Cybersecurity researchers have discovered a pair of critical vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, allowing hackers to forge SAML responses and log in as administrators without needing valid credentials. This exploit has been observed in exploitation attempts targeting several thousand websites running the affected plugins. The miniOrange SAML SSO … Read more
As it turns out, a small but significant group of AI users – about 5% of the total – pose an outsized threat to cybersecurity. These individuals, often unwittingly, expose sensitive identities that can be leveraged by malicious actors to carry out devastating attacks. But what exactly is going on here? How are these seemingly … Read more
South Korea’s government-backed startup platform suffered a devastating data breach in July, revealing a critical failure in encryption key management that left sensitive information exposed. The incident highlights the importance of proper encryption key management and serves as a stark reminder that even encrypted data can be compromised when organizations fail to protect their keys. … Read more
Microsoft has introduced a new feature in its popular collaboration platform, Teams, designed to strengthen meeting security by automatically blocking external bots from joining meetings. This move comes as part of an ongoing effort to mitigate the rising threat of attacks that exploit Teams vulnerabilities for unauthorized access and lateral movement on enterprise networks. The … Read more
Cybersecurity firm ReliaQuest has confirmed that it was targeted by attackers who attempted to steal sensitive information after impersonating one of its security employees. The incident highlights the growing threat of social engineering tactics, where hackers use human psychology to gain access to systems and data. The attack began when an individual claiming to be … Read more
Cybersecurity researchers have uncovered a sophisticated threat campaign that leverages a clever technique called “clickjacking” to deliver malicious payloads, including the notorious Amatera malware. This scheme, known as WordlistLoader, has been observed in the wild, targeting users across various industries and compromising their systems with alarming ease. At its core, WordlistLoader is a type of … Read more
Cybersecurity threats are becoming increasingly sophisticated, and one emerging trend is the use of artificial intelligence (AI) to compromise industrial control systems. Recent reports have revealed that attackers are leveraging AI-powered tools to exploit vulnerabilities in programmable logic controllers (PLCs), which are critical components of modern industrial infrastructure. The impact of these attacks is significant, … Read more
Myanmar Government and IT Sector Hit by Sophisticated Backdoor Campaign A highly organized cyber campaign, dubbed Operation QUICSILVER, has compromised several high-profile targets within Myanmar’s government and IT sector. The attackers employed a sophisticated backdoor tool called QUICAgent to gain unauthorized access to sensitive systems, marking the latest example of state-sponsored threat actors exploiting vulnerabilities … Read more
A Critical Keycloak Flaw Puts Millions of Users at Risk of Account Takeover A severe password reset vulnerability in Keycloak, a popular open-source identity and access management (IAM) solution, has been discovered. The flaw, which affects all Keycloak versions since 2016, allows unauthenticated attackers to reset any user’s password, potentially leading to complete account takeover. … Read more
As a major shipping company, Oceanic Logistics, has revealed that it is struggling to keep up with the sheer volume of AI-powered code being injected into its systems. The result? A staggering $10 million remediation debt, incurred from attempting to contain and mitigate the damage caused by these attacks. But what exactly is going on … Read more