Latest CyberSec News by @thecyberpicker

Malicious PyPI package rerouted MEXC crypto orders and exposed API keys, downloaded 1,065 times.

Apache Roller flaw CVE-2025-24859 keeps sessions active after password changes, risking persistent access.

UNC5174 uses SNOWLIGHT and VShell to target Linux and macOS systems, exploiting Ivanti flaws for remote control.

Microsoft warned Windows users of increased CPU usage when typing while using recent versions of the classic Outlook email client.

Burp Suite Enterprise Edition has a new name: Burp Suite DAST. This new name better reflects what the product truly is: the most accurate, scalable solution for automated dynamic application security

Google is rolling out a new security mechanism on Android devices that will automatically reboot locked, unused devices after three consecutive days of inactivity, restoring memory to an encrypted state.

This week in cybersecurity from the editors at Cybercrime Magazine

Explore why training is essential and what specific areas should be covered to ensure compliance with the White House Executive Order and ethical AI usage.

99% of employees use browser extensions + 53% access sensitive data + exposing entire organizations to risk.

Regulatory compliance and data protection were the biggest cybersecurity challenges cited by UK financial organizations, according to a Bridewell survey

Prepare for PCI DSS v4.x compliance by April 1, 2025. Learn about mandatory Future-Dated Requirements and steps to ensure your organization's readiness.

Thales report reveals bots now account for 51% of all web traffic, surpassing human activity

This week, our Year in Review spotlight is on ransomware—where low-profile tactics led to high-impact consequences. Download our 2 page ransomware summary, or watch our 55 second video.

Pentesting firm Cobalt has found that organizations fix less than half of exploited vulnerabilities, with just 21% of generative AI flaws addressed

North Korea’s Slow Pisces used LinkedIn lures in 2025 to drop RN Stealer malware on crypto developers.

A UK man has been sentenced to over eight years for masterminding £100m phishing platform LabHost

Hertz disclosed a data breach after customer data was stolen via Cleo zero-day exploits in 2024, affecting Hertz, Thrifty, and Dollar brands

Last Friday morning, April 11, I was making my way home from NTT Research’s Upgrade 2025 innovation conference in San Francisco, when it struck me that we’re at a watershed moment. I was reflecting on NTT’s newly launched Physics of Artificial Intelligence Lab when a GeekWire article crossed my LinkedIn feed, touting a seemingly parallel

Huntress reports active exploitation of Gladinet CVE-2025-30406 in the wild, affecting seven organizations and 120 endpoints.

ABB Cylon Aspect 3.08.02 - Cookie User Password Disclosure. CVE-2024-51546 . hardware exploit for Multiple platform

Cacti 1.2.26 - Remote Code Execution (RCE) (Authenticated). CVE-2024-25641 . webapps exploit for PHP platform

ABB Cylon Aspect 3.08.03 - Hard-coded Secrets.. webapps exploit for Multiple platform

ABB Cylon Aspect 3.08.03 (MapServicesHandler) - Authenticated Reflected XSS.. webapps exploit for Multiple platform

ABB Cylon Aspect 3.08.02 (licenseUpload.php) - Stored Cross-Site Scripting. CVE-2024-6516 . hardware exploit for Multiple platform

ABB Cylon Aspect 3.08.02 (uploadDb.php) - Remote Code Execution. CVE-2024-48839 . hardware exploit for Multiple platform

ABB Cylon Aspect 3.08.02 (licenseServerUpdate.php) - Stored Cross-Site Scripting. CVE-2024-6516 . hardware exploit for Multiple platform

Ivanti Connect Secure 22.7R2.5 - Remote Code Execution (RCE). CVE-2025-0282 . remote exploit for Multiple platform

ABB Cylon Aspect 3.08.02 (webServerUpdate.php) - Input Validation Config Poisoning.. hardware exploit for PHP platform

ABB Cylon Aspect 3.08.03 (CookieDB) - SQL Injection.. hardware exploit for Multiple platform

ABB Cylon Aspect 3.08.02 (escDevicesUpdate.php) - Denial of Service (DOS). CVE-2024-48844 . hardware exploit for PHP platform