The Breach News

CISA Includes Erlang SSH and Roundcube Vulnerabilities in Known Exploited Threats Catalog

On June 10, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two significant security vulnerabilities affecting Erlang/Open Telecom Platform (OTP) SSH and Roundcube to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. The identified vulnerabilities are:

  • CVE-2025-32433 (CVSS score: 10.0): A critical missing authentication flaw in the Erlang/OTP SSH server that could enable an attacker to execute arbitrary commands without proper credentials, potentially leading to unauthenticated remote code execution. (Patched in April 2025 in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20)

  • CVE-2024-42009 (CVSS score: 9.3): A cross-site scripting (XSS) vulnerability in RoundCube Webmail that may allow a remote attacker to compromise a victim’s email account by exploiting a desanitization flaw in program/actions/mail/show.php. (Fixed in August 2024 in versions 1.6…)

CISA Updates KEV Catalog with Critical Vulnerabilities in Erlang SSH and Roundcube On June 10, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced the addition of two significant vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, both of which are currently being actively exploited. These vulnerabilities pertain to…

Read More

CISA Includes Erlang SSH and Roundcube Vulnerabilities in Known Exploited Threats Catalog

On June 10, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two significant security vulnerabilities affecting Erlang/Open Telecom Platform (OTP) SSH and Roundcube to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. The identified vulnerabilities are:

  • CVE-2025-32433 (CVSS score: 10.0): A critical missing authentication flaw in the Erlang/OTP SSH server that could enable an attacker to execute arbitrary commands without proper credentials, potentially leading to unauthenticated remote code execution. (Patched in April 2025 in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20)

  • CVE-2024-42009 (CVSS score: 9.3): A cross-site scripting (XSS) vulnerability in RoundCube Webmail that may allow a remote attacker to compromise a victim’s email account by exploiting a desanitization flaw in program/actions/mail/show.php. (Fixed in August 2024 in versions 1.6…)

Rising China-Taiwan Tensions Ignite Sharp Increase in Cyber Attacks

May 18, 2023
Cyber Warfare / Threat Intelligence

Recent geopolitical strains between China and Taiwan have led to a significant rise in cyber attacks targeting the island nation. According to a report from the Trellix Advanced Research Center, “The conflict stemming from China’s claim over Taiwan, combined with Taiwan’s push for independence, has resulted in a troubling escalation of cyber threats.” These attacks, aimed at various sectors, primarily focus on deploying malware and stealing sensitive data. The cybersecurity firm noted a staggering four-fold increase in malicious emails between April 7 and April 10, 2023, with sectors such as networking, manufacturing, and logistics being particularly affected. Following this surge, the region saw a 15x spike in PlugX detections between April 10 and April 12, 2023.

Rising China-Taiwan Tensions Ignite Surge in Cyber Attacks May 18, 2023 Recent months have witnessed a significant escalation in tensions between China and Taiwan, resulting in a marked increase in cyber attacks aimed at the East Asian island nation. According to a new report from the Trellix Advanced Research Center,…

Read More

Rising China-Taiwan Tensions Ignite Sharp Increase in Cyber Attacks

May 18, 2023
Cyber Warfare / Threat Intelligence

Recent geopolitical strains between China and Taiwan have led to a significant rise in cyber attacks targeting the island nation. According to a report from the Trellix Advanced Research Center, “The conflict stemming from China’s claim over Taiwan, combined with Taiwan’s push for independence, has resulted in a troubling escalation of cyber threats.” These attacks, aimed at various sectors, primarily focus on deploying malware and stealing sensitive data. The cybersecurity firm noted a staggering four-fold increase in malicious emails between April 7 and April 10, 2023, with sectors such as networking, manufacturing, and logistics being particularly affected. Following this surge, the region saw a 15x spike in PlugX detections between April 10 and April 12, 2023.

CISA Requests Feedback on SBOM Updates to Address Real-World Gaps

Software Bill of Materials (SBOM), Standards, Regulations & Compliance US Cyber Defense Agency Advocates for Automation and Machine-Readable SBOMs Chris Riotta (@chrisriotta) • August 22, 2025 Image: CISA The Cybersecurity and Infrastructure Security Agency (CISA) is intensifying efforts to develop Software Bills of Materials (SBOMs) as part of its new…

Read MoreCISA Requests Feedback on SBOM Updates to Address Real-World Gaps

U.S. Charges Yemeni Hacker in Black Kingdom Ransomware Attack Affecting 1,500 Systems

May 03, 2025
Cybercrime / Malware

The U.S. Department of Justice (DoJ) announced charges against Rami Khaled Ahmed, a 36-year-old Yemeni national, for allegedly deploying the Black Kingdom ransomware against numerous global targets, including businesses, schools, and hospitals in the United States. Ahmed, currently believed to be residing in Sana’a, Yemen, faces charges of conspiracy, intentional damage to a protected computer, and threatening damage to a protected computer.

According to the DoJ, from March 2021 to June 2023, Ahmed and accomplices compromised the computer networks of several U.S.-based victims, including a medical billing service in Encino, a ski resort in Oregon, a school district in Pennsylvania, and a health clinic in Wisconsin. Ahmed is accused of creating and launching the ransomware by exploiting a known vulnerability in Microsoft Exchange Server referred to as ProxyLogon. The ransomware operation involved encrypting data from targeted systems…

U.S. Charges Yemeni Hacker Linked to Black Kingdom Ransomware Affecting 1,500 Systems On May 3, 2025, the U.S. Department of Justice (DoJ) revealed charges against Rami Khaled Ahmed, a 36-year-old national from Yemen, for allegedly deploying the notorious Black Kingdom ransomware. This malicious software targeted a wide array of entities…

Read More

U.S. Charges Yemeni Hacker in Black Kingdom Ransomware Attack Affecting 1,500 Systems

May 03, 2025
Cybercrime / Malware

The U.S. Department of Justice (DoJ) announced charges against Rami Khaled Ahmed, a 36-year-old Yemeni national, for allegedly deploying the Black Kingdom ransomware against numerous global targets, including businesses, schools, and hospitals in the United States. Ahmed, currently believed to be residing in Sana’a, Yemen, faces charges of conspiracy, intentional damage to a protected computer, and threatening damage to a protected computer.

According to the DoJ, from March 2021 to June 2023, Ahmed and accomplices compromised the computer networks of several U.S.-based victims, including a medical billing service in Encino, a ski resort in Oregon, a school district in Pennsylvania, and a health clinic in Wisconsin. Ahmed is accused of creating and launching the ransomware by exploiting a known vulnerability in Microsoft Exchange Server referred to as ProxyLogon. The ransomware operation involved encrypting data from targeted systems…

Edelson Lechtzin LLP Investigates Potential Data Breach Affecting Customers of The Aspire Rural Health System

LANSING, Mich., Aug. 22, 2025 /PRNewswire/ — The Philadelphia-based law firm Edelson Lechtzin LLP has initiated an investigation into data privacy violations stemming from a significant data breach at Aspire Rural Health System (“Aspire”). This breach, which reportedly began on or around February 13, 2025, has raised alarms regarding the…

Read MoreEdelson Lechtzin LLP Investigates Potential Data Breach Affecting Customers of The Aspire Rural Health System

Researcher Uncovers Vulnerability Exposing Phone Numbers Linked to Google Accounts

Jun 10, 2025
Vulnerability / API Security

Google has acted to resolve a security flaw that could allow malicious actors to brute-force recovery phone numbers associated with Google accounts, potentially compromising user privacy and security. Singaporean security researcher “brutecat” identified that the vulnerability exploited a weakness in the company’s account recovery feature. The issue involved a now-obsolete version of the Google username recovery form (“accounts.google[.]com/signin/usernamerecovery”) that lacked sufficient anti-abuse measures to limit excessive requests. This page allows users to check if a recovery email or phone number is linked to a specific display name (e.g., “John Smith”). By bypassing the CAPTCHA rate limits, attackers could rapidly test various permutations of a Google account’s phone number, leading to possible exploitation.

Security Flaw Discovered in Google Account Recovery Process Exposes User Privacy On June 10, 2025, a significant security vulnerability was identified in Google’s account recovery system, raising concerns about potential risks to user privacy and security. The flaw, discovered by Singaporean security researcher known as “brutecat,” allows for the brute-force…

Read More

Researcher Uncovers Vulnerability Exposing Phone Numbers Linked to Google Accounts

Jun 10, 2025
Vulnerability / API Security

Google has acted to resolve a security flaw that could allow malicious actors to brute-force recovery phone numbers associated with Google accounts, potentially compromising user privacy and security. Singaporean security researcher “brutecat” identified that the vulnerability exploited a weakness in the company’s account recovery feature. The issue involved a now-obsolete version of the Google username recovery form (“accounts.google[.]com/signin/usernamerecovery”) that lacked sufficient anti-abuse measures to limit excessive requests. This page allows users to check if a recovery email or phone number is linked to a specific display name (e.g., “John Smith”). By bypassing the CAPTCHA rate limits, attackers could rapidly test various permutations of a Google account’s phone number, leading to possible exploitation.

Beware the ZIP File: Phishers Exploit .ZIP Domains to Deceive Victims

May 29, 2023
Cyber Threat / Online Security

A new phishing technique dubbed “file archiver in the browser” is being used to imitate file archiver software, such as WinRAR, within web browsers when victims visit a .ZIP domain. Security researcher mr.d0x revealed that this phishing attack involves creating a realistic landing page using HTML and CSS to mimic genuine file archive software, hosted on a .ZIP domain to enhance its legitimacy.

In a typical attack, cybercriminals can redirect users to a credential theft page when they click on a file that appears to be included within the fake ZIP archive. Another alarming tactic involves listing a harmless non-executable file, only for the actual download to be an executable file instead, as noted by mr.d0x…

Beware of ZIP Files: New Phishing Technique Exploited via .ZIP Domains In recent developments, a concerning phishing tactic has emerged, leveraging a method referred to as “file archiver in the browser.” This approach mimics the functionality of legitimate file archiving software within a web browser, specifically when users navigate to…

Read More

Beware the ZIP File: Phishers Exploit .ZIP Domains to Deceive Victims

May 29, 2023
Cyber Threat / Online Security

A new phishing technique dubbed “file archiver in the browser” is being used to imitate file archiver software, such as WinRAR, within web browsers when victims visit a .ZIP domain. Security researcher mr.d0x revealed that this phishing attack involves creating a realistic landing page using HTML and CSS to mimic genuine file archive software, hosted on a .ZIP domain to enhance its legitimacy.

In a typical attack, cybercriminals can redirect users to a credential theft page when they click on a file that appears to be included within the fake ZIP archive. Another alarming tactic involves listing a harmless non-executable file, only for the actual download to be an executable file instead, as noted by mr.d0x…

Netskope’s IPO Filing Shows Soaring Sales and Reduced Losses

AI-Powered SASE, Governance & Risk Management, Security Service Edge (SSE) Netskope Files for Second Cybersecurity IPO of 2025, Emphasizing Channel Partnership Dependency Michael Novinson (MichaelNovinson) • August 22, 2025 Sanjay Beri, Netskope co-founder and CEO (Image: Netskope) Netskope has marked its position as the second cybersecurity entity to initiate an…

Read MoreNetskope’s IPO Filing Shows Soaring Sales and Reduced Losses

The Role of Third Parties and Machine Credentials in 2025’s Major Data Breaches

May 06, 2025
AI Security / Enterprise IT

In the 2025 Verizon Data Breach Investigations Report (DBIR), it wasn’t just ransomware or zero-day exploits that caught attention; rather, it was the underlying factors that enabled these incidents. Two significant contributors to this year’s most severe breaches emerged: third-party vulnerabilities and machine credential misuse. The report revealed that third-party involvement in breaches surged from 15% to 30% year-over-year. Simultaneously, cybercriminals increasingly leveraged machine credentials and unmanaged machine accounts to infiltrate systems, escalate privileges, and steal sensitive data. The takeaway is clear: protecting only employee accounts is no longer sufficient. To effectively combat modern threats, organizations must implement a comprehensive security strategy that encompasses all identities—human, non-employee, and machine.

The Escalating Threat of Third-Party Risks
Today’s enterprises operate within a complex network of partnerships, including contractors, vendors, and more.

Third Parties and Machine Credentials: Key Contributors to 2025’s Security Breaches May 06, 2025 AI Security / Enterprise IT The 2025 Verizon Data Breach Investigations Report (DBIR) revealed that the most pressing issues in this year’s data breaches weren’t the sensational headlines of ransomware attacks or zero-day vulnerabilities, but rather…

Read More

The Role of Third Parties and Machine Credentials in 2025’s Major Data Breaches

May 06, 2025
AI Security / Enterprise IT

In the 2025 Verizon Data Breach Investigations Report (DBIR), it wasn’t just ransomware or zero-day exploits that caught attention; rather, it was the underlying factors that enabled these incidents. Two significant contributors to this year’s most severe breaches emerged: third-party vulnerabilities and machine credential misuse. The report revealed that third-party involvement in breaches surged from 15% to 30% year-over-year. Simultaneously, cybercriminals increasingly leveraged machine credentials and unmanaged machine accounts to infiltrate systems, escalate privileges, and steal sensitive data. The takeaway is clear: protecting only employee accounts is no longer sufficient. To effectively combat modern threats, organizations must implement a comprehensive security strategy that encompasses all identities—human, non-employee, and machine.

The Escalating Threat of Third-Party Risks
Today’s enterprises operate within a complex network of partnerships, including contractors, vendors, and more.