Help Net Security

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Released: MITRE ATT&CK v17.0, now with ESXi attack TTPs MITRE has released the latest version of its ATT&CK framework, which now also includes a new section (“matrix”) to cover the tactics, techniques and procedures (TTPs) used to target VMware ESXi hypervisors. PoC exploit for critical Erlang/OTP SSH bug is public (CVE-2025-32433) There are now several public proof-of-concept (PoC) exploits for … More →

The post Week in review: MITRE ATT&CK v17.0 released, PoC for Erlang/OTP SSH bug is public appeared first on Help Net Security.

Researchers have uncovered three serious vulnerabilities in Rack, a server interface used by most Ruby web app frameworks (Ruby on Rails, Sinatra, Hanami, Roda, and others). Two of the flaws – CVE-2025-25184 and CVE-2025-27111 – could allow attackers to manipulate log content and entries, while the third one – CVE-2025-27610 – is a path traversal vulnerability that may allow attackers to gain unauthorized access to sensitive information. About CVE-2025-27610 Rack provides a standardized way for … More →

The post Rack Ruby vulnerability could reveal secrets to attackers (CVE-2025-27610) appeared first on Help Net Security.

Detectify announced new Asset Classification and Scan Recommendations capabilities. This innovation directly addresses a critical challenge for security teams: knowing what else, beyond their core applications, requires in-depth testing. The new features automatically classify discovered web assets based on attacker reconnaissance techniques and deliver recommendations on where to run DAST, helping organizations bridge the gap between broad and deep vulnerability testing across their entire attack surface. Security teams know they must test their main applications, … More →

The post Detectify Asset Classification and Scan Recommendations improves vulnerability testing appeared first on Help Net Security.

Rubrik announced its upcoming solution, Identity Resilience, designed to secure the entire identity landscape alongside data. Identity Resilience aims to protect the most common entry points for attackers – human and non-human identities (NHIs) – to help organizations maintain operations with minimal downtime. Identity Resilience aims to address a blindspot in enterprise security. A critical piece of infrastructure utilized by a vast majority of organizations, identity remains a consistent target for hackers. When compromised, these … More →

The post Rubrik Identity Resilience protects vulnerable authentication infrastructure appeared first on Help Net Security.

BreachLock AEV automates multistep, threat-intelligence-led attack scenarios—helping security teams uncover real exposures and prioritize what matters most. Going beyond just showing security teams their risk, BreachLock Adversarial Exposure Validation simulates how real-world adversaries would exploit it by mirroring their behavior with business-aware context throughout each phase of the BreachLock AEV workflow –– from discovery to exploitation. BreachLock AEV enables enterprises to launch automated multi-stage, complex red teaming engagements supercharged by generative AI across multiple threat … More →

The post BreachLock AEV simulates real attacks to validate and prioritize exposures appeared first on Help Net Security.

Dashlane unveiled a new approach to addressing human risk in response to the rise of AI-driven phishing attacks and shadow IT in corporate environments. Built on innovation that pushes beyond vault-based password management, Dashlane Omnix is the AI-accelerated credential security platform that unifies proactive intelligence, real-time response, and protected access to provide businesses complete credential security across their workforce – all in one intuitive experience. While GenAI has accelerated business productivity and innovation, it’s also magnified … More →

The post Dashlane introduces Omnix for AI-powered credential protection appeared first on Help Net Security.

As cloud app adoption continues to rise, and the modern workplace continues to evolve, LastPass will introduce a new approach to democratize access management. Built with the needs of small-to-mid-sized businesses in mind, Secure Access Experiences represents a more unified, intuitive way to manage identity and access in a changing world — without the complexity, cost, or confusion that too often defines the category. The problem: rising risks in a shadowed landscape Today, identity is … More →

The post LastPass Secure Access Experiences simplifies access management appeared first on Help Net Security.

Vanta announced new ways to help organizations demonstrate AI security and evaluate AI risk across their ecosystem. With the launch of Vanta’s new AI Security Assessment offering, customers using, developing or building with AI can now more effectively address critical considerations and proactively strengthen their AI security posture. As AI evolves and becomes increasingly ubiquitous, demonstrating secure practices and managing vendor risk are critical for maintaining trust. According to Vanta’s State of Trust report, 62% … More →

The post Vanta AI Security Assessment evaluates AI risk appeared first on Help Net Security.

76% of respondents have been impacted by incidents of device theft in the past two years, with incidents more common in organizations with more flexible working models, according to Kensington. For instance, research revealed that 85% of organizations with flexible working models experienced an incident of theft in the last 2 years, compared to 71% of organizations whose employees are fully onsite. The study, which surveyed 1,000 IT decision-makers representing a variety of industries, revealed … More →

The post Flexible working models fuel surge in device theft appeared first on Help Net Security.

Organizations have implemented various aspects of threat exposure validation, including security control validation (51%) and filtering threat exposures based on the effectiveness of security controls to mitigate threats (48%), according to Cymulate. At the same time, nearly all respondents say they have implemented exposure validation in one or more areas, including cloud security (53%), security controls (49%), response (36%) and threats (34%). Optimizing defense with exposure validation The report surveyed 1,000 security leaders, SecOps practitioners, … More →

The post Exposure validation emerges as critical cyber defense component appeared first on Help Net Security.

The new ETSI TS 104 223 specification for securing AI provides reliable and actionable cybersecurity guidance aimed at protecting end users. Adopting a whole-lifecycle approach, the framework outlines 13 core principles that expand into 72 detailed, trackable principles across five key phases of the AI lifecycle, all designed to enhance the overall security of AI systems. The specification details transparent, high-level principles and provisions for securing AI. It provides stakeholders in the AI supply chain—from … More →

The post 13 core principles to strengthen AI cybersecurity appeared first on Help Net Security.

AppViewX has announced the launch of the AVX ONE Post-Quantum Cryptography (PQC) Assessment Tool that generates a Cryptographic Bill of Materials and PQC readiness score.

The post AVX ONE PQC Tool delivers crypto inventory, risk insights, and readiness scoring appeared first on Help Net Security.

If your organization is using Commvault Command Center for your data protection, backup creation, configuration and restoration needs, you should check whether your on-premise installation has been upgraded to patch a critical vulnerability (CVE-2025-34028) that could allow unauthenticated remote code execution. About CVE-2025-34028 CVE-2025-34028 is a path traversal vulnerability affecting Commvault Command Center (Innovation Release) versions from 11.38.0 to 11.38.19, on Windows and Linux. It was unearthed by watchTowr researcher Sonny Macdonald, who discovered an … More →

The post Critical Commvault RCE vulnerability fixed, PoC available (CVE-2025-34028) appeared first on Help Net Security.

DirectDefense has launched DirectDefense Security Essentials, a fully managed, subscription-based security program purpose-built for small to mid-sized businesses (SMBs). With Security Essentials, DirectDefense is addressing the critical security needs of the underserved SMB market by combining virtual CISO (vCISO) services, identity threat protection, and vulnerability management at a price point designed for growing businesses. Many SMBs face high exposure to cyber threats but lack the budget, staff, and technology to respond effectively. SMBs also struggle … More →

The post DirectDefense launches Security Essentials to protect growing SMBs appeared first on Help Net Security.

Skyhawk Security is adding new protection for custom-built cloud applications. The company announced the update to its AI-powered Autonomous Purple Team for RSAC 2025 Conference, which starts April 28 in San Francisco. The AI-based purple team identifies security weaknesses and then prioritizes them based on the business value of the asset Proactive cloud defense This expansion helps companies spot security gaps in their cloud applications before attackers do. Skyhawk Security now scans both applications and … More →

The post Skyhawk Security brings preemptive cloud app defense to RSAC 2025 appeared first on Help Net Security.

Mandiant has released the M-Trends 2025 report, which outlines global cyber attack trends based on their own incident response engagements from 2024. Key trends and insights In 2024, Mandiant handled more incidents in the financial sector than in any other industry: 17.4%. Other popular targets? Companies in business and professional services (11.1%), high tech (10.6%), government (9.5%), and healthcare (9.3%). Exploitation of a vulnerability is still the most common initial infection vector (33%), followed by … More →

The post Understanding 2024 cyber attack trends appeared first on Help Net Security.

AuditBoard announced RegComply, a new solution for regulatory compliance management to help organizations stay on top of changing regulations and manage their compliance programs with integrated risk insights. The new solution includes new AI capabilities from AuditBoard and is powered by regulatory change and obligations data from CUBE RegPlatform, a leading global regulatory intelligence solution provider. Today, manually tracking changes across multiple sources, from multiple regulatory bodies, while also assessing the impact of these changes on … More →

The post AuditBoard RegComply helps organizations with ongoing regulatory updates appeared first on Help Net Security.

Swimlane announced Compliance Audit Readiness (CAR) Solution, designed to streamline compliance management and accelerate audit readiness. Powered by the Swimlane Turbine AI Automation Platform and built on the Secure Controls Framework, CAR automates compliance control mapping, streamlines audit evidence gathering and provides real-time risk-based reporting. Compliance audits are complex, time-consuming, and resource-intensive for governance, risk, and compliance (GRC) teams. 54% of organizations spend more than five hours each week on manual audit-related tasks. Gathering evidence … More →

The post Swimlane CAR solution automates compliance control mapping appeared first on Help Net Security.

Metomic launched AI Data Protection Solution, an offering designed to prevent sensitive business data from being inadvertently exposed through AI tools such as ChatGPT, Copilot, Glean, Notion AI, Box AI, and others. As enterprises accelerate AI integration, this solution empowers organizations to harness AI’s benefits while maintaining data security and compliance. With AI and machine learning integration ranking as the top priority for CIOs in 2025, the imperative to secure sensitive business data has never … More →

The post Metomic AI Data Protection prevents data leakage in AI tools appeared first on Help Net Security.

Veracode announced new capabilities to help organizations address emerging threats, giving security professionals better visibility and control in one place. The launch includes new AI-powered functionality in the Dynamic Application Security Testing (DAST)product and an External Attack Surface Management (EASM) capability. Together, they enable security teams to discover their entire attack surface and prioritize the most critical risk to streamline and simplify security scanning. “Security teams need to see and secure everything; not only what … More →

The post Veracode platform enhancements improve software security appeared first on Help Net Security.