Cisco Systems Inc. has disclosed a critical vulnerability in its IOS XE Wireless LAN Controllers that could let remote attackers take full control of affected devices without authentication. Tracked as CVE-2025-20188, the flaw carries a maximum CVSS severity score of 10.0 and stems from a hard-coded JSON Web Token in the Out-of-Band Access Point Image […]
IXON, a Dutch provider of industrial remote access solutions, has patched two high-severity vulnerabilities in its VPN Client software that could allow local attackers to escalate privileges to system level on Windows, Linux, and macOS platforms. Tracked as CVE-2025-26168 and CVE-2025-26169, the flaws affect all versions prior to 1.4.4 and were assigned a CVSS score […]
Malicious advertisements posing as cryptocurrency exchange platforms are circulating on Facebook, distributing malware to unsuspecting users. The ads, designed to mimic legitimate crypto services, lure victims by promising investment opportunities or exclusive trading tools. Once clicked, users are redirected to compromised websites where malware is covertly installed on their devices. This campaign underscores growing concerns […]
Microsoft will continue delivering security updates for Microsoft 365 (M365) applications running on Windows 10 through 2028, extending support for its productivity suite even as the underlying operating system nears end-of-life. The announcement offers clarity for enterprise users relying on Windows 10 systems, though it highlights a growing divide between application and OS support. While […]
Twilio Inc. denied reports of a security breach after a threat actor claimed to possess over 89 million Steam user records, including one-time access codes. In a statement to BleepingComputer, the communications platform said it had not been compromised, countering allegations that its systems were the source of the data leak. The claims emerged online, […]
The European Union Agency for Cybersecurity (ENISA) has published a new *Handbook for Cyber Stress Testing*, designed to assist national authorities in evaluating the cybersecurity posture and operational resilience of critical sector entities. The document outlines a structured approach for conducting cyber stress tests, offering guidance on planning, execution and evaluation of results. This initiative […]
Threat actors affiliated with the 3AM ransomware group have deployed highly targeted intrusion techniques in early 2024, including email bombing and impersonation of IT support personnel, according to a report from BleepingComputer. The attackers used email bombing — a tactic involving a flood of irrelevant emails — to obscure critical security alerts and distract potential […]
Hackers are leveraging counterfeit software installers disguised as popular applications, including LetsVPN and QQ Browser, to distribute the Winos 4.0 malware framework, cybersecurity researchers revealed. The campaign, uncovered by Rapid7 in February 2025, employs a sophisticated multi-stage loader known as Catena to execute the attack. Catena functions as a memory-resident loader, embedding shellcode and configuration-switching […]
ConnectWise ScreenConnect has emerged as the most exploited remote access tool (RAT) in cyberattacks throughout 2025, according to a report by Hackread. The remote desktop solution, commonly used for IT support and system administration, was frequently leveraged by threat actors to gain unauthorized access to networks and systems. Its widespread abuse underscores growing security concerns […]
Telecommunications services across Spain suffered a widespread outage on Tuesday, May 20, 2025, following a scheduled network update by Telefónica that triggered a cascading failure across multiple carriers. Fixed-line and mobile services were disrupted nationwide, with Madrid, Barcelona and other urban centers reporting significant connectivity issues. Major providers including Movistar, Orange, Vodafone, Digimobil and O2 […]
More than 100 malicious Chrome browser extensions have been discovered hijacking user sessions, stealing credentials, and injecting unwanted ads, according to recent findings. The campaign, active since at least February 2024, involves an unidentified threat actor who has developed and distributed the rogue extensions under the guise of legitimate utilities and productivity tools. The extensions […]
A Russian-linked hacking group known as Void Blizzard has intensified its cyber-espionage operations, focusing on infiltrating organizations by targeting their external partners and contractors, according to new findings. The group is reportedly leveraging these indirect access points to obtain login credentials and sensitive internal data, heightening concerns among cybersecurity professionals. Void Blizzard’s strategy reflects a […]