Cyber Security News

Oracle has announced the release of VirtualBox 7.2, a major update to the popular open-source virtualization platform that introduces significant enhancements for Windows 11/Arm virtualization, comprehensive GUI improvements, and numerous bug fixes.  Released on August 14, 2025, this version marks a substantial advancement in cross-platform virtualization capabilities, particularly targeting the growing Arm-based computing ecosystem while […]

The post VirtualBox 7.2 Released With Support for Windows 11/Arm VMs and 50 Bug Fixes appeared first on Cyber Security News.

A critical security vulnerability has been discovered in Rockwell Automation’s ControlLogix Ethernet communication modules, potentially allowing remote attackers to execute arbitrary code on industrial control systems.  The vulnerability, tracked as CVE-2025-7353, affects multiple ControlLogix Ethernet modules and carries a maximum CVSS score of 9.8, indicating severe security implications for industrial automation environments.  Key Takeaways1. Critical […]

The post Rockwell ControlLogix Ethernet Vulnerability Let Attackers Execute Remote Code appeared first on Cyber Security News.

Use-after-free (UAF) vulnerabilities represent one of the most critical and prevalent security threats in modern software systems, particularly affecting applications written in memory-unsafe languages like C and C++. These vulnerabilities occur when a program continues to use a memory location after it has been freed, creating opportunities for attackers to manipulate program execution flow, corrupt […]

The post What is Use-After-Free Vulnerability? – Impact and Mitigation appeared first on Cyber Security News.

Workday, a leading provider of enterprise cloud applications for finance and human resources, has confirmed it was the target of a sophisticated social engineering campaign that resulted in a data breach via a third-party Customer Relationship Management (CRM) platform. The company emphasized that the incident did not compromise customer data or tenants. In a recent […]

The post HR Giant Workday Discloses Data Breach After Hackers Compromise Third-Party CRM appeared first on Cyber Security News.

A cybersecurity researcher has discovered that hundreds of publicly accessible TeslaMate installations are exposing sensitive Tesla vehicle data without authentication, revealing GPS coordinates, charging patterns, and personal driving habits to anyone on the internet.  The vulnerability stems from misconfigured deployments of the popular open-source Tesla data logging tool, which connects to Tesla’s official API to […]

The post Hundreds of TeslaMate Installations Leaking Sensitive Vehicle Data in Real Time appeared first on Cyber Security News.

A significant security update rolled out by Microsoft with the Windows 11 24H2 (KB5063878) release is causing widespread issues for users, with reports surfacing that the update can render SSDs and HDDs inaccessible and may potentially corrupt user data. Last week’s Patch Tuesday (August 2025) saw Microsoft release several critical security updates for Windows 10 […]

The post Windows 11 24H2 Security Update Causes SSD/HDD Failures and Potential Data Corruption appeared first on Cyber Security News.

In a significant breach of both cybersecurity defenses and secrecy, a trove of sensitive hacking tools and technical documentation, believed to originate from a North Korean threat actor, has recently been leaked online. The dump, revealed through an extensive article in Phrack Magazine, includes advanced exploit tactics, a detailed system compromise log, and most notably, […]

The post North Korean Hackers Stealthy Linux Malware Leaked Online appeared first on Cyber Security News.

A threat actor operating under the alias “Chucky_BF” has posted a concerning advertisement on a well-known cybercrime forum, claiming to possess and sell a “Global PayPal Credential Dump 2025” containing over 15.8 million email and plaintext password pairs.  The dataset, measuring approximately 1.16GB in plain text format, allegedly comprises sensitive credentials sourced from multi-domain PayPal […]

The post Threat Actor Allegedly Claiming Access to 15.8 Million PayPal Email and Passwords in Plaintext appeared first on Cyber Security News.

As families across the country prepare for the return to school, cybercriminals are exploiting the seasonal rush with a fresh wave of sophisticated shopping scams. Leveraging peaks in online spending, scammers are deploying malicious campaigns that prey on unsuspecting users searching for supply deals and exclusive offers. The emergence of these scams coincides with growing […]

The post Beware of New back-to-school Shopping Scams That Tricks Drives Users to Fake Shopping Sites appeared first on Cyber Security News.

In the week of August 11-17, 2025, the cybersecurity landscape was marked by critical updates from major vendors and a surge in sophisticated threats, underscoring the ongoing battle against digital vulnerabilities. Microsoft rolled out its Patch Tuesday updates on August 12, addressing over 90 vulnerabilities, including several zero-day exploits in Windows and Office suites that […]

The post Weekly Cybersecurity News Recap : Microsoft, Cisco, Fortinet Security Updates and Cyber Attacks appeared first on Cyber Security News.

A newly discovered zero-day vulnerability in Elastic’s Endpoint Detection and Response (EDR) solution allows attackers to bypass security measures, execute malicious code, and trigger a BSOD system crash, according to the Ashes Cybersecurity research. The vulnerability resides in a core component of the security software, effectively turning the defensive tool into a weapon against the […]

The post New Elastic EDR 0-Day Vulnerability Allows Attackers to Bypass Detection, Execute Malware, and Cause BSOD appeared first on Cyber Security News.

CISA in collaboration with international partners, has released comprehensive guidance, titled “Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators,” to strengthen cybersecurity defenses across critical infrastructure sectors. The document emphasizes the critical importance of maintaining accurate operational technology (OT) asset inventories as malicious cyber actors increasingly target industrial control systems (ICS), supervisory […]

The post CISA Releases Operational Technology Guide for Owners and Operators Across all Critical Infrastructure appeared first on Cyber Security News.

Google has awarded a record-breaking $250,000 bounty to security researcher “Micky” for discovering a critical remote code execution vulnerability in Chrome’s browser architecture.  The vulnerability allowed malicious websites to escape Chrome’s sandbox protection and execute arbitrary code on victim systems.  Key Takeaways1.Google paid researcher "Micky" a record amount for finding a critical Chrome vulnerability.2.The bug […]

The post Google Awards $250,000 Bounty for Chrome RCE Vulnerability Discovery appeared first on Cyber Security News.

A critical vulnerability in the Microsoft Web Deploy tool could allow authenticated attackers to execute remote code on affected systems.  The vulnerability, tracked as CVE-2025-53772, was disclosed on August 12, 2025, and carries a CVSS score of 8.8, indicating high severity. The flaw stems from the deserialization of untrusted data in Web Deploy, classified under […]

The post Microsoft IIS Web Deploy Vulnerability Let Attackers Execute Remote Code appeared first on Cyber Security News.

A sophisticated new phishing campaign targeting Gmail users through a multi-layered attack that uses legitimate Microsoft Dynamics infrastructure to bypass security measures and steal login credentials. The attack begins with deceptive “New Voice Notification” emails that appear to come from legitimate voicemail services. These emails contain spoofed sender information and feature prominent “Listen to Voicemail” […]

The post New Gmail Phishing Attack With Weaponized Login Flow Steals Credentials appeared first on Cyber Security News.

Security researchers have uncovered four serious vulnerabilities in ImageMagick, one of the world’s most widely used open-source image processing software suites, potentially exposing millions of users to security risks. The vulnerabilities, discovered by researcher “urban-warrior” and published three days ago, include two high-severity flaws that could allow attackers to execute malicious code through specially crafted […]

The post Multiple ImageMagick Vulnerabilities Cause Memory Corruption and Integer Overflows appeared first on Cyber Security News.

F5 Networks has disclosed a new HTTP/2 vulnerability affecting multiple BIG-IP products that could allow remote attackers to launch denial-of-service attacks against corporate networks. The security flaw, designated CVE-2025-54500 and dubbed the “HTTP/2 MadeYouReset Attack,” was published on August 13, 2025, with updates released on August 15. The vulnerability exploits malformed HTTP/2 control frames to […]

The post F5 Fixes HTTP/2 Vulnerability Enabling Massive DoS Attacks appeared first on Cyber Security News.

Researchers at Hunt.io have made a significant discovery in the cybersecurity field by obtaining and analyzing the complete source code of ERMAC V3.0. This advanced Android banking trojan targets over 700 financial applications worldwide. This unique insight into an active malware-as-a-service platform offers a valuable understanding of modern cybercriminal operations and highlights critical vulnerabilities that could assist […]

The post ERMAC v3.0 Banking Malware Source Code Exposed via Weak Password ‘changemeplease’ appeared first on Cyber Security News.

A sophisticated social engineering campaign by the EncryptHub threat group that combines impersonation tactics with technical exploitation to compromise corporate networks. The Russian-linked cybercriminals are posing as IT support staff and using Microsoft Teams requests to establish remote access, ultimately deploying malicious payloads through a previously unknown Windows vulnerability. The attack begins with threat actors […]

The post Hackers Mimic IT Teams to Exploit Microsoft Teams Request to Gain System Remote Access appeared first on Cyber Security News.

API, short for Application Programming Interface, is a mechanism that helps extract data from software applications and transfer it to other software or users using APIs. Communication through APIs is based on different requests and responses, and developers provide good documentation on structuring requests to get the desired response. APIs allow many software/applications to automatically […]

The post <strong>10 Best API Protection Tools</strong> in 2025 appeared first on Cyber Security News.