The Breach News

CISA Adds Four High-Risk Vulnerabilities to KEV Catalog Amid Ongoing Exploitation

July 8, 2025
Cyber Attacks / Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently included four critical vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The identified vulnerabilities are as follows:

  • CVE-2014-3931 (CVSS score: 9.8): A buffer overflow flaw in Multi-Router Looking Glass (MRLG) allowing remote attackers to perform arbitrary memory writes and cause memory corruption.
  • CVE-2016-10033 (CVSS score: 9.8): A command injection vulnerability in PHPMailer enabling attackers to execute arbitrary code within the application or trigger a denial-of-service (DoS) condition.
  • CVE-2019-5418 (CVSS score: 7.5): A path traversal vulnerability in Ruby on Rails’ Action View that may expose the contents of arbitrary files on the target system’s filesystem.
  • CVE-2019-9621 (CVSS score: 7.5): A Server-Side Request Forgery (SSRF) vulnerability in the Zimbra Collaboration Suite that could…

CISA Expands KEV Catalog with Four Newly Identified Vulnerabilities Amid Active Exploitation On July 8, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced the addition of four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. This update comes in response to new evidence indicating that these vulnerabilities…

Read More

CISA Adds Four High-Risk Vulnerabilities to KEV Catalog Amid Ongoing Exploitation

July 8, 2025
Cyber Attacks / Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently included four critical vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The identified vulnerabilities are as follows:

  • CVE-2014-3931 (CVSS score: 9.8): A buffer overflow flaw in Multi-Router Looking Glass (MRLG) allowing remote attackers to perform arbitrary memory writes and cause memory corruption.
  • CVE-2016-10033 (CVSS score: 9.8): A command injection vulnerability in PHPMailer enabling attackers to execute arbitrary code within the application or trigger a denial-of-service (DoS) condition.
  • CVE-2019-5418 (CVSS score: 7.5): A path traversal vulnerability in Ruby on Rails’ Action View that may expose the contents of arbitrary files on the target system’s filesystem.
  • CVE-2019-9621 (CVSS score: 7.5): A Server-Side Request Forgery (SSRF) vulnerability in the Zimbra Collaboration Suite that could…

North Korean Group Partners with Play Ransomware in Major Cyber Attack

Oct 30, 2024
Ransomware / Threat Intelligence

Threat actors associated with North Korea have been linked to a recent cyber incident involving the notorious Play ransomware, highlighting their financial motives. This activity, which took place between May and September 2024, is connected to a group known as Jumpy Pisces, also referred to as Andariel, APT45, DarkSeoul, Nickel Hyatt, Onyx Sleet (previously Plutonium), Operation Troy, Silent Chollima, and Stonefly. According to a new report from Palo Alto Networks’ Unit 42, “We have moderate confidence that Jumpy Pisces, or a segment of this group, is now collaborating with the Play ransomware collective.” This incident is particularly significant as it represents the first documented partnership between the Jumpy Pisces North Korean state-sponsored group and an underground ransomware operation. Active since at least 2009, Andariel is associated with North Korea’s Reconnaissance General Bureau (RGB) and has a history of deploying various cyber tactics.

Significant Cyber Attack Involves North Korean Collaboration with Play Ransomware Group October 30, 2024 In a notable development in the realm of cybersecurity, threat actors associated with North Korea have been identified as key players in a recent attack utilizing the Play ransomware variant. This collaboration highlights the increasing intersection…

Read More

North Korean Group Partners with Play Ransomware in Major Cyber Attack

Oct 30, 2024
Ransomware / Threat Intelligence

Threat actors associated with North Korea have been linked to a recent cyber incident involving the notorious Play ransomware, highlighting their financial motives. This activity, which took place between May and September 2024, is connected to a group known as Jumpy Pisces, also referred to as Andariel, APT45, DarkSeoul, Nickel Hyatt, Onyx Sleet (previously Plutonium), Operation Troy, Silent Chollima, and Stonefly. According to a new report from Palo Alto Networks’ Unit 42, “We have moderate confidence that Jumpy Pisces, or a segment of this group, is now collaborating with the Play ransomware collective.” This incident is particularly significant as it represents the first documented partnership between the Jumpy Pisces North Korean state-sponsored group and an underground ransomware operation. Active since at least 2009, Andariel is associated with North Korea’s Reconnaissance General Bureau (RGB) and has a history of deploying various cyber tactics.

Critical WinRAR 0-Day Vulnerability Exploited for Weeks by Two Groups

In recent reports, cybersecurity firm BI.ZONE disclosed that the threat actor known as Paper Werewolf has launched a series of attacks leveraging exploits delivered via email attachments. These emails masqueraded as communications from employees at the All-Russian Research Institute, with the malicious aim of installing malware to gain unauthorized access…

Read MoreCritical WinRAR 0-Day Vulnerability Exploited for Weeks by Two Groups

Dutch Investigators Attribute Hacks to Multiple Threat Actors

Critical Infrastructure Security, Cybercrime, Fraud Management & Cybercrime NCSC-NL Reports Citrix NetScaler Vulnerability Targeted Critical Infrastructure Akshaya Asokan (asokan_akshaya) • August 11, 2025 Dutch authorities indicate a suspected Russian hacking campaign utilized multiple groups to exploit a flaw in Citrix NetScaler, targeting the nation’s law enforcement network. (Image: Shutterstock) The…

Read MoreDutch Investigators Attribute Hacks to Multiple Threat Actors

⚡ Weekly Highlights: Chrome Zero-Day, Ivanti Vulnerabilities, macOS Malware, Crypto Capers, and More

Jul 07, 2025
Cybersecurity / Hacking

In the realm of cybersecurity, everything may seem secure—until an overlooked detail lets danger in. Even robust systems can fail due to a simple oversight or a trusted tool’s misuse. Most threats don’t announce their presence; they creep in through overlooked vulnerabilities. A minor bug, a recycled password, a silent connection—these small oversights can lead to substantial risks.

Staying secure isn’t just about quick responses; it’s about identifying early indicators before they escalate into major issues. This week’s updates underscore their importance. From subtle strategies to unexpected intrusion points, the highlights below reveal how swiftly threats can proliferate—and what proactive teams are doing to stay ahead. Let’s get started.

⚡ Threat of the Week

U.S. Disrupts North Korean IT Worker Scheme
— Authorities have revealed that North Korean IT personnel infiltrated over 100 U.S. firms using fake or stolen identities. They not only collected salaries but also siphoned sensitive information and misappropriated virtual currency, with one incident involving over $900,000 targeting an unnamed blockchain company.

Weekly Cybersecurity Recap: Chrome 0-Day Exploit, Ivanti Vulnerabilities, MacOS Data Theft, and Cryptocurrency Heists Date: July 7, 2025 In the realm of cybersecurity, a false sense of security can be perilous. Even the most robust systems are vulnerable if a small detail is overlooked or a typically secure tool is…

Read More

⚡ Weekly Highlights: Chrome Zero-Day, Ivanti Vulnerabilities, macOS Malware, Crypto Capers, and More

Jul 07, 2025
Cybersecurity / Hacking

In the realm of cybersecurity, everything may seem secure—until an overlooked detail lets danger in. Even robust systems can fail due to a simple oversight or a trusted tool’s misuse. Most threats don’t announce their presence; they creep in through overlooked vulnerabilities. A minor bug, a recycled password, a silent connection—these small oversights can lead to substantial risks.

Staying secure isn’t just about quick responses; it’s about identifying early indicators before they escalate into major issues. This week’s updates underscore their importance. From subtle strategies to unexpected intrusion points, the highlights below reveal how swiftly threats can proliferate—and what proactive teams are doing to stay ahead. Let’s get started.

⚡ Threat of the Week

U.S. Disrupts North Korean IT Worker Scheme
— Authorities have revealed that North Korean IT personnel infiltrated over 100 U.S. firms using fake or stolen identities. They not only collected salaries but also siphoned sensitive information and misappropriated virtual currency, with one incident involving over $900,000 targeting an unnamed blockchain company.

Investigation Launched by Levi & Korsinsky, LLP into Sanderling Healthcare Data Breach – ACCESS Newswire

Sanderling Healthcare Data Breach Under Investigation by Levi & Korsinsky, LLP In a significant development in the realm of cybersecurity, Sanderling Healthcare has become the subject of an investigation by legal firm Levi & Korsinsky, LLP, following a substantial data breach. This incident underscores the growing vulnerability of healthcare organizations…

Read MoreInvestigation Launched by Levi & Korsinsky, LLP into Sanderling Healthcare Data Breach – ACCESS Newswire

Microsoft Addresses 130 Vulnerabilities, Including Critical Issues in SPNEGO and SQL Server

July 9, 2025
Endpoint Security / Vulnerability

In its first Patch Tuesday update of 2025, Microsoft has rolled out fixes for 130 vulnerabilities, marking a shift as no exploited security flaws were included in this batch. Notably, one flaw addressed had already been publicly disclosed. The update also tackles 10 additional non-Microsoft CVEs impacting Visual Studio, AMD, and the Chromium-based Edge browser. Among the patched vulnerabilities, 10 are classified as Critical, while the remainder are deemed Important. “This marks the end of an 11-month streak of fixing at least one zero-day exploitation,” noted Satnam Narang, Senior Staff Research Engineer at Tenable. The vulnerabilities include 53 related to privilege escalation, 42 for remote code execution, 17 for information disclosure, and 8 for security feature bypasses. Furthermore, the update builds on two other flaws previously fixed in the Edge browser since the last month’s Patch Tuesday.

Microsoft Addresses 130 Vulnerabilities, Highlighting Critical Flaws in SPNEGO and SQL Server On July 9, 2025, Microsoft released its Patch Tuesday updates, addressing a total of 130 vulnerabilities, including critical security flaws within the SPNEGO protocol and SQL Server. Notably, this month’s updates marked the first time in 2025 that…

Read More

Microsoft Addresses 130 Vulnerabilities, Including Critical Issues in SPNEGO and SQL Server

July 9, 2025
Endpoint Security / Vulnerability

In its first Patch Tuesday update of 2025, Microsoft has rolled out fixes for 130 vulnerabilities, marking a shift as no exploited security flaws were included in this batch. Notably, one flaw addressed had already been publicly disclosed. The update also tackles 10 additional non-Microsoft CVEs impacting Visual Studio, AMD, and the Chromium-based Edge browser. Among the patched vulnerabilities, 10 are classified as Critical, while the remainder are deemed Important. “This marks the end of an 11-month streak of fixing at least one zero-day exploitation,” noted Satnam Narang, Senior Staff Research Engineer at Tenable. The vulnerabilities include 53 related to privilege escalation, 42 for remote code execution, 17 for information disclosure, and 8 for security feature bypasses. Furthermore, the update builds on two other flaws previously fixed in the Edge browser since the last month’s Patch Tuesday.

Google Alerts Users to Actively Exploited CVE-2024-43093 Vulnerability in Android

November 5, 2024 – Mobile Security / Vulnerability

Google has issued a warning regarding a security vulnerability in its Android operating system that is currently being actively exploited. Identified as CVE-2024-43093, this privilege escalation flaw affects the Android Framework component and may allow unauthorized access to the “Android/data,” “Android/obb,” and “Android/sandbox” directories, along with their subdirectories. While details on the exploitation methods remain limited, Google noted in its monthly report that there are signs of “limited, targeted exploitation.” Additionally, the company highlighted CVE-2024-43047, a previously patched security issue in Qualcomm chipsets, which is also being actively exploited. This particular vulnerability involves a use-after-free flaw in the Digital Signal Processor (DSP) Service, where successful exploitation could lead to memory corruption.

Google Alerts Users to Actively Exploited CVE-2024-43093 Vulnerability in Android On November 5, 2024, Google issued a critical warning regarding a security vulnerability in the Android operating system, designated as CVE-2024-43093. This vulnerability involves privilege escalation within the Android Framework component, potentially allowing unauthorized access to sensitive directories, including “Android/data,”…

Read More

Google Alerts Users to Actively Exploited CVE-2024-43093 Vulnerability in Android

November 5, 2024 – Mobile Security / Vulnerability

Google has issued a warning regarding a security vulnerability in its Android operating system that is currently being actively exploited. Identified as CVE-2024-43093, this privilege escalation flaw affects the Android Framework component and may allow unauthorized access to the “Android/data,” “Android/obb,” and “Android/sandbox” directories, along with their subdirectories. While details on the exploitation methods remain limited, Google noted in its monthly report that there are signs of “limited, targeted exploitation.” Additionally, the company highlighted CVE-2024-43047, a previously patched security issue in Qualcomm chipsets, which is also being actively exploited. This particular vulnerability involves a use-after-free flaw in the Digital Signal Processor (DSP) Service, where successful exploitation could lead to memory corruption.