Sead Fadilpašić

Microsoft Trusted Signing is being abused to grant malware short-lived certificates and help it bypass endpoint protection.

Hundreds of projects suffered as hackers attacked Coinbase.

Hacker claims they were able to upload a .txt file with their email address to Oracle servers.

Older versions of WP Ghost grant threat actors remote code execution abilities so make sure to update the plugin.

Two Cisco vulnerabilities are being abused in the wild, so patch up.

A NAKIVO bug patched in November 2024 has been added to CISA's KEV catalog, so update now.

Researchers criticize the way Veeam handled deserialization flaws.

ServiceNow patched the flaws in May 2024, so users should update immediately.

Cybernews found a non-password-protected database containing Collectibles.com user names, addresses, and more.

The Pennsylvania State Education Association suffered a ransomware attack in 2024 which exposed sensitive user data on thousands.

Zero-click zero-day was allegedly being used by multiple nation-states against journalists and other high-profile targets.

DollyWay has been around since 2016, distributing malware, and redirecting people to fake gambling sites.

Virtual disk files allow cybercriminals to bypass security protections.

Bitdefender uncovers a large-scale ad fraud campaign employing hundreds of Android apps.

McAfee is warning of a "cocktail of malware" hiding behind fake DeepSeek apps.

Someone stole sensitive data from California Cryobank, including names, bank accounts, and more.

North Korea, Russia, China, and others are abusing an ancient flaw in .LNK files to attack Windows.

This is the second attack on Orange in less than a month, both done by ransomware actors.

Hackers are building on their salting technique to bypass email protection, track users, and redirect them to phishing pages.

Both bugs were fixed in January 2025, but users should update immediately.

StilachiRAT malware hides easily, allows for remote code execution, and steals data.