Feb 04, 2025The Hacker NewsVulnerability / Cloud Security Microsoft has released patches to address two Critical-rated security flaws impacting Azure AI Face Service and Microsoft Account that could allow a malicious actor to escalate their privileges under certain conditions. The flaws are listed below – CVE-2025-21396 (CVSS score: 7.5) –
If there ever was a consensus in cybersecurity, it’s that legacy software is one of the weakest links in IT infrastructures. It’s a given that it’s here. That it needs to go is less obvious and much, much easier said than done. So what do you do until that elusive
Sep 14, 2024Ravie LakshmananEnterprise Security / Threat Intelligence Ivanti has revealed that a newly patched security flaw in its Cloud Service Appliance (CSA) has come under active exploitation in the wild. The high-severity vulnerability in question is CVE-2024-8190 (CVSS score: 7.2), which allows remote code execution under certain circumstances. “An
Security experts are raising alarms about a newly patched VMware ESXi hypervisor vulnerability that is being actively exploited by prominent ransomware groups. CVE-2024-37085, despite its 6.8 CVSS rating, has been leveraged by ransomware gangs such as Black Basta, Akira, Medusa, and Octo Tempest/Scattered Spider as a post-compromise technique. This vulnerability
Multiple threat actors are exploiting a newly disclosed security flaw in PHP to distribute remote access trojans, cryptocurrency miners, and DDoS botnets. The vulnerability, identified as CVE-2024-4577 (CVSS score: 9.8), allows attackers to execute malicious commands on Windows systems using Chinese and Japanese language locales. This flaw, publicly disclosed in
Shortly after a new PHP bug was disclosed in late spring, Akamai researchers detected numerous attempts to exploit the vulnerability, highlighting its high exploitability and rapid adoption by threat actors. Given that PHP is one of the most popular server-side scripting languages, used to create dynamic web pages on more
Jun 26, 2024NewsroomVulnerability / Data Protection A newly disclosed critical security flaw impacting Progress Software MOVEit Transfer is already seeing exploitation attempts in the wild shortly after details of the bug were publicly disclosed. The vulnerability, tracked as CVE-2024-5806 (CVSS score: 9.1), concerns an authentication bypass that impacts the following
Chinese hackers breached 20,000 Fortinet FortiGate systems worldwide in 2022 and 2023, using this access to target Western governments and private defense companies in a scheme described as “much more extensive than previously known.” FortiGate is Fortinet’s firewall and network security platform. In February, the company confirmed a vulnerability that
If you haven’t upgraded to version 1.3.0 of Apache HugeGraph, now is the time. At least two proof-of-concept (POC) exploits for a CVSS 9.8-rated remote command execution (RCE) vulnerability in the open-source graph database have been made public. Apache HugeGraph is widely used by developers to build applications based on
As the Central Board of Secondary Education (CBSE) in India released the CBSE results 2024 for its class 10th and 12th examinations, a significant cybersecurity flaw was discovered on the official website. This vulnerability, identified by The Cyber Express, could potentially allow unauthorized individuals to view and alter students’ examination