Security News & Blog

CISA’s advisory on Kieback & Peter DDC Building Controllers is another reminder that building automation systems are now part of the cyber-risk surface, not just facilities infrastructure. These controllers are used to …

The Hacker News article highlights an important shift in phishing: attackers are no longer always trying to steal passwords. They are increasingly trying to trick users into approving OAuth consent, which can give attac…

The Drupal advisory is a clear reminder that CMS platforms remain high-value targets because they sit directly on the public internet and often power business-critical websites. Drupal has announced an urgent core secur…

The SEPPMail Secure E-Mail Gateway vulnerabilities are a strong reminder that security gateways themselves must be treated as high-value attack surfaces. According to the report, multiple flaws could allow attackers to …

The compromised Nx Console 18.95.0 incident is a serious reminder that developer tools have become a direct path into enterprise environments. According to the report, a malicious version of the Nx Console extension was…

The Trapdoor Android ad-fraud campaign shows how mobile threats are becoming more layered and harder to detect. Researchers found that the operation involved 455 malicious Android apps and 183 attacker-controlled C2 dom…

The 7-Eleven data breach claimed by ShinyHunters is another reminder that large retail brands must secure not only customer-facing systems, but also franchisee, document-management, and SaaS environments. 7-Eleven confi…

CISA’s advisory on ZKTeco CCTV Cameras highlights why physical security devices must be managed with the same discipline as core IT infrastructure. The issue affects the SSC335-GC2063-Face-0b77 solution, where vulnerabi…

View CSAF Summary An update is available that resolves vulnerability in the product versions listed as affected in this advisory. A path traversal vulnerability in these products can allow unauthentic…

The GitHub Actions supply-chain attack against actions-cool/issues-helper is a serious reminder that CI/CD pipelines are now prime targets for credential theft. In this case, attackers reportedly moved existing GitHub A…

The SHub “Reaper” macOS infostealer campaign shows how attackers are rapidly adapting to platform security improvements. Instead of relying only on older ClickFix-style Terminal tricks, this variant abuses the applescri…

The reported exposure of AWS GovCloud keys and internal CISA credentials on a public GitHub repository is a stark reminder that secret management failures can undermine even the most security-focused organizations. Acco…