Security Bulletin

A threat group researchers call "Armored Likho" has gained access to government agencies and electrical power entities in Russia, Brazil, and Kazakhstan.

Attackers wasted little time targeting the latest memory disclosure flaw in Citrix's NetScaler products, after researchers published a proof-of-concept exploit (PoC).

Socket says the campaign remains active and more attacks are likely.

An "agentic threat actor" successfully exploited a Langflow flaw to steal data from a production database server and encrypt other systems.

Everything has sped up, but that's why effective defenses still rely on good people.

MeetingTV, a videoconferencing provider, has filed a lawsuit contesting a Koi Security blog post that accused its domain and Zoomcorder service of being fronts for a China-linked threat actor.

New research led by Muhammad Usama Sardar, a researcher at TU Dresden, indicates that the attested TLS protocol, designed to ensure clients are communicating with genuine, unmodified Trusted Execution Environments (TEEs), is susceptible to diversion...

The incident, detailed in a case study by Ransom-ISAC, involved Kairos gaining access to a U.S. government entity's network, reportedly through a brute-force credential attack.

The seven vulnerabilities in FatFs, a library embedded in firmware for devices like security cameras, drones, and industrial controllers, were found to be reachable through malformed USB drives, SD cards, or firmware update files.

An analysis found that over 8% of organizations had no email protection in place, and a mere 0.6% achieved full marks.