Latest CyberSec News by @thecyberpicker

Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover. CVE-2024-5910 . webapps exploit for Multiple platform

DataEase 2.4.0 - Database Configuration Information Exposure. CVE-2024-30269 . webapps exploit for Java platform

A now-patched flaw in Verizon ’s iOS Call Filter app exposed call records of millions. Only phone numbers and timestamps were at risk

A vulnerability in the WinRAR file archiver solution could be exploited to bypass the Mark of the Web (MotW) security warning and execute arbitrary code on a Windows machine.

Coinbase is fixing an incorrect account activity message that freaks out customers and makes them think their credentials were compromised.

EncryptHub compromised 618+ targets using Microsoft flaws and custom malware after failed freelance attempts.

North Korean actors used 11 npm packages downloaded 5,600+ times to spread BeaverTail malware, expanding attacks to Bitbucket.

Royal Elementor Addons and Templates 1.3.78 - Unauthenticated Arbitrary File Upload. CVE-2023-5360 . webapps exploit for Multiple platform

Next.js Middleware 15.2.2 - Authorization Bypass. CVE-2025-29927 . webapps exploit for Multiple platform

Exclusive Addons for Elementor 2.6.9 - Stored Cross-Site Scripting (XSS). CVE-2024-1234 . webapps exploit for Multiple platform

Kubio AI Page Builder 2.5.1 - Local File Inclusion (LFI). CVE-2025-2294 . webapps exploit for Multiple platform

L’Usine Digitale vous propose un récapitulatif des grandes actualités de la semaine en matière de cybersécurité. Au programme, une...-Cybersécurité

Researchers found Disgrasya downloaded 37,217 times, targeting WooCommerce with carding scripts that steal payment data.

Placé sous le thème du Zero Trust, le Forum InCyber s'est tenu cette semaine à Lille. L'Usine Digitale en résume les temps forts et les...-Cybersécurité

Microchip TimeProvider 4100 Grandmaster (Data plot modules) 2.4.6 - SQL Injection. CVE-2024-7801 . remote exploit for Hardware platform

IBM Security Verify Access 10.0.0 - Open Redirect during OAuth Flow. CVE-2024-35133 . webapps exploit for Multiple platform

Criminal and state-linked hackers use fast-changing DNS records to make it harder for defenders to detect or disrupt malicious activity.

A Maryland pharmacist installed spyware on hundreds of computers at a major teaching hospital and recorded videos of staff over the course of a decade, a class-action lawsuit alleges.

The Brooklyn indie art-punk group, Two-Man Giant Squid, just released a new album. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

The bipartisan legislation would strengthen the agency’s authorities to investigate criminal activity tied to digital assets.

The organization that runs Seattle-Tacoma International Airport and several container terminals said it is sending breach notification letters to those affected by a ransomware attack, including about 71,000 people in Washington state.

La société de cybersécurité Mandiant a observé le déploiement de deux familles de malwares suite à l'exploitation d'une vulnérabilité sur des...-Cybersécurité

​Port of Seattle, the U.S. government agency overseeing Seattle's seaport and airport, is notifying roughly 90,000 individuals of a data breach after their personal information was stolen in an August 2024 ransomware attack.

A Minnesota cybersecurity and computer forensics expert whose testimony has featured in thousands of courtroom trials over the past 30 years is facing questions about his credentials and an inquiry from the Federal Bureau of Investigation (FBI). Legal experts say…

A large-scale phishing campaign dubbed 'PoisonSeed' compromises corporate email marketing accounts to distribute emails containing crypto seed phrases used to drain cryptocurrency wallets.

Gen. Timothy D. Haugh served as the head of two government organizations that play integral roles for U.S. cybersecurity.

Over the weekend, a massive wave of credential stuffing attacks hit multiple large Australian super funds, compromising thousands of members' accounts.

A security researcher found a flaw in Verizon call record requests that may have put millions of Americans at risk

It was not immediately clear why Haugh was let go.