Author: Staff Writer

Essential Insights Managing Non-Human Identities (NHIs) effectively enhances security, compliance, and operational efficiency, even within budget constraints, by automating tasks like secrets rotation and centralized oversight. Implementing holistic NHI management—beyond point solutions—fosters collaboration between security and R&D teams, utilizing context-aware, insight-driven platforms to identify vulnerabilities proactively. Industry-specific needs, such as healthcare and financial services, require tailored security strategies, with automation and real-time analytics playing key roles in safeguarding sensitive data and ensuring compliance. Cost-effective approaches—leveraging automation, integration-friendly tools, and open-source resources—enable organizations to secure NHIs without compromising security quality or overextending financial resources. The Issue The story explains how organizations…

Summary Points Unauthorized Access Investigation: Salesforce is investigating suspicious activity linked to connected applications from Gainsight that may have enabled unauthorized access to customer data. Token Revocation and App Removal: In response to potential breaches, Salesforce has revoked all active tokens for Gainsight applications and removed them from its AppExchange marketplace. OAuth Token Exploitation: Google Threat Intelligence Group reports hackers, associated with ShinyHunters, are compromising OAuth tokens, highlighting a trend of targeting third-party SaaS integrations. Security Recommendations: Security teams are advised to audit their SaaS environments, review OAuth tokens, and rotate credentials if any unusual activity is detected. Investigating the…

Summary Points A 35-year-old Russian suspected hacker was arrested in Phuket on an international warrant linked to cyberattacks on U.S. and European agencies. The suspect, identified as Denis Obrezko, entered Thailand on October 30 and was taken into custody at his hotel on November 6. Authorities seized digital devices and confirmed the arrest followed FBI intelligence, with extradition proceedings underway. Russia has acknowledged the arrest, and Russian diplomats have visited the suspect in Bangkok prison, while U.S. and Thai officials remain silent on the case. The Issue A 35-year-old Russian man, reportedly identified by Russian media as Denis Obrezko, was…

Top Highlights Arrest of Russian Hacker: A suspected Russian hacker wanted by the FBI was arrested in Phuket, Thailand, on November 6, following a tip-off about his travel to the country. Charges and Extradition: The suspect, identified as Denis Obrezko, faces allegations of cyberattacks on U.S. and European government agencies, with extradition proceedings underway. Russian Diplomatic Involvement: Russian consular officials have visited Obrezko in prison, confirming their awareness of the arrest and efforts to support him. Evidence Seized: Police confiscated multiple digital devices during the arrest, indicating a significant potential for evidence linked to his cyber activities. [gptA technology journalist,…

Summary Points Malicious scanning activity targeting Palo Alto Networks GlobalProtect VPN login portals surged 40 times within 24 hours starting November 14, indicating a coordinated campaign, with geo-targeted attempts primarily from Germany, Canada, the US, Mexico, and Pakistan. GreyNoise reports a pattern of recurring campaigns involving suspicious and malicious IPs, with previous spikes in October and April, linked through consistent fingerprints and reused Autonomous System Numbers (ASNs), notably ASN AS200373. Approximately 2.3 million sessions targeted the GlobalProtect login endpoint during this spike, emphasizing the importance of actively blocking and monitoring these malicious probes, especially since such spikes often precede security…

Summary Points A hacker breached Almaviva, exposing 2.3 TB of recent confidential data from Italy’s FS Italiane Group, including sensitive documents and internal company information. The leak’s structure suggests it was organized like ransomware and data broker dumps, referencing data from Q3 of 2025, but not linked to a past ransomware attack. Almaviva, a major IT service provider with over 41,000 employees, confirmed the breach and reported the incident to authorities, emphasizing ongoing investigations. It remains unclear whether passenger data or other client information are affected, with the company promising transparency as inquiries continue. Key Challenge Recently, Italy’s leading railway…

Essential Insights Ongoing attacks exploit a two-year-old, unpatched vulnerability in the Ray AI framework (CVE-2023-48022) to hijack NVIDIA GPU clusters for autonomous cryptomining and malware spreading. Cybercriminals utilize exposed Ray dashboards via GitHub and GitLab to deploy malicious payloads, establish reverse shells, and propagate the malware across networks. The campaigns leverage large language models to craft complex payloads, include region-specific malware, and employ tactics like process disguise and CPU throttling to evade detection. Threat actors are weaponizing compromised Ray clusters for DDoS attacks and creating a versatile botnet, transforming a cryptojacking operation into a multi-purpose attack infrastructure. Underlying Problem Oligo…

Quick Takeaways A critical Windows Graphics Component vulnerability (CVSS 9.8) allows remote code execution via specially crafted JPEG images, requiring no user interaction. Discovered in May 2025 and patched in August 2025, it exploits an untrusted pointer dereference in the windowscodecs.dll library, impacting image processing functions. Attackers can embed malicious JPEGs into files like Office documents, enabling silent, network-based exploitation and potential system control. Immediate patching and proactive security measures are essential, as the flaw’s low complexity and wide reach make it a prime target for future attacks. Underlying Problem A significant vulnerability has been uncovered in Microsoft’s Windows Graphics…

Summary Points Despite improvements in incident detection (detecting 50% within 24 hours) and containment (65% within 48 hours), remediation remains slow, with 22% taking days to weeks and some over a year, highlighting ongoing recovery challenges. Remote access poses significant risks, with only 13% of organizations fully implementing advanced controls like session recording; many lack resources or legacy system compatibility, increasing vulnerability. Although 57% have ICS/OT incident response plans and threat intelligence use rises, actual investment in proactive measures like threat hunting, exercises, and automation remains low, requiring targeted resource allocation. Moving forward, organizations must shift focus from merely detecting…

Top Highlights Critical Vulnerability Alert: A newly discovered OS command injection vulnerability (CVE-2025-58034) in Fortinet FortiWeb allows authorized attackers to execute system code through crafted HTTP requests or CLI commands. Severity and Exploitation: The flaw, with a severity score of 6.7, has been confirmed to be actively exploited in the wild, putting systems at significant risk if not patched. Chained Vulnerabilities: Recent findings indicate that two vulnerabilities (CVE-2025-58034 and CVE-2025-64446) could be chained together, enabling attackers to perform unauthenticated remote code execution. Security Community Concerns: Fortinet has faced criticism for issuing silent patches for vulnerabilities, leaving security teams unaware and…