Exploit for CVE-2025-26055

CVE-2025-26055 CVE Description Author : Rohan Deshpande...

PT-2025-9651

Name of the Vulnerable Software and Affected Versions VMware ESXi and Workstation versions prior to patch availability VMware Fusion versions prior to patch availability Description VMware ESXi, Workstation, and Fusion contain a Time-of-Check Time-of-Use TOCTOU vulnerability that results in an...

A week in security (February 24 – March 2)

Last week on Malwarebytes Labs: Millions of stalkerware users exposed again PayPal’s "no-code checkout" abused by scammers Countries and companies are fighting at the expense of our data privacy Roblox called "real-life nightmare for children" as Roblox and Discord sued Android happy to check you...

Fake CAPTCHA PDFs Spread Lumma Stealer via Webflow, GoDaddy, and Other Domains

Cybersecurity researchers have uncovered a widespread phishing campaign that uses fake CAPTCHA images shared via PDF documents hosted on Webflow's content delivery network CDN to deliver the Lumma stealer malware. Netskope Threat Labs said it discovered 260 unique domains hosting 5,000 phishing P...

Have I Been Pwned Adds ALIEN TXTBASE Data 280M Emails & Passwords

HaveIbeenPwned HIBP website has significantly expanded its database with hundreds of millions of newly compromised credentials extracted by hackers though infostealer logs...

US Background Check Firm Data Breach Exposes 3.3M Records

A data breach at DISA Global Solutions, a firm providing background checks, and drugs and alcohol testing services,…...

Background check provider data breach affects 3 million people who may not have heard of the company

Employment screening company DISA Global Solutions has filed a data breach notification after a cyber incident on their network. DISA says a third party had access to its environment between February 9, 2024, and April 22, 2024. The attacker may have accessed over three million files containing...

CVE-2025-25876

A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /delete.php. The attack can use SQL injection to obtain sensitive data...

CVE-2024-13609

The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data includi...

12 Million Zacks accounts leaked by cybercriminal

A cybercriminal claimed to have stolen 15 million data records from the customers and clients of the company Zacks—a number that a separate investigation, after analysis, shaved down to just 12 million. Zacks is an investment research company best known for its "Zacks Ranks," which are daily list...

ABB Cylon FLXeon 9.3.4 Insecure Backup Sensitive Data Exposure

ABB Cylon FLXeon version 9.3.4 has backups that contain sensitive system files, including main.db, SSL/TLS certificates and keys, the system shadow file with hashed passwords, and the license key. ABB Cylon FLXeon 9.3.4 Insecure Backup Sensitive Data Exposure Vendor: ABB Ltd. Product web page:...

Nearly a Year Later, Mozilla is Still Promoting OneRep

In mid-March 2024, KrebsOnSecurity revealed that the founder of the personal data removal service Onerep also founded dozens of people-search companies. Shortly after that investigation was published, Mozilla said it would stop bundling Onerep with the Firefox browser and wind down its partnershi...

Doxbin Data Breach: Hackers Leak 136K User Records and Blacklist File

Doxbin Data Breach: Hackers leak 136,000+ user records, emails, and a ‘blacklist’ file, exposing those who paid to…...

CVE-2024-13842

A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to read sensitive data...

Cisco Rejects Kraken Ransomware’s Data Breach Claims

Cisco denies recent data breach claims by the Kraken ransomware group, stating leaked credentials are from a resolved 2022 incident. Learn more about Cisco's response and the details of the original attack...

CVE-2024-13842

A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to read sensitive data...

Handala Hackers Claim Massive Data Breach on Israeli Police, Leak 350,000 Files

Iranian-linked hackers claim to have breached Israeli police systems, stealing 2.1TB of sensitive data. Police deny the breach. Learn more about the alleged hack and its implications...

CVE-2022-4093

SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In...

Small business owners, secure your web shop

An online shop is more than just another way to sell your products. It comes with a responsibility to keep the web shop secure. Cybercriminals are looking to steal your customers’ credit card details, their personal data, and even your revenue. And it’s not as if using a platform that is used by...

CVE-2020-14598

Vulnerability in the Oracle CRM Gateway for Mobile Devices product of Oracle E-Business Suite component: Setup of Mobile Applications. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromis...