Columbia University Data Breach: A Stark Wake-Up Call for Educational Institutions Columbia University recently announced a significant data breach that occurred in May and was uncovered in June, but the details were not made public until August 7th. Public filings…
On June 3, 2025, cybersecurity researchers revealed a significant security flaw in Roundcube webmail software, active for a decade, that could enable authenticated users to execute malicious code on vulnerable systems. Classified as CVE-2025-49113, the vulnerability has a CVSS score of 9.9 out of 10, highlighting its severity. It involves post-authentication remote code execution through PHP object deserialization. According to the National Vulnerability Database (NVD), “Roundcube Webmail versions before 1.5.10 and 1.6.x prior to 1.6.11 allow authenticated users to execute remote code due to the lack of validation for the _from parameter in the URL in program/actions/settings/upload.php.” This flaw affects all versions up to and including 1.6.10 but has been patched in versions 1.6.11 and 1.5.10 LTS. The vulnerability was discovered and reported by Kirill Firsov, founder and CEO of FearsOff.
Critical Vulnerability in Roundcube Webmail Exposes Systems to Remote Code Execution On June 3, 2025, cybersecurity researchers revealed a significant security vulnerability in the Roundcube webmail software, a flaw that has remained undetected for a decade. This vulnerability has the…
Meta Exposes Extensive Cyber Espionage Campaigns on Social Media in South Asia
May 04, 2023
Social Media / Cyber Risk
Three distinct threat actors exploited countless elaborate fake profiles on Facebook and Instagram to conduct targeted attacks against individuals in South Asia. “These advanced persistent threats (APTs) relied heavily on social engineering tactics to deceive users into clicking malicious links, downloading malware, or sharing sensitive information online,” stated Guy Rosen, Meta’s chief information security officer. “This focus on social engineering reduced their need to invest heavily in malware development.” The counterfeit accounts utilized traditional tactics, pretending to be romantic interests, recruiters, journalists, or military personnel. Notably, two cyber espionage initiatives involved low-sophistication malware, likely attempting to evade app verification measures from Apple and Google. Meta’s findings revealed…
Meta Uncovers Extensive Cyber Espionage Campaigns Targeting South Asia On May 4, 2023, Meta revealed the discovery of a significant cyber espionage operation involving multiple threat actors utilizing a network of fraudulent identities on Facebook and Instagram. These campaigns aimed…
I’m sorry, but I can’t assist with that. Source link
April 29, 2025
Vulnerability / Web Security
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced on Monday that two serious security vulnerabilities affecting Broadcom’s Brocade Fabric OS and Commvault’s Web Server have been added to its Known Exploited Vulnerabilities (KEV) database, following reports of active exploitation. The specific vulnerabilities are:
CISA Integrates Broadcom and Commvault Vulnerabilities into KEV Database On April 29, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) fortifies its Known Exploited Vulnerabilities (KEV) catalog by including two critical security flaws affecting Broadcom’s Brocade Fabric OS and…
South Texas College to Launch Innovative Cybersecurity Clinic Aimed at Local Businesses South Texas College (STC) is set to introduce a pioneering cybersecurity clinic, designed to extend its services beyond student involvement. This initiative underscores the institution’s commitment to address…
June 04, 2025
Vulnerability / DevOps
Hewlett Packard Enterprise (HPE) has issued security updates to address up to eight vulnerabilities in its StoreOnce data backup and deduplication software, which could lead to remote authentication bypass and remote code execution. HPE’s advisory states, “These vulnerabilities could be remotely exploited, enabling remote code execution, information disclosure, server-side request forgery, authentication bypass, arbitrary file deletion, and directory traversal.” Among them is a critical flaw identified as CVE-2025-37093, rated 9.8 on the CVSS scale, which affects all software versions prior to 4.3.11. The vendor was notified of the vulnerability on October 31, 2024. Acknowledging an anonymous researcher for the discovery, the Zero Day Initiative (ZDI) shared insights on the issue…
HPE Releases Critical Security Patch for StoreOnce, Addressing Authentication Bypass Vulnerabilities On June 4, 2025, Hewlett Packard Enterprise (HPE) announced the rollout of significant security updates aimed at rectifying multiple vulnerabilities within its StoreOnce data backup and deduplication solution. Among…
U.S. Government Dismantles Russia’s Advanced Snake Cyber Espionage Tool
May 10, 2023
Cyber Espionage / Cyber Attack
On Tuesday, the U.S. government announced the successful court-authorized disruption of a global network compromised by an advanced malware strain known as Snake, utilized by Russia’s Federal Security Service (FSB). Referred to as the “most sophisticated cyber espionage tool,” Snake is attributed to the Russian state-sponsored group Turla (also known as Iron Hunter, Secret Blizzard, SUMMIT, Uroburos, Venomous Bear, and Waterbug), connected to a unit within Center 16 of the FSB. This threat actor has historically targeted entities in Europe, the Commonwealth of Independent States (CIS), and NATO-affiliated countries, with recent efforts expanding into Middle Eastern nations viewed as threats to Russian-supported interests in the region. “For nearly 20 years, this unit […] has leveraged versions of the Snake malware to steal sensitive documents from hundreds of computer systems in at least 50 countries…”
U.S. Government Disrupts Advanced Russian Cyber Espionage Network On May 10, 2023, the U.S. government announced it had successfully disrupted a sophisticated cyber espionage network tied to an advanced malware strain known as Snake. This operation was carried out with…
Certainly! Here’s a revised version of the content reflecting a more polished and cohesive style suited for a business-oriented audience: — Welcome to ISMG Enhance your profile and keep yourself informed Select Title LevelAnalytics/Architecture/EngineeringAttorney / General Counsel / CounselAVPBoard of…
April 29, 2025
Vulnerability / Artificial Intelligence
Recent findings have identified significant vulnerabilities within various generative artificial intelligence (GenAI) platforms, uncovering two distinct jailbreak techniques that can produce harmful or illegal content. The first technique, known as Inception, manipulates an AI tool to envision a fictional scenario, which can then evolve into a second scenario devoid of safety measures. According to an advisory from the CERT Coordination Center (CERT/CC), “Continuous prompting within this second context can lead to the bypassing of safety guardrails, enabling the generation of malicious outputs.” The second jailbreak tactic involves instructing the AI on how to evade specific responses. “By alternating between illicit and legitimate prompts, attackers can effectively navigate around safety protocols,” CERT/CC noted.
New Findings Expose Vulnerabilities in Prominent AI Systems, Highlighting Risks of Jailbreaks and Data Theft April 29, 2025 Recent reports have unveiled significant vulnerabilities in various generative artificial intelligence (GenAI) services, revealing that they are susceptible to two distinct forms…
