Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
CrushFTP auth bypass vulnerability: Disclosure mess leads to attacks
Outpost24 analysts recently discovered a critical authentication bypass vulnerability in CrushFTP, identified as CVE-2025-31161. The vulnerability has a CVSSv3.1 score of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). We reached out to MITRE for a CVE on 13th March 2025 and were within an agreed 90-day non-disclosure period with CrushFTP. The plan was to give users plenty of time to patch before attackers were alerted to the vulnerability and able to exploit it.
CVE-2025-31161: Exploitation of Critical Authentication Bypass Vulnerability in CrushFTP
On March 21, 2025, CrushFTP privately alerted customers to a critical authentication bypass vulnerability, now tracked as CVE-2025-31161. Since the initial disclosure, a proof-of-concept (PoC) exploit has been made publicly available, and the CrushFTP CEO has confirmed observing customer compromises via CVE-2025-31161.
The Role of Vulnerability Management in Mergers and Acquisitions
The landscape of mergers and acquisitions (M&A) is evolving rapidly, particularly in the United States, where the dynamics of these deals are shaped by numerous factors, including cybersecurity. Within this sector, vulnerability management plays a critical role in ensuring the integrity, confidentiality, and availability of digital assets, which are often crucial in M&A transactions.
Get Off My Lawn and Fix Your Vulnerabilities!
Today, I'm absolutely thrilled to announce our newest innovation in the security space: our new CLI tool, Greybeard. After years of giving polite, professional security advice, we've realized what developers really need is an ornery virtual security expert who tells it like it is.
What are Zero-Day Attacks?
A Zero-Day Attack occurs when hackers exploit a previously unknown vulnerability in software or hardware before the developer has a chance to fix it. These attacks are particularly dangerous because there is no defense in place when they occur. In this video, we explain how Zero-Day attacks work and how you can protect your systems from these hidden threats.
Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk
Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of current security tools, and the implications for businesses relying on API-driven applications. It will also discuss potential approaches for improving API security posture.
CVE-2017-12637: Exploitation of SAP NetWeaver Directory Traversal Vulnerability
On March 19, 2025, the CISA issued a warning about the active exploitation of CVE-2017-12637, a directory traversal vulnerability in SAP NetWeaver AS Java. This vulnerability, originally patched in 2017, has resurfaced due to incomplete mitigations, leading to increased risks for organizations using outdated or misconfigured SAP environments.
Why Vulnerability Management Is AI's Biggest Untapped Opportunity
The security industry has reached a turning point with AI. It’s no longer just hype, as AI has now become a critical part of day-to-day cybersecurity operations. According to The Rise of AI-Powered Vulnerability Management, the latest report from Seemplicity and Dark Reading, 86% of security teams now use some form of AI in their security stack. More than half of respondents say AI is already crucial to their work.
The CRITICAL Next.js Vulnerability you NEED to be aware of...
A major security flaw has been discovered in Next.js, potentially leaving thousands of applications vulnerable to attacks. In this video, we will be uncovering how this vulnerability was discovered, who is impacted by it and what you can do to secure your applications.