OpenSSL Servers Hit by Critical DoS Flaw, Leaving Them Permanently Bloated with Memory A severe denial-of-service (DoS) vulnerability has been discovered in OpenSSL, a widely-used library for secure internet communication. Dubbed HollowByte, this flaw allows unauthenticated attackers to trigger a condition that leaves affected servers permanently bloated with memory, rendering them unable to function. The … Read more
Abbott Laboratories is currently investigating two separate cybersecurity incidents that have raised concerns about unauthorized access to its internal systems and potential data breaches. The company has confirmed that it has been targeted by two different threat actors, who claim to have compromised sensitive information through various means. One of the incidents involves the ShinyHunters … Read more
A new wave of malicious npm packages, seven in total, has been discovered using blockchain-based command and control (C2) infrastructure to deliver a remote access Trojan (RAT). These compromised packages, hosted on the popular JavaScript library registry Vite, have been installed by unsuspecting developers worldwide. The revelation highlights the increasing sophistication and stealth of modern … Read more
A newly discovered vulnerability in OpenSSL, a widely-used cryptographic library, has the potential to freeze server memory with carefully crafted TLS requests. The issue, dubbed “HollowByte,” affects systems using OpenSSL 3.x and can be exploited by attackers sending 11-byte TLS messages. This flaw poses a significant threat to organizations that rely on secure online transactions, … Read more
A newly discovered flaw in WordPress core, dubbed “wp2shell,” allows unauthenticated attackers to inject and run malicious code on affected websites. The vulnerability is particularly concerning because it can be exploited without needing any login credentials or exploiting a separate vulnerability first. As a result, millions of WordPress users are at risk of falling victim … Read more
A recent high-profile attack has exposed a growing risk in enterprise cybersecurity: the vulnerability of artificial intelligence (AI) systems to “authority laundering.” This process occurs when an AI intermediary transforms untrusted input into seemingly trusted internal instructions, allowing attackers to bypass traditional security measures. The incident serves as a warning sign for IT leaders as … Read more
OpenSSL Servers Left Vulnerable to Memory-Consuming Attack A newly discovered vulnerability in OpenSSL, dubbed HollowByte, allows unauthenticated attackers to trigger a denial-of-service (DoS) condition on vulnerable servers with just an 11-byte malicious payload. The issue has been silently patched by the OpenSSL team and backported to older releases. The problem lies in the way vulnerable … Read more
A group of skilled hackers, part of the infamous GoldenEyeDog subgroup, has been linked to a major breach at DigiCert, one of the world’s leading digital certificate authorities. The incident resulted in the theft of code-signing certificates, which are used to authenticate software and prevent tampering. This is a significant threat to the security of … Read more
A New NadMesh Botnet Targets Exposed AI Services, Putting Cloud Security at Risk Researchers have uncovered a sophisticated botnet called NadMesh that’s been aggressively scanning the internet for vulnerable AI services, primarily those exposed on cloud infrastructure. The botnet is specifically hunting for cloud keys and Kubernetes tokens, which could grant attackers unfettered access to … Read more
A recent wave of malicious activity on the npm package registry has exposed thousands of developers and organizations to potential cyber threats. Seven suspicious packages, disguised as legitimate Vite plugins, have been found to use a blockchain-based command and control (C2) infrastructure to deliver a Remote Access Trojan (RAT). This sophisticated attack highlights the increasing … Read more