Collaborate Disseminate
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added seven security flaws to its Known Exploited Vulnerabilities (KEV) catalog after they landed in attackers’ crosshairs.
The vulnerabilities are as follows –
Google on Wednesday announced Gemini 3.8 Flash Cyber, which it described as its most capable cybersecurity model, and has made it available to a set of trusted defenders via a new initiative called the Fairwind Program.
“The Fairwind Program gives hig… Continue reading Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs
An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers.
“The campaign has targeted users looking to download popular software and has resulted in compromises across multi… Continue reading Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository’s own Git configuration names a command that the agent runs on the developer’s machine, four of them still unpatched at publication.
A Chinese-speaking cybercrime cluster known as Gambling Goblin has been observed installing malicious Apache modules on compromised web servers run by Brazilian government and educational institutions, and using them to divert visitors to attacker-cont… Continue reading Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages
Virtualizor said hackers used a Border Gateway Protocol (BGP) hijack to divert Softaculous traffic. The hackers then used the diverted update traffic to deliver a malicious Virtualizor package to some installations. A hosting-provider account separatel… Continue reading BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access
Cybersecurity researchers have disclosed details of a new Android banking trojan called StreamRat that was promoted to Spanish-speaking users through a fake television-streaming campaign on Meta and can give operators near-complete control of infected … Continue reading Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control
The debate about whether AI delivers business value is over. The challenge now is implementing it at scale and securely across every function while meeting board-level pressure to move fast. Organizations must focus on adopting AI at business speed wit… Continue reading How to Secure Enterprise AI: From Adoption to Incident Readiness
SonicWall has released security updates to address two security flaws impacting its Secure Mobile Access (SMA) 1000 series VPN appliances that have been exploited in zero-day attacks.
The vulnerabilities, discovered internally by SonicWall’s William P… Continue reading Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain
Two vulnerabilities in GeoNetwork can be chained to achieve unauthenticated remote code execution (RCE) on the open-source geospatial metadata catalog, which sits behind many government and agency geoportals.
The project shipped fixes in versions 4.4…. Continue reading GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends