New mandatory USCG cyber regulations. What you need to know

TL;DR US Coast Guard introduces mandatory new Marine Transportation System cybersecurity requirements They take effect on July 16, 2025, and training must begin by July 17, 2025 US flagged large commercial vessels affected Cybersecurity Officers CySO need to be appointed Penetration testing of...

Online Threats Are Rising -Here’s Why Companies Must Improve Their Cybersecurity

Cybersecurity is a must as online threats rise. Businesses must train employees, back up data, and adopt strong…...

4 Ways to Keep MFA From Becoming too Much of a Good Thing

Multi-factor authentication MFA has quickly become the standard for securing business accounts. Once a niche security measure, adoption is on the rise across industries. But while it's undeniably effective at keeping bad actors out, the implementation of MFA solutions can be a tangled mess of...

CVE-2024-50529

Unrestricted Upload of File with Dangerous Type vulnerability in rudrainn Training – Courses training allows Upload a Web Shell to a Web Server.This issue affects Training – Courses: from n/a through = 2.0.1...

Nanjing Guanbao Technology Development Co., Ltd. safety education and training information system has information leakage vulnerability

Nanjing Tube Bao Technology Development Co., Ltd. is a high-tech enterprise focusing on computer hardware and software research and development, sales, service and system integration. There is an information leakage vulnerability in the security education and training information system of Nanjin...

How Imperva Infused AI Throughout Research and Development

The Age of AI Is Upon Us The current pace of technological change beggars’ belief. Generative Artificial Intelligence GenAI, released to the world a mere two years ago, promises to eliminate much of the tedium of the digital world. Software engineers around the world are already using it to speed...

API Security Is At the Center of OpenAI vs. DeepSeek Allegations

With a high-stakes battle between OpenAI and its alleged Chinese rival, DeepSeek, API security was catapulted to priority number one in the AI community today. According to multiple reports, OpenAI and Microsoft have been investigating whether DeepSeek improperly used OpenAI’s API to train its ow...

⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [13 January]

The cyber world’s been buzzing this week, and it’s all about staying ahead of the bad guys. From sneaky software bugs to advanced hacking tricks, the risks are real, but so are the ways to protect yourself. In this recap, we’ll break down what’s happening, why it matters, and what you can do to...

CISA: OBP Training Fact Sheet

System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...

CISA: Federally Sponsored C-IED Training and Education Resources Catalog

System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...

CISA: VILT Fact Sheet

System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...

CISA: Chemical Sector Security Awareness Training

System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...

Do we still have to keep doing it like this?

Welcome to the first edition of the Threat Source newsletter for 2025. Upon returning to work this week from my Lindt chocolate reindeer coma, my first task was to write this newsletter. As I stared at a blank template hoping for inspiration to suddenly strike, I did what any security professiona...

10 Non-tech things you wish you had done after being breached

TL;DR Non-tech aspects to breach follow-up are often overlooked but essential NDAs, supply chain, and third party contracts and obligations should be reviewed Reviewing communication protocols and employee training increases resilience Looking after, and retaining your people improves recovery fo...

Practice being punched in the face. The realities of incident response preparation

“Everyone has a plan until they get punched in the face.” This Mike Tyson boxing quote perfectly encapsulates the chaos of a cybersecurity breach. TL;DR Accept that your organisation may be breached Train hard. Regularly test incident response plans Build muscle memory Practice getting punched in...

CVE-2024-11984

A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authenticated users to bypass file upload restrictions and perform arbitrary system commands with SYSTEM privilege via a crafted ZIP file...

CVE-2024-11984 SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authenticated users to bypass file upload restrictions and perform arbitrary system commands with SYSTEM privilege via a crafted ZIP file...

CVE-2024-11984

The CVE-2024-11984 vulnerability affects the Corporate Training Management System, specifically the epaper draft function. It describes an unrestricted upload of files with dangerous types that lets remote authenticated users bypass upload restrictions and run arbitrary commands with SYSTEM privi...

CVE-2024-11984 SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authenticated users to bypass file upload restrictions and perform arbitrary system commands with SYSTEM privilege via a crafted ZIP file...

SUNNET Corporate Training Management System 安全漏洞

SUNNET Corporate Training Management System is a corporate training management system from SUNNET. A security vulnerability exists in SUNNET Corporate Training Management System versions prior to 10.13. An attacker can use this vulnerability to execute arbitrary system commands with SYSTEM...