Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

levelblue

How to Detect and Mitigate Zero-Day Vulnerabilities

Sep 30, 2025 By Daniel Ghillione In LevelBlue
Companies face more sophisticated, unpredictable cyber threats. Zero Day vulnerabilities are among the greatest risks, as these software flaws are unknown and exploited before a fix is available, potentially compromising thousands of organizations. Stopping zero-day attacks is a top priority for security teams, requiring faster identification, detection, and mitigation to prevent damage. But how do these attacks work, and what practices really help?
Read Post
tripwire

Understanding the OWASP AI Maturity Assessment

Sep 29, 2025 By Josh Breaker-Rolfe In Tripwire
Today, almost all organizations use AI in some way. But while it creates invaluable opportunities for innovation and efficiency, it also carries serious risks. Mitigating these risks and ensuring responsible AI adoption relies on mature AI models, guided by governance frameworks. The OWASP AI Maturity Assessment Model (AIMA) is one of the most practical. In this article, we’ll explore what it is, how it compares to other frameworks, and how organizations can use it to assess their AI maturity.
Read Post
graylog

The Value of a Robust Vulnerability Management Program

Sep 29, 2025 By Jeff Darrington In Graylog
Back before live security video feeds in homes, people would walk around at night checking to make sure they locked every window and door. They took these precautions because they knew that a single open lock gave burglars an opportunity to steal from them. For organizations, vulnerability management programs are a way to lock the doors against cybercriminals.
Read Post
bitsight

Critical Vulnerability Alert: CVE-2025-10035 in GoAnywhere MFT

Sep 29, 2025 By Emma Stevens In BitSight
A critical security vulnerability (CVE-2025-10035) has been identified in GoAnywhere MFT, a widely used file transfer solution developed by Fortra. This software is commonly deployed to securely transfer sensitive data such as financial records, HR files, legal documents, and personally identifiable information (PII). Currently, CVE-2025-10035 is rated at a 10.0 (critical) on the CVSS scale and a 9.23 out of 10 on Bitsight’s Dynamic Vulnerability Exploit (DVE) scale.
Read Post

The case against secrets in .env files

Sep 29, 2025 By Snyk In Snyk
Most developers rely on.env files to store secrets like API keys, database passwords, and tokens. But what if I told you this common practice can leave you wide open to attacks? In this video, I break down why storing secrets in a.env file is dangerous, how attackers can exploit it, and what safer alternatives you should be using instead.
View Video
Top 5 Cybersecurity Risks in ERP Systems and How to Prevent Them

Top 5 Cybersecurity Risks in ERP Systems and How to Prevent Them

Sep 29, 2025 By SecuritySenses In SecuritySenses
Modern businesses are built on Enterprise Resource Planning (ERP) systems. From finance to supply chain, they run everything in one place. Many of them can even connect to cloud systems, mobile apps, and IoT devices. But where they are most powerful, they are also most vulnerable. Cybercriminals know that ERP systems are treasure troves of data. So if an attack happens, it can lead to significant data theft. Not only that, it can also delay payroll, damage production lines, and stop operations.
Read Post
ionix

CVE-2025-20333: Authenticated RCE in Cisco ASA / FTD VPN Web Server

Sep 26, 2025 By Tal Zamir In IONIX
A high-severity vulnerability (CVSS 9.9) has been disclosed in the VPN web server component of Cisco Secure Firewall ASA and FTD software. An authenticated attacker (i.e. one possessing valid VPN credentials) can send specially crafted HTTP(S) requests that bypass input validation and lead to remote code execution as root. This means full device compromise is possible.
Read Post
Trustwave

REDCap: Multiple Cross-Site Scripting (XSS) Vulnerabilities

Sep 26, 2025 By Harold Zang In Trustwave
REDCap, developed by Vanderbilt University, is a secure platform designed for data collection in research studies and operations. REDCap is popular within scientific institutions and universities that require strict compliance with government regulations and data privacy laws when conducting data collection for research purposes. It is particularly useful for managing studies that often contain sensitive or private information.
Read Post
Arctic Wolf

Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs, Deploys Ransomware in an Hour or Less

Sep 26, 2025 By Arctic Wolf Labs In Arctic Wolf
In late July 2025, Arctic Wolf Labs began observing a surge of intrusions involving suspicious SonicWall SSL VPN activity. Malicious logins were followed within minutes by port scanning, Impacket SMB activity, and rapid deployment of Akira ransomware. Victims spanned across multiple sectors and organization sizes, suggesting opportunistic mass exploitation. This campaign has recently escalated, with new infrastructure linked to it observed as late as September 20, 2025.
Read Post
Arctic Wolf

Cisco Patches ASA, FTD, and IOS Vulnerabilities, Including Critical and Exploited Flaws

Sep 26, 2025 By Andres Ramos In Arctic Wolf
On September 25, 2025, Cisco released fixes for two vulnerabilities in Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) that are currently being actively exploited by a sophisticated threat actor. The US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 25-03 requiring Federal Civilian Executive Branch (FCEB) agencies to patch these vulnerabilities by 12 PM EDT on September 26.
Read Post
outpost 24

Carding ecosystem: The fall of traditional financial cybercrime

Sep 26, 2025 By Marcelo Ruano In Outpost 24
Carding is a type of cybercrime where attackers steal or illegally buy credit card information and use it to make unauthorized transactions. It often involves testing stolen card numbers with small purchases before making larger fraudulent charges. Criminals typically exchange or sell these stolen details on underground forums or dark web marketplaces. Outpost24’s Threat Intelligence team, KrakenLabs, carried out a previous public analysis of the underground card fraud ecosystem in 2022.
Read Post
Snyk

Malicious MCP Server on npm postmark-mcp Harvests Emails

Sep 25, 2025 By Liran Tal In Snyk
On September 25, 2025, the npm package postmark-mcp, an MCP (Model Context Protocol) server intended to let AI assistants send emails via Postmark, was reportedly modified to secretly exfiltrate email contents by adding a blind-copy (BCC) to an external domain. Current analysis suggests the behavior began around 1.0.16 and persisted in later versions.
Read Post
outpost 24

Olymp Loader: A new Malware-as-a-Service written in Assembly

Sep 25, 2025 By Lidia López Sanz In Outpost 24
Olymp Loader is a Malware-as-a-Service (MaaS) advertised on underground forums and Telegram since June 5, 2025. The seller, “OLYMPO”, presents Olymp Loader as fully written in assembly language and frequently markets it as FUD (Fully UnDetectable). Despite its recent appearance, many underground forum users have already posted positive reviews.
Read Post

When Attackers Weaponize AI and Defenders Fight Back with Smarter Remediation

Sep 24, 2025 By Nucleus Security In Nucleus
Artificial intelligence is transforming cybersecurity, and not always for the better. Attackers are now weaponizing AI to speed up reconnaissance, create exploit code, and bypass traditional defenses. Security teams can’t afford to rely on outdated vulnerability management practices. In this webinar, Scott Kuffer (COO, Nucleus Security) and Corey Brunkow (Director of Federal Operations, Horizon3.ai) break down how AI is changing the threat landscape and what defenders can do to stay ahead.
View Video
Snyk

How Snyk Learn Helps You Meet PCI DSS v4.0 Developer Training Requirements

Sep 23, 2025 By Michael Biocchi In Snyk
As businesses strive to secure sensitive cardholder data and stay compliant with Payment Card Industry Data Security Standard (PCI DSS) v4.0.1, one of the most overlooked areas is developer training. The latest version of the PCI DSS places clear emphasis on ensuring developers are not only residually aware of security best practices, but are actively trained to build secure software and detect vulnerabilities. This is where Snyk Learn comes in.
Read Post
Arctic Wolf

CVE-2025-26399: Critical Unauthenticated RCE in SolarWinds Web Help Desk Through Second Bypass

Sep 23, 2025 By Andres Ramos In Arctic Wolf
On September 23, 2025, SolarWinds released a hotfix for a critical vulnerability impacting Web Help Desk (WHD), tracked as CVE-2025-26399. The vulnerability arises from a deserialization flaw in the AjaxProxy component that could allow a remote unauthenticated threat actor to achieve remote code execution. CVE-2025-26399 is the second bypass of a flaw originally disclosed last year as CVE-2024-28986 within WHD, with the first bypass being CVE-2024-28988.
Read Post
nucleus

Exploitability as the Countdown Clock: Prioritizing Vulnerabilities Before Time Runs Out

Sep 23, 2025 By Corey Tomlinson In Nucleus
In vulnerability management, every scan tells a story. The truth is that only some of those stories matter right now and that the challenge isn’t finding vulnerabilities. It’s knowing which ones are about to cost you. If you’re dealing with hundreds of vulnerabilities per asset, especially if you’ve adopted cloud solutions, you’re not alone. That’s become the norm. But you can’t patch everything, and you shouldn’t even try.
Read Post
lookout

Zero-Day Mobile Vulnerabilities: Why Speed is the Key to Cyber Defense

Sep 23, 2025 By Lookout In Lookout
Every year, mobile devices become more powerful, more innovative, and more complex. That’s good news for diligent workers who want to stay connected and productive. Unfortunately, it’s also good news for threat actors who want to steal sensitive data. Zero-day vulnerabilities in mobile applications and operating systems (OSs) are becoming more common over time.
Read Post
outpost 24

Outpost24 introduces new pen test reports and packages for mobile apps and APIs

Sep 23, 2025 By Outpost 24 In Outpost 24
Philadelphia, PA, 23rd September – Outpost24, a leading provider of exposure management solutions, today announced the launch of new pen test reporting, giving customers a consolidated view of all penetration testing results within a single platform. This eliminates the need to manage multiple reports from different sources, saving time and improving operational efficiency. Security teams can now view, schedule, and download reports directly, with actionable insights from certified pen testers.
Read Post
astra

Partial Scans vs. Full Scans: Which Delivers Better Security Coverage and Efficiency?

Sep 22, 2025 By Aakanksha Khanna In Astra
Vulnerability scanning is no longer optional for modern teams. With new features released weekly, and sometimes resources deployed and removed within hours, businesses need constant vigilance to stay ahead of attackers. The real question is: how often should you scan without slowing down the development process? Full scans are thorough but time-intensive, sometimes taking hours or days. Partial (incremental) scans are faster and CI/CD-friendly but risk missing critical gaps.
Read Post
Snyk

Snyk Ranked #51 on 2025 Forbes Cloud 100 List

Sep 22, 2025 By Peter McKay In Snyk
We’re thrilled to share that Snyk has, for the sixth time and fifth consecutive year, been named to the Forbes Cloud 100 ranked at, recognizing the world’s most innovative private cloud companies. This year’s recognition is especially meaningful, reflecting the bold step we took in May to launch the AI Trust Platform, reorienting Snyk around a single mission — securing the future of AI-native software development.
Read Post
outpost 24

zerodayx1: Hacktivist groups turning to ransomware operations

Sep 22, 2025 By KrakenLabs In Outpost 24
In July 2025, pro-Palestinian hacktivist group zerodayx1 launched its own Ransomware-as-a-Service (RaaS) operation, following the path of other hacktivist teams. They loudly announced the initiative on platforms commonly used for such purposes, including X (formerly Twitter) and Telegram. Zerodayx1 exemplifies the ongoing evolution of these groups, underscoring the importance of studying and understanding their methods in order to better prepare for and respond to such threats.
Read Post
ionix

CVE-2025-10035 Critical Remote Code Execution in Fortra GoAnywhere MFT

Sep 21, 2025 By Tal Zamir In IONIX
A new critical vulnerability, CVE-2025-10035, has been disclosed in Fortra’s GoAnywhere MFT, a widely used managed file transfer solution. The flaw lies in the License Servlet and allows unauthenticated attackers to achieve remote code execution (RCE) through crafted license responses. The vendor has rated this vulnerability as Critical (CVSS 10.0) due to its potential for complete system compromise over the network.
Read Post
jfrog

Shifting Security 'Lefter' Than Left Is The Key To Avoiding Risky Packages

Sep 19, 2025 By Asaf Karas In JFrog
As the AI revolution accelerates, developers are being inundated with a dazzling array of new software packages and game-changing tools such as GitHub CoPilot, Sourcegraph, Qodo, Cursor, Goose, and others that promise incredible advances in productivity and impact. The excitement over this is high and just keeps on growing.
Read Post
Arctic Wolf

CVE-2025-10035: Maximum-Severity Command Injection Vulnerability in Fortra GoAnywhere MFT

Sep 19, 2025 By Andres Ramos In Arctic Wolf
On September 18, 2025, Fortra released a patch addressing a critical vulnerability in GoAnywhere Managed File Transfer (MFT), tracked as CVE-2025-10035. The vulnerability stems from a deserialization flaw in the License Servlet of GoAnywhere MFT, allowing a remote threat actor with a valid forged license response signature to deserialize an arbitrary, threat-actor-controlled object and potentially achieve command injection.
Read Post
squarex

Palo Alto Networks Acknowledges SquareX Research on Limitations of SWGs Against Last Mile Reassembly Attacks

Sep 18, 2025 By SquareX
SquareX first discovered and disclosed Last Mile Reassembly attacks at DEF CON 32 last year, warning the security community of 20+ attacks that allow attackers to bypass all major SASE/SSE solutions and smuggle malware through the browser. Despite responsible disclosures to all major SASE/SSE providers, no vendor has made an official statement to warn its customers about the vulnerability in the past 13 months - until two weeks ago.
Read Post
nucleus

Operationalizing Exposure Remediation Across Teams

Sep 18, 2025 By Adam Dudley In Nucleus
Exposure management doesn’t end when you discover and prioritize vulnerabilities. The real measure of success is whether you’ve effectively remediated those exposures. Too often, security teams identify risks but struggle to see them resolved because remediation processes aren’t aligned across people, tools, and workflows. Exposure remediation best practices address this gap, ensuring that insights lead to action and that action drives measurable risk reduction.
Read Post
Snyk

Secure Your AI Workflows: New Governance & Visibility Features from Snyk

Sep 18, 2025 By Kate Powers Burke In Snyk
As AI transforms software development, AppSec teams face new complexities. For instance, the lack of visibility into where AI is being used and the reality that AI-generated code is often highly vulnerable make it nearly impossible to prioritize remediation and effectively scale security programs. To succeed, AppSec teams have to evolve from task managers to strategic governance enforcers.
Read Post
CrowdStrike

Falcon for IT Redefines Vulnerability Management with Risk-based Patching

Sep 17, 2025 By Michael Devins In CrowdStrike
CrowdStrike is introducing Risk-based Patching in CrowdStrike Falcon for IT to close the gap between security and IT teams. With AI-powered Risk-based Patching and CrowdStrike Falcon Exposure Management, organizations can identify, prioritize, and fix the vulnerabilities most critical to them through a single console and workflow while accelerating security and IT consolidation.
Read Post
Arctic Wolf

SonicWall Warns Customers of Data Exposure Incident Affecting MySonicWall Configuration Backup Files

Sep 17, 2025 By Julian Tuin In Arctic Wolf
On September 17, 2025, SonicWall released a knowledge base article detailing the exposure of firewall configuration backup files stored in certain MySonicWall accounts. SonicWall states that after identifying the incident they began an investigation containing the incident, terminating the ‘unauthorized access point’, and working with law enforcement and select cybersecurity agencies globally.
Read Post
Arctic Wolf

CVE-2025-9242: Critical Unauthenticated Out-of-Bounds Write Vulnerability in WatchGuard Firebox

Sep 17, 2025 By Andres Ramos In Arctic Wolf
On September 17, 2025, WatchGuard released fixes for a critical out-of-bounds write vulnerability (CVE-2025-9242) in the iked process of WatchGuard Fireware OS, which powers their Firebox firewall appliances. This flaw allows a remote unauthenticated threat actor to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN with IKEv2 when configured with a dynamic gateway peer.
Read Post
jfrog

Chaotic Deputy: Critical vulnerabilities in Chaos Mesh lead to Kubernetes cluster takeover

Sep 16, 2025 By Natan Nehorai In JFrog
JFrog Security Research recently discovered and disclosed multiple CVEs in the highly popular Chaos engineering platform – Chaos-Mesh. The discovered CVEs, which we’ve named Chaotic Deputy are CVE-2025-59358, CVE-2025-59360, CVE-2025-59361 and CVE-2025-59359. The last three Chaotic Deputy CVEs are critical severity (CVSS 9.8) vulnerabilities which can be easily exploited by in-cluster attackers to run arbitrary code on any pod in the cluster, even in the default configuration of Chaos-Mesh.
Read Post
Snyk

Speaking Different Languages: How to Align Dev and Sec Teams Effectively

Sep 15, 2025 By Tiago Mendo In Snyk
Security issues in software development often stem not from developers’ lack of concern but from a fundamental disconnect between development and security teams. Each wants to do their job well, but their goals and expectations frequently conflict. This misalignment costs organizations in heightened security risks and tangible operational setbacks. Security issues identified too late in the cycle delay releases and increase project costs.
Read Post

You Won't Believe These Results from Replit

Sep 15, 2025 By Snyk In Snyk
In this video, we put Replit’s AI coding tool to the test by asking it to create a secure note-taking app. While the tool shows off some seriously impressive abilities, it’s not without its flaws... Join me as I explore what Replit can (and can’t) do, and whether AI coding tools such as this one are ready to build reliable, secure apps.
View Video
nucleus

Nucleus Momentum Validated Across Three Industry Analyst Reports

Sep 11, 2025 By Tamir Hardof In Nucleus
It’s one thing for us to say Nucleus is changing how enterprises address vulnerability and exposure management. It’s another when three different analyst firms all say it, and at the same time. In recent weeks, Forrester, IDC, and GigaOm each published their latest market evaluations, recognizing Nucleus in all three. That’s rare validation in a market where many vendors don’t even make the cut for inclusion.
Read Post
CalCom

New SMB Vulnerability opens door to privilege escalation

Sep 11, 2025 By Roy Ludmir In CalCom
On September 9, 2025, Microsoft released details of CVE-2025-55234, a critical vulnerability in the Windows Server Message Block (SMB) protocol. With a CVSS v3 score of 8.8, it’s classified as High severity and poses a serious elevation-of-privilege (EoP) risk. An attacker exploiting this flaw could launch a relay attack, allowing them to gain the privileges of a legitimate user without elevated permissions or insider access.
Read Post
detectify

Product comparison: Detectify vs. Intruder

Sep 10, 2025 By Detectify In Detectify
Intruder is a cloud-based vulnerability scanner that provides an automated overview of an organization’s attack surface. Its primary function is to proactively identify weaknesses across internet-facing infrastructure and applications before they are exploited. The platform’s scanning engine runs a set of checks for both infrastructure-level misconfigurations and application-layer vulnerabilities, like those in the OWASP Top 10. It leverages open-source engines like ZAP to execute its checks.
Read Post

When Secure Isn't Safe Uncovering OWASP Top 10 Business Logic Abuse

Sep 10, 2025 By Wallarm In Wallarm
The OWASP Top 10 for Business Logic Abuse reveals the most critical ways attackers exploit the design of your applications, not just their code. Business logic abuse isn’t about SQL injection or XSS, it's about bypassing the rules, manipulating workflows, and triggering unintended behaviors in ways your functional tests never anticipated. Why this Matters? Attackers are shifting from exploiting code flaws to abusing the intended functionality of your applications.These logic-level threats are particularly dangerous because they.
View Video
Arctic Wolf

CVE202554236: Critical Adobe Commerce and Magento Open Source Flaw Allows Customer Account Takeover and RCE

Sep 10, 2025 By Andres Ramos In Arctic Wolf
On September 9, 2025, Adobe released an out-of-band security update to address a critical vulnerability in Adobe Commerce and Magento Open Source. The vulnerability, tracked as CVE-2025-54236 and referred to in open-source reporting as “SessionReaper,” allows a remote unauthenticated threat actor to take over customer accounts through the Commerce REST API.
Read Post
Featured Post
Machines, the Silent Threat Lurking Inside the Enterprise

Machines, the Silent Threat Lurking Inside the Enterprise

Sep 9, 2025 By Brian Ramsey, VP Americas - Sales In Xalient
The digital enterprise is no longer primarily made up of individuals' identities. According to Gartner, over 60% of all identities in a typical organization are non-human. These Non-Human Identities (NHIs) are digital identities assigned to software, services, applications, containers, or devices that require access to systems and data. Unlike human identities, NHIs operate autonomously, at scale, and often with high privilege. This makes them essential for modern automation and uniquely vulnerable to misuse.
Read Post
seemplicity

5 Steps to Operationalize Threat Exposure Management

Sep 9, 2025 By Jessica Amado In Seemplicity
Security teams are drowning in findings, but only a fraction of exposures actually put the business at risk. Treating every issue as equal spreads resources thin, slows down remediation, and leaves critical systems exposed. Threat Exposure Management (TEM) changes the equation by forcing teams to focus on the exposures most likely to cause real damage – and to build the operating model that ensures they get fixed.
Read Post
bitsight

Patch vs. Workaround: How CVEs Actually Get Fixed

Sep 9, 2025 By Diogo Ferreira In BitSight
In order to collect various security-related metrics, Bitsight scans the entire internet, collecting a unique set of data that enables us to carry out a variety of studies that would be extremely difficult for any other company to conduct. One of the metrics that we collect is related to the presence of certain vulnerabilities. For this, we need to take into consideration all possible mitigation strategies that are available and that allow us to reduce the risk.
Read Post
elastic

Guide to the OWASP Top 10 for LLMs: Vulnerability mitigation with Elastic

Sep 9, 2025 By Rich Cabrera In Elastic
Industries, governments, and enterprises of all kinds have adopted large language models (LLMs) and generative AI (GenAI) into their operations and workflows, unlocking new possibilities for everything from customer interaction to complex data analysis. But with this innovation comes new challenges for security, observability, and data science teams.
Read Post
Arctic Wolf

CVE-2025-42944: Maximum-Severity OS Command Execution Vulnerability in SAP NetWeaver

Sep 9, 2025 By Andres Ramos In Arctic Wolf
On September 9, 2025, SAP released its September 2025 Security Patch Day update with patches for 21 vulnerabilities. The most severe of these, CVE-2025-42944, is a maximum-severity deserialization vulnerability of untrusted Java objects in SAP NetWeaver that resides in the RMI-RP4 module. A remote unauthenticated threat actor can exploit this vulnerability by submitting a malicious payload to an open port to achieve arbitrary OS command execution.
Read Post
ionix

Unauthenticated SSRF in Ditty WordPress Plugin (CVE-2025-8085)

Sep 9, 2025 By Tal Zamir In IONIX
A critical Server-Side Request Forgery (SSRF) vulnerability—CVE-2025-8085—has been discovered in the popular WordPress plugin “Ditty (News Ticker & Display Items)” for versions prior to 3.1.58. The issue resides in the displayItems REST API endpoint (wp-json/dittyeditor/v1/displayItems), which lacks authentication and authorization, allowing unauthenticated attackers to force the server to fetch arbitrary URLs—internal or external—via crafted JSON payloads.
Read Post
Snyk

Snyk Named a Leader in the 2025 Forrester SAST Wave: SAST Solutions, Q3 2025

Sep 9, 2025 By Ben Desjardins In Snyk
We’re excited to announce that Snyk has been recognized as a Leader in the Forrester Wave: Static Application Security Testing (SAST) Solutions, Q3 2025. This recognition affirms our place at the forefront of developer-first security — and highlights the innovation, customer impact, and platform breadth that continue to set us apart.
Read Post
upguard

Introducing UpGuard's Unified CRPM Platform

Sep 9, 2025 By Revashni Moodley In UpGuard
Cybersecurity isn’t a one-off battle. It’s a daily war fought on multiple fronts. Despite this, many security teams have been defending their organizations without cohesive visibility. Isolated security tools present a disjointed defense, one that is still fighting yesterday’s battles, but not today’s cyber threats.
Read Post
Snyk

npm Supply Chain Attack via Open Source maintainer compromise

Sep 8, 2025 By Brian Clark In Snyk
On Monday, September 8th, a highly regarded open source developer, ~qix, was compromised via a phishing email. ~qix is an author and maintainer behind a large number of popular npm packages and found himself caught by this attack after responding to a message from the email address of support help. This resulted in the attacker taking over his npm account and having access to publish malicious versions of packages to which Qix had privileged access.
Read Post
Trustwave

Rogue AI Agents In Your SOCs and SIEMs - Indirect Prompt Injection via Log Files

Sep 5, 2025 By Tom Neaves In Trustwave
AI agents (utilizing LLMs and RAG) are being used within SOCs and SIEMS to both help identify attacks and assist analysts with working more efficiently; however, I’ve done a little bit of research one sunny British afternoon and found that these agents can be abused by attackers and made to go rogue. They can be made to modify the details of an attack, hide attacks altogether, or create fictitious events to cause a distraction while the real target is attacked instead.
Read Post
cyberark

Defeating Microsoft EPM in the Race to Admin: a Tale of a LPE vulnerability

Sep 4, 2025 By Rotem Salinas In CyberArk
Not too long ago I read an interesting blogpost by SpecterOps about Microsoft EPM that got my attention as I was not aware of this Microsoft product/feature. It was interesting to learn that Microsoft expanded into the realm of Endpoint Privilege Management and since this means that there must be some service/driver running with high privileges that elevates low-privileged processes, I thought there could be potential vulnerabilities and bugs.
Read Post
Snyk

What an 'Aha' Moment with an Org Admin Token Taught One DevSecCon Speaker About AI Security

Sep 4, 2025 By Alysa Turner In Snyk
As the summer winds down and conversation around AI Security heats up, the Snyk team is in full swing planning mode for a double-header this October—with the return of DevSecCon’s Flagship conference, focusing this year on Securing the Shift to AI Native, and serving as the founding partner of the inaugural AI Security Summit.
Read Post
outpost 24

Business logic: The silent future of cyberattacks

Sep 4, 2025 By Jimmy Bergqvist In Outpost 24
Future hacks won’t trigger alarms or leave traces. No security measures will be violated. The systems are functioning normally – but the loss is real. As automated defenses improve, attackers must target what machines can’t: the business processes. By exploiting flaws in workflow logic, hackers can steal data and funds in a way no one expected. Business logic vulnerabilities are now a serious cybersecurity blind spot, and a leading method for breaching even the most secure systems.
Read Post
nucleus

Why We Built Nucleus Insights

Sep 3, 2025 By Scott Kuffer In Nucleus
Today we’re announcing the beginning of the next phase of our journey. We’re launching our Vulnerability Intelligence feed, Nucleus Insights. As we’ve worked with many companies, partners, and clients over the years, this became an obvious next step for Nucleus, and I want to share with you why. Fixing vulnerabilities is expensive. Not just in terms of patching costs or system downtime, but in people, time, and lost focus.
Read Post
astra

Balancing Scan Depth and Speed in Modern Pipelines

Sep 3, 2025 By Sanskriti Jain In Astra
Most teams run on velocity budgets, not risk budgets. While features get sprints, milestones, and release slots, risk, on the other hand, gets hope. When scan depth and speed decisions are made without an explicit budget for risk, the outcome is predictable: throughput is optimized while exposure compounds silently in the background.
Read Post
signmycode

What is Code Injection? Types, Prevention & Detection Strategies

Sep 3, 2025 By SignMyCode In SignMyCode
In 2021, a critical vulnerability in a popular Node.js library allowed hackers to carry out code injection and silently compromise thousands of applications, with disastrous effects. It wasn’t a brute-force attack. It wasn’t ransomware. It was some wittily constructed pieces of malevolent code that got through defences and provided attackers with complete carte blanche. Code injection attacks are no longer rare. They’re alarmingly common.
Read Post
outpost 24

Outpost24 Recognized as a Major Player in IDC MarketScape for Exposure Management

Sep 3, 2025 By Outpost 24 In Outpost 24
PHILADELPHIA (Aug 25, 2025) – Outpost24, a leading provider of exposure management solutions, today announced it has been named as a Major Player in the IDC MarketScape: Worldwide Exposure Management 2025 Vendor Assessment. The Outpost24 team believes this recognition underscores our comprehensive exposure management solutions and commitment to delivering exceptional customer service.
Read Post
foresiet

Next.js Vulnerability: The Critical Flaw of CVE-2025-29927 Explained

Sep 3, 2025 By Foresiet In Foresiet
A critical vulnerability, identified as CVE-2025-29927, has shaken the Next.js development community. Rated with a severity score of 9.1 (Critical), this flaw allows attackers to completely bypass authorization checks in middleware, potentially granting unauthorized access to sensitive data and protected routes. The issue is a powerful reminder that even a small design flaw in a popular framework can have widespread and dangerous consequences.
Read Post
Trustwave

Securing Healthcare's Vulnerable Supply Chain

Sep 2, 2025 By Trustwave In Trustwave
The digital interdependence of today’s healthcare supply chain has created new systemic risks. Cybersecurity is no longer limited to internal systems, but vulnerabilities in the innumerable third-party suppliers can now expose entire networks to disruption. From patient records stored in the cloud to diagnostic tools and logistics platforms, every element is a potential entry point for attackers.
Read Post
seemplicity

Risk Assessments Automation & Integration for Cybersecurity

Sep 2, 2025 By Jessica Amado In Seemplicity
The problem with cybersecurity risk today? It won’t sit still. Modern risk is messy. It spreads across cloud workloads, third-party services, shadow assets, and developer pipelines. It evolves faster than most teams can keep up. And it rarely announces itself with a neat dashboard alert. Yet many organizations still rely on the old playbook: manual risk assessments, stitched together from siloed tools, delivered days or weeks after they’re already outdated.
Read Post

Multi-Tenant Systems: Sharing Vulnerabilities #appsec

Sep 2, 2025 By Mend In Mend
Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.
View Video
outpost 24

Seven ways AI could impact the future of pen testing

Sep 1, 2025 By Marcus White In Outpost 24
In an era where attack surfaces are expanding faster than ever, AI has the potential to transform how organizations find and fix vulnerabilities. Gartner estimates AI agents will reduce the time it takes to exploit account vulnerabilities by 50%. From automating routine scans to developing self-learning attack agents, AI is already changing the red team playbook – and the pace of innovation shows no signs of slowing.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.