OpenSSL Servers Left Vulnerable to Memory-Consuming Attack A newly discovered vulnerability in OpenSSL, dubbed HollowByte, allows unauthenticated attackers to trigger a denial-of-service (DoS) condition on vulnerable servers with just an 11-byte malicious payload. The issue has been silently patched by the OpenSSL team and backported to older releases. The problem lies in the way vulnerable … Read more
A group of skilled hackers, part of the infamous GoldenEyeDog subgroup, has been linked to a major breach at DigiCert, one of the world’s leading digital certificate authorities. The incident resulted in the theft of code-signing certificates, which are used to authenticate software and prevent tampering. This is a significant threat to the security of … Read more
A New NadMesh Botnet Targets Exposed AI Services, Putting Cloud Security at Risk Researchers have uncovered a sophisticated botnet called NadMesh that’s been aggressively scanning the internet for vulnerable AI services, primarily those exposed on cloud infrastructure. The botnet is specifically hunting for cloud keys and Kubernetes tokens, which could grant attackers unfettered access to … Read more
A recent wave of malicious activity on the npm package registry has exposed thousands of developers and organizations to potential cyber threats. Seven suspicious packages, disguised as legitimate Vite plugins, have been found to use a blockchain-based command and control (C2) infrastructure to deliver a Remote Access Trojan (RAT). This sophisticated attack highlights the increasing … Read more
Criminals are getting more sophisticated in their online activities, and one key area they’re focusing on is creating convincing digital identities. A recent analysis of underground posts has revealed that carders – individuals who engage in credit card theft – are no longer relying solely on residential proxies to carry out their schemes. In fact, … Read more
Ernst & Young Reveals Data Breach After Support System Hack, Leaving Thousands of Clients Concerned Global auditing and professional services giant Ernst & Young (EY) has disclosed a data breach that occurred when an unauthorized third party accessed its support ticket system. The compromised platform allowed hackers to download multiple documents containing sensitive client information, … Read more
A sophisticated phishing campaign has been uncovered, leveraging fake coding tests and SVG flag images to deliver malicious malware linked to the notorious OtterCookie botnet. The attack’s novelty lies in its ability to evade detection by security software, making it a pressing concern for developers and organizations worldwide. The scheme targets individuals with programming skills, … Read more
A sophisticated cyber threat group, known as GoldenEyeDog Subgroup, has been linked to a major breach of DigiCert’s certificate authority infrastructure, resulting in the theft of code-signing certificates. This malicious activity has significant implications for software security and highlights the growing threat posed by advanced AI-powered attacks. The breach is believed to have occurred sometime … Read more
A new botnet, dubbed NadMesh, has been identified hunting for exposed AI services that have been left unsecured on cloud platforms and Kubernetes clusters. This alarming trend highlights the growing threat of AI-powered attacks, which are increasingly being used by malicious actors to compromise sensitive systems. NadMesh is a sophisticated botnet that leverages machine learning … Read more
In just over three months, Microsoft will withdraw mainstream support for its popular server operating system, Windows Server 2022. This means that after October 13, 2026, no new features or security updates will be released for this version of the software, leaving systems vulnerable to emerging threats. The withdrawal of mainstream support is a natural … Read more