the platform’s developers, but users are urged to update their sites … Read more

A Novel HTTP Desync Technique Exploits Apache Zero-Day, Putting Millions of Websites at Risk A group of security researchers has uncovered a novel HTTP desync technique that can be used to exploit an unpatched vulnerability in Apache servers, potentially leaving millions of websites vulnerable to attacks. The discovery was made by the team behind AI-Assisted … Read more

Cyber attackers have discovered a new way to hijack Microsoft 365 accounts, using a sophisticated phishing tactic that exploits a weakness in the platform’s authentication mechanism. Dubbed “AitM” (Authentication into Mail), this campaign has already compromised numerous high-profile organizations and individuals, with reports suggesting that payroll and finance emails are being intercepted for malicious purposes. … Read more

A Long-Dormant Linux Vulnerability Can Grant Root Access and Escape Containers, Experts Warn A critical vulnerability in the Linux operating system has been discovered, allowing local attackers to gain root access and potentially escape from containers. The flaw, which affects the Session Traversal of UDP through IPv4 (SCTP) protocol, has been present since 2008 and … Read more

**Identity Exposure Unlocks Active Attack Paths, Leaving Vulnerable Individuals and Organizations Exposed** Imagine waking up one morning to find that your identity has been stolen. Not just any identity, but a carefully crafted digital persona that’s been built over years of online activity. This is not the stuff of science fiction; it’s a reality for … Read more

A Critical WordPress Vulnerability Allows Hackers to Inject Malicious PHP Code, Leaving Millions of Websites Exposed A newly discovered pre-authentication cross-site scripting (XSS) vulnerability in WordPress has been found to allow hackers to inject malicious PHP code on affected websites. The flaw, which affects all versions of WordPress prior to 5.8.3, enables attackers to bypass … Read more

A Novel HTTP Desync Technique Exposed by AI-Assisted Researcher, Exploiting Apache Zero-Day Vulnerability A groundbreaking discovery has been made in the realm of web security, as a researcher using AI-assisted tools uncovered novel techniques for exploiting HTTP desync attacks against Apache servers. This zero-day vulnerability has significant implications for organizations relying on the popular web … Read more

Cyberattackers have been exploiting a previously unknown vulnerability in Microsoft 365’s account management system, allowing them to hijack user accounts and siphon off sensitive emails related to payroll and finance. This sophisticated phishing campaign has left several high-profile organizations scrambling to contain the damage. The attack works by targeting users of Microsoft 365, sending carefully … Read more

A new wave of attacks, dubbed NatJack, is making headlines in the cybersecurity world by hijacking TCP sessions and spoofing DNS queries through manipulation of NAT tables. This sophisticated threat targets organizations with a history of identity exposure, exploiting vulnerabilities that have been present for years but only recently come to light. NatJack works by … Read more