Articles and insights about Cybersecurity & Digital Risk.
30 articles in this category
The newly formed CVE Foundation emerges as a potential successor to MITRE's vulnerability tracking program following federal funding uncertainty, while security researchers raise questions about the long-term trustworthiness of the CVE ecosystem.
Hertz confirmed a data breach affecting customers of its Hertz, Thrifty, and Dollar brands after attackers exploited zero-day vulnerabilities in Cleo file transfer software, exposing personal information including driver's licenses and credit card data.
Chinese officials acknowledged responsibility for the Volt Typhoon cyberattacks targeting US critical infrastructure during a secret meeting with American counterparts, according to a Wall Street Journal exclusive report published on April 10, 2025.
NIST announced a policy shift to deprioritize analysis of CVEs published before 2018, focusing resources on clearing the National Vulnerability Database backlog that has accumulated since early 2024.
The FBI has opened an investigation into a reported cyberattack on Oracle's cloud infrastructure, while the company continues to deny any breach occurred despite security researchers claiming 6 million records were exfiltrated from over 140,000 tenants.
Google released an emergency patch for CVE-2025-2783, a high-severity Chrome sandbox escape vulnerability actively exploited in espionage attacks targeting Russian organizations, discovered by Kaspersky researchers during an APT campaign dubbed Operation ForumTroll.
A critical vulnerability in Next.js middleware allows attackers to bypass authentication and authorization controls by manipulating the x-middleware-subrequest header, affecting versions from 11.1.4 through recent releases.
Apple's Passwords app sent unencrypted HTTP requests for website icons, allowing attackers on the same Wi-Fi network to redirect users to phishing sites for approximately three months before a fix arrived in iOS 18.2.
Security researchers at Socket discovered six malicious npm packages linked to North Korea's Lazarus Group, designed to steal credentials and cryptocurrency wallet data from JavaScript developers through typosquatting tactics.
Microsoft released more than 50 security updates on March 11, 2025, addressing six zero-day vulnerabilities under active exploitation, including NTFS flaws and an elevation of privilege bug discovered by ESET researchers.
Showing 10 of 30 articles • Page 2 of 3
