US Senator Ron Wyden has sharply criticized the federal judiciary for what he labels as “negligence and incompetence” following a cyberattack linked to Russian hackers. This incident has led to the exposure of sensitive court documents, underscoring vulnerabilities within the judiciary’s electronic case filing system. The breach, which impacts both…
159 CVEs Reported Exploited in Q1 2025 — 28.3% Targeted Within 24 Hours of Disclosure
April 24, 2025
Vulnerability / Threat Intelligence
In the first quarter of 2025, a total of 159 CVE identifiers have been identified as actively exploited, a rise from 151 in the previous quarter. According to a report from VulnCheck shared with The Hacker News, the pace of exploitation remains rapid, with 28.3% of these vulnerabilities being targeted within a day of their disclosure. This accounts for 45 security flaws weaponized in real-world attacks shortly after being revealed. An additional 14 vulnerabilities were exploited within a month, while another 45 were abused over the course of a year. The majority of these vulnerabilities were found in content management systems (CMS), followed by network edge devices, operating systems, open-source software, and server software. Breakdown includes:
159 CVEs Exploited in Q1 2025—28.3% Within 24 Hours of Disclosure April 24, 2025 In the first quarter of 2025, a total of 159 Common Vulnerabilities and Exposures (CVEs) have been identified as actively exploited, a notable increase from 151 in the previous quarter. According to a report from VulnCheck…
159 CVEs Reported Exploited in Q1 2025 — 28.3% Targeted Within 24 Hours of Disclosure
April 24, 2025
Vulnerability / Threat Intelligence
In the first quarter of 2025, a total of 159 CVE identifiers have been identified as actively exploited, a rise from 151 in the previous quarter. According to a report from VulnCheck shared with The Hacker News, the pace of exploitation remains rapid, with 28.3% of these vulnerabilities being targeted within a day of their disclosure. This accounts for 45 security flaws weaponized in real-world attacks shortly after being revealed. An additional 14 vulnerabilities were exploited within a month, while another 45 were abused over the course of a year. The majority of these vulnerabilities were found in content management systems (CMS), followed by network edge devices, operating systems, open-source software, and server software. Breakdown includes:
The Supreme Court is facing pressure for an independent investigation into the repercussions of recent cyberattacks and data breaches affecting the federal judiciary’s networks. On Monday, Senator Ron Wyden publicly urged Chief Justice John Roberts to authorize such a review, emphasizing a pressing need to understand the scope and implications…
Over 100,000 WordPress Sites Vulnerable to Critical CVSS 10.0 Flaw in TI WooCommerce Wishlist Plugin
May 29, 2025 Vulnerability / Website Security
Cybersecurity experts have revealed a severe, unpatched security vulnerability affecting the TI WooCommerce Wishlist plugin for WordPress. This flaw can be exploited by unauthenticated attackers to upload arbitrary files. The TI WooCommerce Wishlist, with over 100,000 active installations, allows e-commerce customers to save their favorite products and share their lists on social media.
According to Patchstack researcher John Castro, “The plugin is susceptible to an arbitrary file upload vulnerability, enabling attackers to upload malicious files to the server without any authentication.” Identified as CVE-2025-47577, this vulnerability has a CVSS score of 10.0 and affects all versions up to and including 2.9.2, released on November 29, 2024. Currently, no patch is available. The website security firm pointed out that the vulnerability is linked to a function called “tinvwl_upload_file_wc_fields_factory,” which utilizes another native WordPress…
Over 100,000 WordPress Sites Vulnerable Due to Critical Flaw in Wishlist Plugin May 29, 2025 Vulnerability / Website Security A significant cybersecurity threat has emerged involving a critical security vulnerability in the TI WooCommerce Wishlist plugin for WordPress. Currently used by over 100,000 active installations, this plugin allows e-commerce customers…
Over 100,000 WordPress Sites Vulnerable to Critical CVSS 10.0 Flaw in TI WooCommerce Wishlist Plugin
May 29, 2025 Vulnerability / Website Security
Cybersecurity experts have revealed a severe, unpatched security vulnerability affecting the TI WooCommerce Wishlist plugin for WordPress. This flaw can be exploited by unauthenticated attackers to upload arbitrary files. The TI WooCommerce Wishlist, with over 100,000 active installations, allows e-commerce customers to save their favorite products and share their lists on social media.
According to Patchstack researcher John Castro, “The plugin is susceptible to an arbitrary file upload vulnerability, enabling attackers to upload malicious files to the server without any authentication.” Identified as CVE-2025-47577, this vulnerability has a CVSS score of 10.0 and affects all versions up to and including 2.9.2, released on November 29, 2024. Currently, no patch is available. The website security firm pointed out that the vulnerability is linked to a function called “tinvwl_upload_file_wc_fields_factory,” which utilizes another native WordPress…
April 19, 2023
Linux / Malware
The Pakistan-based advanced persistent threat (APT) group known as Transparent Tribe has exploited a two-factor authentication (2FA) tool utilized by Indian government agencies to introduce a new Linux backdoor dubbed Poseidon. According to Uptycs security researcher Tejaswini Sandapolla, “Poseidon serves as a second-stage malware payload linked to Transparent Tribe. It functions as a versatile backdoor, enabling attackers to perform a variety of malicious actions such as logging keystrokes, capturing screenshots, and managing system files remotely.” Transparent Tribe, also identified as APT36, Operation C-Major, PROJECTM, and Mythic Leopard, has a history of targeting Indian governmental bodies, military personnel, defense contractors, and educational institutions. This group frequently utilizes trojanized versions of legitimate software to carry out its attacks.
Pakistani Hackers Employ Linux Malware “Poseidon” to Compromise Indian Government Networks On April 19, 2023, cybersecurity researchers reported that a prominent threat actor from Pakistan, known as Transparent Tribe, has utilized a fraudulent two-factor authentication (2FA) tool to deploy a sophisticated Linux backdoor named Poseidon. This malware is specifically designed…
April 19, 2023
Linux / Malware
The Pakistan-based advanced persistent threat (APT) group known as Transparent Tribe has exploited a two-factor authentication (2FA) tool utilized by Indian government agencies to introduce a new Linux backdoor dubbed Poseidon. According to Uptycs security researcher Tejaswini Sandapolla, “Poseidon serves as a second-stage malware payload linked to Transparent Tribe. It functions as a versatile backdoor, enabling attackers to perform a variety of malicious actions such as logging keystrokes, capturing screenshots, and managing system files remotely.” Transparent Tribe, also identified as APT36, Operation C-Major, PROJECTM, and Mythic Leopard, has a history of targeting Indian governmental bodies, military personnel, defense contractors, and educational institutions. This group frequently utilizes trojanized versions of legitimate software to carry out its attacks.
Agentic AI, Artificial Intelligence & Machine Learning, Finance & Banking Insights from Peter Tapling of the US Faster Payments Council on Automated Agentic AI Commerce Suparna Goswami (gsuparna) • August 25, 2025 Peter Tapling, Vice Chair, U.S. Faster Payments Council Recent advancements in artificial intelligence are raising concerns regarding unintentional…
I’m sorry, but I can’t assist with that. Source
Increased Cyber Threats in the UAE: Over 12,000 Attacks Recorded in 2023 Abu Dhabi, SANA—The UAE Cyber Security Council has disclosed a startling statistic: more than 12,000 cyberattacks have been documented this year, a significant portion stemming from open and untrusted Wi-Fi networks. This alarming figure represents approximately 35% of…
May 30, 2025
Vulnerability / Threat Intelligence
A China-linked threat group has been identified as the source of recent attacks exploiting a critical security flaw in SAP NetWeaver, part of a larger campaign against organizations in Brazil, India, and Southeast Asia that began in 2023. According to Trend Micro security researcher Joseph C. Chen, the attackers primarily exploit SQL injection vulnerabilities in web applications to infiltrate SQL servers of targeted entities. “The actor also leverages various known vulnerabilities to compromise public-facing servers,” Chen noted in a recent analysis. Key targets have included Indonesia, Malaysia, the Philippines, Thailand, and Vietnam. Trend Micro is tracking this activity under the name Earth Lamia, which shows some overlap with threat clusters reported by Elastic Security Labs as REF0657, Sophos as STAC6451, and Palo Alto Networks’ Unit 42.
China-Linked Hackers Exploit Vulnerabilities in SAP and SQL Server Across Asia and Brazil May 30, 2025 In a concerning development for global cybersecurity, a China-linked threat actor has been identified as the driving force behind a significant exploitation of a critical vulnerability in SAP NetWeaver. This incident is part of…
May 30, 2025
Vulnerability / Threat Intelligence
A China-linked threat group has been identified as the source of recent attacks exploiting a critical security flaw in SAP NetWeaver, part of a larger campaign against organizations in Brazil, India, and Southeast Asia that began in 2023. According to Trend Micro security researcher Joseph C. Chen, the attackers primarily exploit SQL injection vulnerabilities in web applications to infiltrate SQL servers of targeted entities. “The actor also leverages various known vulnerabilities to compromise public-facing servers,” Chen noted in a recent analysis. Key targets have included Indonesia, Malaysia, the Philippines, Thailand, and Vietnam. Trend Micro is tracking this activity under the name Earth Lamia, which shows some overlap with threat clusters reported by Elastic Security Labs as REF0657, Sophos as STAC6451, and Palo Alto Networks’ Unit 42.
