Author: Staff Writer

Summary Points Oracle disclosed critical local vulnerabilities in VirtualBox (versions 7.1.12 and 7.2.2) that could allow attackers to fully control the environment, risking data leaks, system crashes, and malware persistence, with high CVSS scores highlighting severe danger. The nine identified CVEs stem from privilege handling flaws, requiring local access but potentially enabling scope changes to affect broader system security and impact confidentiality, integrity, and availability. Despite no active exploits reported, the vulnerabilities’ resemblance to past bugs and high severity scores underscore the urgent need for immediate patching and enhanced security practices. Oracle recommends prompt application of the October 2025 fixes,…

Quick Takeaways Critical Vulnerability Alert: Adobe Commerce and Magento Open Source platforms are facing exploitation of a severe flaw (CVE-2025-54236), with over 250 attacks recorded in just 24 hours. Widespread Insecurity: Approximately 62% of Magento stores are still vulnerable to this high-risk flaw, emphasizing the need for urgent patch application. Exploitation Tactics: Threat actors are using the vulnerability to upload PHP backdoors and probe server configurations, indicating a high likelihood of account takeovers. Historical Context: This incident marks the second significant deserialization vulnerability within Adobe platforms in two years, underscoring ongoing security challenges in the ecosystem. Over 250 Magento Stores…

Summary Points Over 75% of organizations struggle to keep up with increasingly sophisticated cyberattacks, with 89% relying on AI to bridge the threat detection gap. Nearly half view AI-automated attack chains as the top ransomware threat, while 85% believe traditional detection is becoming obsolete against AI-driven tactics. Despite increased investments in cybersecurity post-attack, only 22% can recover from ransomware within 24 hours, and 78% experienced an attack in the past year. The average cost per ransomware incident is $1.7 million, with a significant disconnect between leadership and security teams on ransomware preparedness. Key Challenge A recent survey of 1,100 cybersecurity…

Summary Points Lumma Infostealer, launched in August 2022, rapidly became a popular malware-as-a-service tool, enabling even unskilled actors to steal high-value credentials through sophisticated infection techniques. Delivered via phishing with NSIS installers, it employs process hollowing and process injection to evade detection, stealthily extracting browser cookies, tokens, cryptocurrency wallets, and VPN/RDP credentials. The malware’s modular design allows continuous updates and uses encrypted channels to exfiltrate data to C2 domains hosted on compromised infrastructure, often serving as a gateway for further cyberattacks like ransomware. Effective mitigation requires behavior-based endpoint detection, monitoring installer behaviors, blocking known C2 domains, and employing sandbox analysis…

Top Highlights Effective management of Non-Human Identities (NHIs) is crucial for securing cloud environments, requiring a holistic, lifecycle approach that includes discovery, classification, continuous monitoring, and secure decommissioning. Reliance solely on point solutions like secret scanners is insufficient; organizations must adopt automated, platform-driven strategies that enhance visibility, reduce risks, and ensure compliance. Collaboration between security and R&D teams is essential to bridge gaps, align priorities, and establish policies that balance rapid innovation with robust security. Leveraging advanced technology, data analytics, and adaptive governance policies enables proactive risk management, smarter decision-making, and enhanced operational efficiency in NHI security. Problem Explained The…

Quick Takeaways Targeting Drone Manufacturing: North Korea’s Lazarus Group is focused on stealing proprietary information from European drone manufacturers to enhance its domestic drone capabilities. Specific Campaign Details: ESET researchers identified attacks on at least three organizations in Central and Southeastern Europe, all related to military drone production, tying into North Korea’s interest in UAV technology. Malware Utilization: The group’s primary weapon, ScoringMathTea, is a remote access Trojan enabling full control of infected systems, showing little evolution since its introduction but highlighting operational simplicity and stability. Strategic Cyber Tactics: Lazarus employs decoy job-themed documents to infiltrate systems while leveraging compromised…

Essential Insights Critical Role of Browsers: Browsers have become the primary application in enterprises, handling sensitive data and workflows, making them the most targeted attack surface, while legacy security tools are ill-equipped to defend against modern threats. Evolving Attack Strategies: Cybercriminals utilize advanced techniques like rapid zero-day exploitation, malicious browser extensions, and AI-driven social engineering to bypass traditional security measures and maintain persistence in enterprise environments. Limitations of Legacy Security: Traditional security solutions struggle with visibility and real-time response to browser-based attacks, leaving blind spots and vulnerabilities, especially in cloud-native environments where data flows outside classic perimeters. Adopting a Secure…

Summary Points The 2024 FinWise breach was caused by a former employee using retained credentials to access sensitive customer data, going undetected for over a year and highlighting insider threat vulnerabilities. The incident underscores the importance of robust encryption, key management, and proactive access controls to prevent data misuse and minimize damage after breaches. D.AMO, a comprehensive security platform by Penta Security, integrates encryption, granular access control, and isolated key management to protect sensitive data and combat insider threats effectively. Financial institutions must adopt unified, proactive data security solutions like D.AMO to address insider risks, ensure compliance, and prevent irreversible…

Essential Insights Robust IAM policies are essential for managing Non-Human Identities (NHIs) and secrets, reducing risks, enhancing compliance, and increasing operational efficiency. Effective NHI management, including real-time visibility, automated permission adjustments, and secrets rotation, is critical for securing cloud environments and meeting regulatory standards. Implementing Zero Trust architecture and integrating security into DevSecOps practices strengthen NHI security through strict verification and continuous monitoring. Aligning NHI management with business objectives transforms cybersecurity from a cost center into a strategic enabler, fostering innovation, compliance, and competitive advantage. The Core Issue The story reports how organizations across sectors like finance, healthcare, and DevOps…

Essential Insights A sophisticated cyber espionage campaign called PassiveNeuron primarily targets government, financial, and industrial organizations across Asia, Africa, and Latin America using advanced malware and lateral movement techniques. Since November 2024, passive and evolving infection waves have exploited compromised servers, especially Windows Servers via SQL, deploying tailored backdoors like Neursite and NeuralExecutor, and legitimate tools like Cobalt Strike for stealth. The attackers use covert communication methods, such as embedded C2 configurations and platforms like GitHub, to control malware, enabling data exfiltration and sustained access while remaining stealthy. PassiveNeuron uniquely targets internet-exposed servers — valuable footholds for wider infiltration —…