Joe Pichlmayr

Trend Zero Day Initiative™ (ZDI) exposed the tactics of Russian cybercriminals targeting Ukrainian organizations. From spear-phishing to advanced homoglyph attacks, understand the full spectrum of these threats and how to fortify your business against them: https://spr.ly/6047Ir4aF

94

1 Kommentar

🔐🌍 UPDATE — CISA extends funding to prevent a shutdown of the CVE Program. A new CVE Foundation is also launched to ensure global, independent oversight—just as ENISA rolls out the EU Vulnerability Database. Read: https://lnkd.in/gMFDgr7i

590

15 Kommentare

Kudos to our Penetration Testing Team! 🎉   Once again, they have demonstrated their expertise and sharp skills by uncovering a Reflected Cross-Site Scripting (XSS) vulnerability in the phpIPAM product. This vulnerability has been officially registered with MITRE and assigned the identifier CVE-2024-55093 under the Common Vulnerabilities and Exposures (CVE®) Program. 🛡️ The issue stems from insufficient input validation and encoding, allowing attackers to inject malicious scripts into users’ browsers. If exploited, this could lead to session hijacking, exposure of sensitive data, and other security risks. For more details, check out the following resources: CVE: Common Vulnerabilities and Exposures 👉 https://lnkd.in/dbz_bva5 NVD - CVE-2024-55093 👉 https://lnkd.in/dbz_bva5 Bugfix: XSS - Reflected in install scripts · phpipam/phpipam@d0caaeb · GitHub 👉https://lnkd.in/dz7CYBh3

77

1 Kommentar

🧠 Looking to expand your DFIR toolkit? We’re sharing a hand-picked list of blogs and training resources recently highlighted by Dr. Ashar Neyaz—each one packed with practical tips, tools, and investigative insights for digital forensics professionals: 🔹 OneDrive evolution & schema updates https://lnkd.in/edcVqT-c 🔹 Portable forensics with Raspberry Pi https://lnkd.in/eHeAsuzN 🔹 Open-source intelligence tools https://lnkd.in/eGYRQb7P 🔹 Email and mobile forensics blog https://lnkd.in/eiu9uxHx 🔹 Incident response training https://lnkd.in/ekGNi9Ae 🔹 Belkasoft’s digital forensics training https://lnkd.in/ezVV3PSh 🔹 Memory forensics articles and research https://lnkd.in/emSnTK9s 🔹 Timeline analysis in memory forensics https://lnkd.in/epd3M-h3 Explore more on our blog: https://lnkd.in/eCbnniPT 💬 Got a favorite source or blog of your own? Share it in the comments—we’re always on the lookout for new resources to learn from. #DFIR #CyberSecurity #DigitalForensics

44

The CVE Program — as we know it — just almost expired. MITRE’s contract to run the Common Vulnerabilities and Exposures (CVE) Program was to end April 16, 2025. That’s the system we all rely on to coordinate software vulnerability disclosures. No #CVE means no standardized alerts, no shared language for tracking threats, and a whole lot of chaos for defenders. Over 2,800 CVEs are issued monthly. Without continuity, threat actors get a head start — and defenders are stuck making up names like “That-One-Unpatched-Thing-In-The-Corner.” #CVE #Cybersecurity #OTSecurity #MITRE #CISA #MaxAI #CyberIn60Seconds #Resilience #mikeechols Leslie EcholsChuck BrooksChloe BurkeLes McCollum II, MPS-CRMCalvin Nobles, Ph.D.Danyetta Fleming Magana, CISSP, F. ISRMLaszlo Gonc, CISSP, QTESean C. Robert CraneLester Lewis, MBA#CISAntonio "T" ScurlockRoy White, MBA, PMPHoward TsaiTamika McCree ElhilaliJeffrey M. Vinson, Sr CISSP, CCISO, CIPP, NSA IAM-IEMGuy WaltonGotham ArtistsMatthew DimmickTim CooganJohn B MooreDeborah PageAdam Mohamed#aws #informationsharing #mikeechols

37

3 Kommentare

🚨 On September 25, 2025, #Cisco published advisories for 3 vulnerabilities affecting multiple different Cisco products. CVE-2025-20333 & CVE-2025-20362 are known to be exploited in the wild, while the third vuln, CVE-2025-20363, is said to be at high risk thereof. Find mitigation guidance and more in the Rapid7 blog: http://r-7.co/4pLZs0Y

50

🚨 New RCE Discovered in Anthropic’s MCP Inspector 🚨 Oligo Security research reported a critical vulnerability in the MCP Inspector used by AI developers worldwide, leading to CVE-2025-49596 (CVSS 9.4) being issued. This flaw enables attackers to exploit the decades-old 0000-Day vulnerability in browsers to hijack developer machines via a single visit to a malicious website. Our latest blog dives deep into: 💻 How default MCP Inspector configurations exposed a new class of browser-based attacks 🔓 What makes localhost services surprisingly dangerous 🔒 How Anthropic’s prompt fix in version 0.14.1 mitigates the threat 📽️ Plus, a quick exploit demo video from the OliGOAT, Avi Lumelsky Check out the writeup and the demo here: https://lnkd.in/eCVTnycY

67

6 Kommentare

🕵️‍♀️ Legit on the surface. Malicious underneath. Cybercriminals are designing threats to look like normal activity. That’s why we joined forces with the MITRE Center for Threat-Informed Defense to develop Ambiguous Techniques—a new approach to identifying attacker behaviors that mimic legitimate actions. 💡 The result? Context-aware detection analytics that help defenders understand intent, improve SOC efficiency, and stay ahead of sophisticated adversaries. 🔗 Read how we’re advancing detection engineering: https://ftnt.net/60434abHU

110

2 Kommentare

New from Semperis: Service Account Protection Essential Today, we introduced a new edition of Directory Services Protector (DSP), purpose-built to tackle one of the biggest blind spots in identity security: Active Directory service accounts. Why it matters: “Service accounts are nearly ungovernable by nature,” said Ran Harel, AVP of Security Products. “They’re often overly privileged, forgotten, and remain static for years—perfect targets for attackers.” As Alex Weinert, our Chief Product Officer and former Microsoft VP of Identity Security, noted: “Service Account Protection Essential gives organizations unprecedented visibility into their service account security posture and reduces the attack surface across hybrid AD environments.” 📢 Learn how to bring non-human identity risk out of the shadows: https://lnkd.in/gFunPAQs

51

🔍 Threat Actor Tradecraft: KARAKURT’s Internal Tools Reveal Long-Term Access Strategy 🛑 KARAKURT is no longer active, but their techniques continue to appear in the wider Wizard Spider ecosystem. From their internal victim management system, we identified: 🔁 Backdoors added to enable repeated access and re-infection 🗂️ Use of stolen ntds.dit files to reconstruct victim Active Directory environments 💡 This highlights a critical fact: paying the ransom does not restore security. It often leaves systems exposed to future compromises by the same or affiliated groups. 📎 Full analysis available to CATALYST subscribers: https://lnkd.in/enPPPwDC #CyberSecurity #ThreatIntelligence #Ransomware #KARAKURT #ActiveDirectory #Persistence #PRODAFT #CATALYST

39

RFC REMINDER: eligible #PCISSC stakeholders are invited to review and provide feedback on the draft PCI Point-to-Point Encryption (P2PE) v3.2 Standard during a 30-day request for comments (RFC) period. Find out more: https://brnw.ch/21wQPzF

23

MITRE ATT&CK v18 lands today with a groundbreaking update to ATT&CK's threat detection taxonomy. This restructuring—announced during ATT&CKcon by MITRE ATT&CK defense lead Lex Crumpton—will help cybersecurity teams better connect the dots across adversary behaviors, enabling more effective and informed defenses. Read more on Inside Cybersecurity: http://spklr.io/6047BzpN3 #ATTACKcon #Cybersecurity #ThreatInformedDefense #MITREattack

325

6 Kommentare

🚨 Zero-day Zyxel Vulnerability Under Active Exploitation 🚨 GreyNoise is observing active exploitation of a critical command injection vulnerability in Zyxel CPE devices (CVE-2024-40891). The vulnerability, disclosed by VulnCheck and confirmed by GreyNoise, remains unpatched and undisclosed by the vendor, leaving over 1,500 devices exposed online (source: Censys). This telnet-based flaw allows unauthenticated attackers to execute arbitrary commands, enabling system compromise, data theft, and network infiltration. 🔎 GreyNoise’s real-time data and collaboration with VulnCheck ensure defenders can respond immediately by tracking exploitation activity, including attacker IPs. 📢 Action Steps: - Monitor Zyxel management interface traffic. - Restrict administrative access to trusted IPs. - Watch for Zyxel advisories and apply updates immediately if available. Stay ahead of the attackers. Track live exploitation here: https://lnkd.in/gKnBHfvT #Cybersecurity #ZeroDay #ThreatIntelligence #GreyNoise

34

1 Kommentar

📣 Join our "Cybersecurity risks: organizations, people and technologies" webinar: ⏰ 19 May 2025 11:00 - 12:00 UTC 🔗 https://bit.ly/4lbajPu Mitigating the risks of cyber threats and attacks should be an urgent and critical task of all organizations. Such threats are of common occurrence in the digital world we are so increasingly dependent on. The international community has developed many standards to meet the challenges of mitigating cyber risks. These include: ✅ The management standard ISO/IEC 27001, ✅ Information security control standards ISO/IEC 27002, ISO/IEC 27005, ISO/IEC 27011, ISO/IEC 27017 and ISO/IEC 27019, ✅ Technology and service standards such as ISO/IEC 27400 series, ISO/IEC 27033 series. These standards help organizations deal with known cybersecurity risks related to their business operations. This workshop will share the experiences of both global professionals and standards developers who possess years of knowledge of cyber risks and the application of international standards to mitigate against cyber risks. #IECAcademy #IECevents #IECEmerginTech #Cybersecurity #Innovation

25

1 Kommentar

Today we publish insights from our expert Antonia Böhm, Digital Forensic Investigator. With thousands of hours of hands-on incident response experience, Antonia highlights a critical red flag: when organizations view forensic investigations as optional rather than essential. She also shares why “restarting and rebooting” can be a bad idea during an incident. Curious to learn more about what not to do during a cyber incident? Read the full article via the link: https://lnkd.in/d-DHZjYS #CyberSecurity #IncidentResponse #DigitalForensics

39