Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CVSS 4.0 and its Evolving Role in Vulnerability Management

Oct 30, 2025 By Nucleus Security In Nucleus
Adam Dudley, Nucleus VP of Strategy and Alliances, provides some background on the Common Vulnerability Scoring System (CVSS) version 4.0 in this Nucleus conversation. He discusses the improvements made in the new version, the evolving role of CVSS in vulnerability management, the limitations practitioners face, and the future of scoring systems in the context of emerging technologies like AI. The conversation emphasizes the importance of context and quality inputs in effectively utilizing CVSS for risk assessment.
View Video
Corelight

No PoCs? No problem. How to hunt for F5 exploitation even when details are sparse

Oct 28, 2025 By David Burkett In Corelight
Endpoint detection and response (EDR) tools, and the analysts using them, have become incredibly effective. They have become so good, in fact, that we're now seeing a clear shift in adversary behavior: attackers are being pushed off the endpoint and onto places where EDR cannot run. This isn't just a theory. As I was writing a separate blog about a recent Cisco exploit which spurred an immediate CISA emergency directive, news dropped about another major network edge vendor, F5.
Read Post

LDAP Nightmare - Windows LDAP Denial of Service Vulnerability

Oct 27, 2025 By SafeBreach In SafeBreach
In this technical webinar, SafeBreach security experts explore recent LDAP vulnerabilities, focusing on CVE-2024-49113 — a critical flaw capable of crashing unpatched Windows Servers. The team breaks down: This session emphasizes the importance of proactive patching, continuous validation, and understanding the underlying mechanics of directory services to strengthen enterprise resilience.
View Video
Arctic Wolf

Microsoft Releases Emergency Patch for Exploited Critical Remote Code Execution Vulnerability (CVE-2025-59287)

Oct 24, 2025 By Andres Ramos In Arctic Wolf
On October 23, 2025, Microsoft released an out-of-band security update for a critical vulnerability tracked as CVE-2025-59287. The flaw stems from the deserialization of untrusted data in Windows Server Update Services (WSUS), which allows remote, unauthenticated threat actors to achieve remote code execution by sending a crafted event. According to Microsoft, only Windows servers with the WSUS Server Role enabled are affected. This feature is not enabled by default.
Read Post
squarex

AI Sidebar Spoofing Attack: SquareX Uncovers Malicious Extensions that Impersonate AI Browser Sidebars

Oct 23, 2025 By SquareX
SquareX released critical research exposing a new class of attack targeting AI browsers. The AI Sidebar Spoofing attack leverages malicious browser extensions to impersonate trusted AI sidebar interfaces, which is used to trick users into executing dangerous commands that can lead to credential theft, device hijacking, and password exfiltration.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.