Schneier on Security
MARCH 10, 2025
The malware includes four separate backdoors : Creating four backdoors facilitates the attackers having multiple points of re-entry should one be detected and removed. A unique case we haven’t seen before. Which introduces another type of attack made possibly by abusing websites that don’t monitor 3rd party dependencies in the browser of their users.
Troy Hunt
MARCH 11, 2025
Designing the first logo for Have I Been Pwned was easy: I took a SQL injection pattern, wrote "have i been pwned?" after it and then, just to give it a touch of class, put a rectangle with rounded corners around it: Job done! I mean really, what more did I need for a pet project with a stupid name that would likely only add to the litany of failed nerdy ideas I'd had before that?
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Krebs on Security
MARCH 7, 2025
In September 2023, KrebsOnSecurity published findings from security researchers who concluded that a series of six-figure cyberheists across dozens of victims resulted from thieves cracking master passwords stolen from the password manager service LastPass in 2022.
Security Affairs
MARCH 8, 2025
The Akira ransomware gang exploited an unsecured webcam to bypass EDR and launch encryption attacks on a victim’s network. Cybersecurity researchers at S-RM team discovered a novel attack technique used by the Akira ransomware gang. The ransomware group used an unsecured webcam to encrypt systems within atarget’s network, bypassing Endpoint Detection and Response (EDR).
Advertisement
The DHS compliance audit clock is ticking on Zero Trust. Government agencies can no longer ignore or delay their Zero Trust initiatives. During this virtual panel discussion—featuring Kelly Fuller Gordon, Founder and CEO of RisX, Chris Wild, Zero Trust subject matter expert at Zermount, Inc., and Principal of Cybersecurity Practice at Eliassen Group, Trey Gannon—you’ll gain a detailed understanding of the Federal Zero Trust mandate, its requirements, milestones, and deadlines.
Jane Frankland
MARCH 8, 2025
For nearly a decade, we’ve heard the same discussion in cybersecurity circles about the gender diversity problem. As the first women owned penetration testing provider in the UK some 28-years ago, Ive researched, campaigned, written, spoken and stepped up as a visible role model, always presenting the business case. I’ve also watched how panels, passion projects, and awareness campaigns touting the need for inclusivity and diversity have come and gone including my own.
Schneier on Security
MARCH 7, 2025
The EFF has created an open-source hardware tool to detect IMSI catchers: fake cell phone towers that are used for mass surveillance of an area. It runs on a $20 mobile hotspot.
Cyber Security Informer brings together the best content for cyber security professionals from the widest variety of industry thought leaders.
Krebs on Security
MARCH 11, 2025
Authorities in India today arrested the alleged co-founder of Garantex , a cryptocurrency exchange sanctioned by the U.S. government in 2022 for facilitating tens of billions of dollars in money laundering by transnational criminal and cybercriminal organizations. Sources close to the investigation told KrebsOnSecurity the Lithuanian national Aleksej Besciokov , 46, was apprehended while vacationing on the coast of India with his family.
WIRED Threat Level
MARCH 11, 2025
Elon Musk said a massive cyberattack disrupted X on Monday and pointed to IP addresses originating in the Ukraine area as the source of the attack. Security experts say that's not how it works.
Joseph Steinberg
MARCH 11, 2025
During the upcoming Summer 2025 semester, cybersecurity expert Joseph Steinberg will once again lecture at Columbia University. Steinberg, a faculty member of the Columbia University School of Professional Studies, will teach students pursuing graduate degrees in Technology Management ; the title of the course will be Cybersecurity Strategy and Executive Response , and the course will be taught on Columbia’s main New York City campus in May, June, and July of 2025.
Schneier on Security
MARCH 6, 2025
Interesting article —with photos!—of the US/UK “Combined Cipher Machine” from WWII.
Advertisement
Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.
Penetration Testing
MARCH 10, 2025
A serious vulnerability, CVE-2025-24813, has been discovered in Apache Tomcat, potentially allowing attackers to execute remote code, disclose The post CVE-2025-24813 Flaw in Apache Tomcat Exposes Servers to RCE, Data Leaks: Update Immediately appeared first on Cybersecurity News.
Krebs on Security
MARCH 11, 2025
Microsoft today issued more than 50 security updates for its various Windows operating systems, including fixes for a whopping six zero-day vulnerabilities that are already seeing active exploitation. Two of the zero-day flaws include CVE-2025-24991 and CVE-2025-24993 , both vulnerabilities in NTFS , the default file system for Windows and Windows Server.
Malwarebytes
MARCH 10, 2025
There are more and more sites that use a clipboard hijacker and instruct victims on how to infect their own machine. I realize that may sound like something trivial to steer clear from, but apparently its not because the social engineering behind it is pretty sophisticated. At first, these attacks were more targeted at people that could provide cybercriminals a foothold at a targeted company, but their popularity has grown so much that now anyone can run into one of them.
The Last Watchdog
MARCH 12, 2025
San Jose, Calif., Mar. 12, 2025, CyberNewswire — Aptori , a leader in AI-driven application security, today announced the launch of its AI-driven AppSec Platform on Google Cloud Marketplace as part of graduating from Google Clouds ISV Startup Springboard program. This new agentic AI solution leverages semantic reasoning to analyze application code and logic in real time, delivering deterministic vulnerability detection, contextual risk prioritization, and automated remediation.
Advertisement
Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.
Schneier on Security
MARCH 12, 2025
Former CISA Director Jen Easterly writes about a new international intelligence sharing co-op: Historically, China, Russia, Iran & North Korea have cooperated to some extent on military and intelligence matters, but differences in language, culture, politics & technological sophistication have hindered deeper collaboration, including in cyber.
Penetration Testing
MARCH 10, 2025
A newly discovered vulnerability in the widely-used JavaScript library ‘Axios’ could leave millions of users at risk of The post Popular JavaScript Library ‘Axios’ Exposes Millions to Server-Side Vulnerabilities (CVE-2025-27152) appeared first on Cybersecurity News.
Troy Hunt
MARCH 8, 2025
We survived the cyclone! That was a seriously weird week with lots of build-up to an event that last occurred before I was born. It'd been 50 years since a cyclone came this far south, and the media was full of alarming predictions of destruction. In the end, we maxed out at 52kts just after I recorded this video: It’s here. But 47kts max gusts isn’t too bad, nothing actually blowing over here (yet). pic.twitter.com/qFyrZdiyRW — Troy Hunt (@troyhunt) March 7, 2025 We re
Malwarebytes
MARCH 10, 2025
In the early morning hours of March 10, thousands of users on X (formerly Twitter) began having trouble logging into the platform. It was only the first service blip of at least three to come that same day and, if one cybercriminal group is to be believed, it was all on purpose. Twitter has been taken offline by Dark Storm Team read one message on the messaging and social media platform Telegram.
Advertisement
How many people would you trust with your house keys? Chances are, you have a handful of trusted friends and family members who have an emergency copy, but you definitely wouldn’t hand those out too freely. You have stuff that’s worth protecting—and the more people that have access to your belongings, the higher the odds that something will go missing.
Security Affairs
MARCH 10, 2025
Threat actors exploit PHP flaw CVE-2024-4577 for remote code execution. Over 1,000 attacks detected globally. GreyNoise researchers warn of a large-scale exploitation of a critical vulnerability, tracked as CVE-2024-4577 (CVSS 9.8), in PHP. An attacker could exploit the vulnerability to achieve remote code execution on vulnerable servers using Apache and PHP-CGI.
Schneier on Security
MARCH 11, 2025
Lots of interesting details in the story : The US Department of Justice on Wednesday announced the indictment of 12 Chinese individuals accused of more than a decade of hacker intrusions around the world, including eight staffers for the contractor i-Soon, two officials at China’s Ministry of Public Security who allegedly worked with them, and two other alleged hackers who are said to be part of the Chinese hacker group APT27, or Silk Typhoon, which prosecutors say was involved in the US T
Penetration Testing
MARCH 11, 2025
Following the earlier release of DuckAssist, a digital assistant designed to help users quickly grasp webpage summaries or The post DuckDuckGo Unleashes Duck.ai: Free and Private AI-Powered Chat for Everyone appeared first on Cybersecurity News.
Lohrman on Security
MARCH 9, 2025
What are some good, bad and ugly ways to measure how your security and technology leaders are doing? More important, how do you measure and improve your own growth as a CISO?
Advertiser: Revenera
In a recent study, IDC found that 64% of organizations said they were already using open source in software development with a further 25% planning to in the next year. Most organizations are unaware of just how much open-source code is used and underestimate their dependency on it. As enterprises grow the use of open-source software, they face a new challenge: understanding the scope of open-source software that's being used throughout the organization and the corresponding exposure.
Zero Day
MARCH 10, 2025
Ubuntu is based on Debian, but they're not the same. To help you choose which to install, we compare support, pre-installed software, release cycle, user-friendliness, and more.
Security Affairs
MARCH 10, 2025
Microsoft researchers reported that North Korea-linked APT tracked as Moonstone Sleet has employed the Qilin ransomware in limited attacks. Microsoft observed a North Korea-linked APT group, tracked as Moonstone Sleet, deploying Qilin ransomware in limited attacks since February 2025. The APT group uses Qilin ransomware after previously using custom ransomware. “Moonstone Sleet has previously exclusively deployed their own custom ransomware in their attacks, and this represents the first i
Penetration Testing
MARCH 11, 2025
A severe vulnerability has been discovered in the popular WordPress plugin “HUSKY WooCommerce Products Filter Professional,” formerly The post Critical Flaw Exposes 100,000+ WooCommerce Sites: Unauthenticated File Inclusion Threatens Total Takeover appeared first on Cybersecurity News.
Advertisement
After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!
The Hacker News
MARCH 6, 2025
Over 1,000 websites powered by WordPress have been infected with a third-party JavaScript code that injects four separate backdoors. "Creating four backdoors facilitates the attackers having multiple points of re-entry should one be detected and removed," c/side researcher Himanshu Anand said in a Wednesday analysis. The malicious JavaScript code has been found to be served via cdn.
Malwarebytes
MARCH 12, 2025
Google is spying on Android users, starting from even before they have logged in to their Google account. That’s what researchers from Dublins Trinity College found after they conducted a measurement study to investigate the cookies, identifiers and other data stored on Android devices by Google Play Services. As the company behind the Android Operating System (OS), the Google Play Store, the most popular search engine in the world, and part of the leading company in digital advertising (A
Zero Day
MARCH 11, 2025
Almost one in four tech jobs in the US need people with AI skills, according to recent job data.
Tech Republic Security
MARCH 7, 2025
In 2024, women accounted for 22% of global security teams on average, compared to 17% in 2023, according to ISC2.
Advertisement
The healthcare industry has massively adopted web tracking tools, including pixels and trackers. Tracking tools on user-authenticated and unauthenticated web pages can access personal health information (PHI) such as IP addresses, medical record numbers, home and email addresses, appointment dates, or other info provided by users on pages and thus can violate HIPAA Rules that govern the Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.
Expert insights. Personalized for you.
281 
Let's personalize your content