Attackers distributing a miner and the ClipBanker Trojan via SourceForge

Recently, we noticed a rather unique scheme for distributing malware that exploits SourceForge, a popular website providing software hosting, comparison, and distribution services. The site hosts numerous software projects, and anyone can upload theirs. One such project, officepackage , on the ma...

CVE-2024-41792

creationtimestamp| type| source ---|---|--- 2025-04-08 08:46:49+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10884 2025-04-08 11:48:21+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114302183018844167 2025-04-08 12:07:14+00:00| seen|...

Schneider Electric ConneXium Network Manager Software

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

Schneider Electric Trio Q Licensed Data Radio

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

PT-2025-15596

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to April 2025 Patch Tuesday Description A use-after-free vulnerability exists in the Windows Common Log File System CLFS driver. Successful exploitation of this vulnerability allows an authorized attacker to...

CTEM + CREM: Aligning Your Cybersecurity Strategy

Cyber threats evolve daily, and organizations need to move beyond traditional security approaches to stay ahead. That’s why Continuous Threat Exposure Management CTEM, a concept introduced by Gartner, has been gaining traction. CTEM isn’t just another cybersecurity buzzword; it’s a structured,...

Steps to TruRisk™ – 2: Measuring the Likelihood of Vulnerability Exploitation

Cybersecurity programs rely on various methods to measure the risk associated with vulnerabilities for prioritization, such as CVSS, EPSS, CISA KEV, or even internally developed systems that combine multiple approaches. While these methods help assess whether a specific vulnerability exists on an...

Year in Review: In conversation with the report's authors

🎥 Talos Year in Review 2024: Part 1 & 2 - Watch Now! Another year, another mountain of malicious telemetry to sift through. I spoke with a few of Talos' Year in Review authors, freshly out of the sandbox, to discuss the how's and why's of our biggest findings. 👉 Part 1: The major theme of 2024, t...

CISA and FBI Warn Fast Flux is Powering Resilient Malware, C2, and Phishing Networks

Cybersecurity agencies from Australia, Canada, New Zealand, and the United States have published a joint advisory about the risks associated with a technique called fast flux that has been adopted by threat actors to obscure a command-and-control C2 channel. "'Fast flux' is a technique used to...

Don’t Miss Out: What You Need to Know Before Take Command 2025

Take Command 2025 is just two days away, and there’s still time to secure your spot. Whether you’ve already registered or are building your agenda now, there’s plenty to look forward to — and it all starts this Wednesday, April 9. In the lead-up to the live summit, two new on-demand sessions are...

DDoS Attack Trends in 2024 Signify That Sophistication Overshadows Size

...

⚡ Weekly Recap: VPN Exploits, Oracle's Silent Breach, ClickFix Surge and More

Today, every unpatched system, leaked password, and overlooked plugin is a doorway for attackers. Supply chains stretch deep into the code we trust, and malware hides not just in shady apps — but in job offers, hardware, and cloud services we rely on every day. Hackers don't need sophisticated...

Security Theater: Vanity Metrics Keep You Busy - and Exposed

After more than 25 years of mitigating risks, ensuring compliance, and building robust security programs for Fortune 500 companies, I've learned that looking busy isn't the same as being secure. It's an easy trap for busy cybersecurity leaders to fall into. We rely on metrics that tell a story of...

Cyber Forensic Expert in 2,000+ Cases Faces FBI Probe

A Minnesota cybersecurity and computer forensics expert whose testimony has featured in thousands of courtroom trials over the past 30 years is facing questions about his credentials and an inquiry from the Federal Bureau of Investigation FBI. Legal experts say the inquiry could be grounds to...

fanosanchez.com Cross Site Scripting vulnerability OBB-4042268

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Troy Hunt Gets Phished

In case you need proof that anyone , even someone who does cybersecurity for a living, can fall for a phishing attack, Troy Hunt has a long, iterative story on his webpage about how he got phished. Worth reading. EDITED TO ADD 4/14: Commentary from Adam Shostack and Cory Doctorow...

CVE-2025-2780

creationtimestamp| type| source ---|---|--- 2025-04-04 07:36:06+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10413 2025-04-04 08:02:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3llxxalf7r72r 2025-04-04 08:40:20+00:00| seen|...

Capacity is Critical in Riskier Threat Landscape

International cooperation, reporting, and capacity building are critical to enhance cybersecurity defenses. Effective governance in an increasingly risky landscape requires visibility as well as coordinated vulnerability disclosure...

PT-2025-14888 · Favethemes · Favethemes Homey

Name of the Vulnerable Software and Affected Versions: Favethemes Homey versions 2.4.1 and earlier Description: The issue is related to an Incorrect Privilege Assignment vulnerability, which allows Privilege Escalation. This vulnerability poses substantial risks within digital spaces, emphasizing...

CVE-2025-30406

creationtimestamp| type| source ---|---|--- 2025-04-03 19:35:34+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10326 2025-04-03 21:06:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3llwsmf36672w 2025-04-03 23:36:28+00:00| seen| https://t.me/cvedetector/22026 2025-04-04...