Ongoing Xurum Attacks on E-commerce Sites Exploiting Critical Magento 2 Vulnerability

E-commerce sites using Adobe's Magento 2 software are the target of an ongoing campaign that has been active since at least January 2023. The attacks, dubbed Xurum by Akamai, leverage a now-patched critical security flaw CVE-2022-24086, CVSS score: 9.8 in Adobe Commerce and Magento Open Source...

Wiz's agentless approach to cloud-native vulnerability management

Prioritize critical vulnerabilities based on business impact with Wiz’s agentless Vulnerability Management solution...

Trend Vision One™ - A Cybersecurity Consolidation Path

A single-platform approach delivers value greater than the sum of its parts...

(Micro)Segmentation from a Practical Perspective

...

Platform Approach to Cybersecurity: The New Paradigm

Embracing platform approach as the path to enhanced security and resilience...

Human vs Machine Identity Risk Management

In today's business world's dynamic and ever-changing digital landscape, organizations encounter escalating security challenges that demand a more business-friendly and pertinent approach...

SRE vs DevOps: Differences & Similarities

SRE vs DevOps: which approach should you use? Explore shared goals and distinctions between their functions and responsibilities...

“Picture in Picture” Technique Exploited in New Deceptive Phishing Attack

By Habiba Rashid The innovative approach, known as "picture in picture," capitalizes on users trust in familiar logos and promotions, making… This is a post from HackRead.com Read the original post: "Picture in Picture" Technique Exploited in New Deceptive Phishing Attack...

GHSA-86H2-2G4G-29QX avo possible unsafe reflection / partial DoS vulnerability

Summary The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. Details After reviewing th...

Implementing Risk-Based Vulnerability Discovery and Remediation

In this day and age, vulnerabilities in software and systems pose a considerable danger to businesses, which is why it is essential to have an efficient vulnerability management program in place. To stay one step ahead of possible breaches and reduce the damage they may cause, it is crucial to...

EFB vulnerability in Lufthansa’s Lido eRouteManual

Almost all commercial airlines now use electronic flight bags EFBs to drive efficiency and safety in their operations. We’ve been testing the security of EFBs and their apps, here’s our latest findings. TL;DR Many airlines use Lufthansa Systems Lido eRoute Manual for their EFB approach plates. We...

Manage Cyber Risk with a Platform Approach

Discover how a platform approach can best assist and support security operations teams with a cyber risk management so you can be more resilient with less resources...

How to Set Up a Threat Hunting and Threat Intelligence Program

Threat hunting is an essential component of your cybersecurity strategy. Whether you're getting started or in an advanced state, this article will help you ramp up your threat intelligence program. What is Threat Hunting? The cybersecurity industry is shifting from a reactive to a proactive...

Rapture, a Ransomware Family With Similarities to Paradise

In March and April 2023, we observed a type of ransomware targeting its victims via a minimalistic approach with tools that leave only a minimal footprint behind. Our findings revealed many of the preparations made by the perpetrators and how quickly they managed to carry out the ransomware attac...

Healthy security habits to fight credential breaches: Cyberattack Series

Fifty percent of Microsoft cybersecurity recovery engagements relate to ransomware,1 and 61 percent of all breaches involve credentials.2 In this second report in our ongoing Cyberattack Series, we look at the steps taken to discover, understand, and respond to a push-bombing request that targete...

How to put your organization’s cloud security strategy into action

CISOs of Paramount, Aon and Wiz reveal their secrets for creating a future-proof approach to cloud security...

Deloitte and Wiz Announce a Strategic Alliance to Help their Mutual Clients Accelerate Digital Transformation with a Modern Cloud Security Strategy

New alliance to enable organizations to proactively identify, prioritize, remediate, and prevent risks in their cloud...

Hacking Pickleball

My latest book, A Hackers Mind, has a lot of sports stories. Sports are filled with hacks, as players look for every possible advantage that doesnt explicitly break the rules. Heres an example from pickleball, which nicely explains the dilemma between hacking as a subversion and hacking as...

Rapid7 Podcast Explores Hybrid-First Workplace Learnings

As the world continues to navigate the post-pandemic shift in work environments, Rapid7 is operating on a hybrid-first approach that balances flexibility and productivity with collaboration and optimizing for customer success. In the spirit of cross-collaboration, the People Development and...

Secure hybrid and remote workplaces with a Zero Trust approach

Productivity and innovation have become critical goals in many hybrid and remote work environments. Ensuring preventative and strong security, in turn, must be at the heart of that. In this blog series, we’ll discuss two Zero Trust business scenarios: enabling a more productive hybrid or remote...