A UK criminal records office suffered a significant data breach due to an unpatched content management system (CMS) and systematically ignored security alerts. The incident exposed sensitive criminal records data, highlighting catastrophic failures in basic security hygiene. The breach stemmed from
CISA has added multiple SonicWall SMA1000 vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation by ransomware operators. The flaws affect SonicWall Secure Mobile Access (SMA) 1000 series appliances, enabling attackers to gain unauthorized access, execute
A dataset containing 9.2 million Israeli citizen records has surfaced on dark web marketplaces, marketed as a recent breach of Israel’s population registry. Investigation reveals this data originates from a 2005 compromise at Israel’s Population and Immigration Authority, making it nearly two decade
Progress Kemp LoadMaster application delivery controllers contain a critical vulnerability (CVE-2024-1212) now being actively exploited by threat actors. The flaw allows unauthenticated remote code execution with a CVSS score of 10.0, affecting multiple LoadMaster versions. Organizations running vul
Critical vulnerabilities in the Connective eID browser extension expose over 2 million Belgian citizens to remote code execution (RCE) and PIN theft attacks. The flaws affect the extension used for national electronic identification, allowing malicious websites to trigger arbitrary code execution an
Threat actors have deployed malicious Visual Studio Code extensions disguised as legitimate Solidity development tools to steal cryptocurrency wallets, API keys, and developer credentials. The “Solidity Pro” extension and related variants were available on the official VS Code Marketplace, targeting
A sophisticated supply chain attack targeting BdThemes WordPress products has compromised thousands of websites through a poisoned API response mechanism. Attackers injected malicious code into the legitimate update distribution system, deploying backdoors disguised as theme templates. The breach af
A critical zero-day vulnerability in Metabase, a popular open-source business intelligence platform, is being actively exploited in the wild to gain unauthorized administrative access. Attackers are leveraging this flaw to bypass authentication mechanisms and execute arbitrary commands on vulnerable
Security researchers have uncovered a novel attack technique called “CSS Bomb” that weaponizes Cascading Style Sheets (CSS) to transform malicious emails into real-time keyloggers. When victims open these specially crafted emails in web-based email clients, the embedded CSS code captures every keyst
Ransomware operators are shifting their social engineering tactics, deliberately bypassing C-suite executives to target mid-level IT managers and system administrators. These attacks exploit the technical access privileges of IT staff while capitalizing on their often-lower security awareness compar