FortiSandbox XSS Vulnerability Let Attackers Run Arbitrary Commands
Fortinet has disclosed a high-severity cross-site scripting (XSS) vulnerability in its FortiSandbox platform, tracked as CVE-2025-52436 (FG-IR-25-093), that enables unauthenticated attackers to execute arbitrary commands on affected systems. Dubbed an “Improper Neutralization of Input During Web Page Generation” issue (CWE-79), the flaw resides in the graphical user interface (GUI) component and scores a 7.9. At […] The post FortiSandbox XSS Vulnerability Let Attackers Run Arbitrary Com...| Cyber Security News
Threat Hunting Is Critical to SOC Maturity but Often Misses Real Attacks
High-performing SOC teams are increasingly turning to sandbox-derived threat intelligence to make threat hunting repeatable and impactful. Tools like ANY.RUN’s TI Lookup enables faster hunts grounded in real attacker behaviours from millions of analyses. Threat hunting remains a cornerstone of mature Security Operations Centers (SOCs), aiming to detect stealthy adversaries before they cause damage. However, […] The post Threat Hunting Is Critical to SOC Maturity but Often Misses Real Atta...| Cyber Security News
FortiOS Authentication Bypass Vulnerability Lets Attackers Bypass LDAP Authentication
Fortinet has disclosed a high-severity authentication bypass vulnerability in FortiOS, tracked as CVE-2026-22153 (FG-IR-25-1052), that could allow unauthenticated attackers to sidestep LDAP authentication for Agentless VPN or Fortinet Single Sign-On (FSSO) policies. Classified under CWE-305 (Authentication Bypass by Primary Weakness), the flaw resides in the fnbamd daemon and requires specific LDAP server configurations enabling unauthenticated […] The post FortiOS Authentication Bypass Vul...| Cyber Security News
Microsoft 365 Admin Center Outage Hits users in North America
Microsoft 365 administrators in North America are grappling with widespread access issues to the Microsoft 365 admin center, as confirmed by the company’s service health dashboard. Issue ID MO1230320 marks a service degradation affecting the core Microsoft 365 suite, disrupting critical management tasks like user provisioning, security configurations, and compliance monitoring. The outage, first noted […] The post Microsoft 365 Admin Center Outage Hits users in North America appeared firs...| Cyber Security News
Ivanti Endpoint Manager Vulnerability Lets Remote Attacker Leak Arbitrary Data
Ivanti has released critical security updates for its Endpoint Manager (EPM) platform, addressing two newly discovered vulnerabilities that could enable unauthorized access to sensitive database information and compromise user credentials. The updates, released in version 2024 SU5, also resolve 11 medium-severity vulnerabilities previously disclosed in October 2025. The security advisory highlights two primary vulnerabilities of […] The post Ivanti Endpoint Manager Vulnerability Lets Remote...| Cyber Security News
Hackers Weaponizing 7-Zip Downloads to Turn Your Home Computers into Proxy Nodes
A deceptive campaign targeting unsuspecting users has emerged, using a counterfeit version of the widely used 7-Zip file archiving software to silently transform home computers into residential proxy nodes. The malicious operation relies on a lookalike domain, 7zip[.]com, which closely mimics the legitimate 7-zip.org website, tricking users into downloading a compromised installer that appears fully […] The post Hackers Weaponizing 7-Zip Downloads to Turn Your Home Computers into Proxy Node...| Cyber Security News
SAP Security Patch Day – Critical SAP CRM and SAP S/4HANA Code Injection Vulnerabilities Fixed
SAP’s February 2026 Security Patch Day delivered fixes that SAP urges customers to prioritize to reduce exposure across core enterprise workloads. The release includes 26 new SAP Security Notes and one update to a previously published note. SAP’s monthly bulletin is a remediation guide for vulnerabilities identified in SAP products, with an explicit recommendation to […] The post SAP Security Patch Day – Critical SAP CRM and SAP S/4HANA Code Injection Vulnerabilities Fixed appeared fi...| Cyber Security News
ILOVEPOOP Toolkit Exploiting React2Shell Vulnerability to Deploy Malicious Payload
The cybersecurity sector has been impacted by the sudden appearance of “React2Shell” (CVE-2025-55182), a critical vulnerability affecting Next.js and React Server Components. Following its public disclosure on December 4, 2025, threat actors mobilized with alarming speed, launching exploitation attempts against internet-facing systems within just 20 hours. The flaw allows unauthenticated attackers to execute arbitrary code […] The post ILOVEPOOP Toolkit Exploiting React2Shell Vulnerabil...| Cyber Security News
TeamPCP Industrializes Cloud Misconfigurations Into a Self-Propagating Cybercrime Platform
TeamPCP, also known as PCPcat, ShellForce, and DeadCatx3, emerged in December 2025 as a sophisticated cloud-native threat actor targeting exposed Docker APIs, Kubernetes clusters, Ray dashboards, Redis servers, and React2Shell vulnerabilities. The group launched a massive campaign designed to build a distributed proxy and scanning infrastructure at scale, then compromise servers to exfiltrate data, deploy […] The post TeamPCP Industrializes Cloud Misconfigurations Into a Self-Propagating Cy...| Cyber Security News
APT36 Hacker Group Attacking Linux Systems with New Tools to Disturb Services
APT36 and SideCopy continue spying on Indian govt and defense, using phishing and weaponized files to deploy Geta RAT on Windows systems.| Cyber Security News
ValleyRAT Mimic as LINE Installer Attacking Users to Steal Login Details
ValleyRAT malware is spread via fake LINE installers, targeting Chinese users with stealthy loaders to steal credentials and evade detection.| Cyber Security News
Attackers Hijacked 200+ Websites Exploiting Magento Vulnerability to Gain Root-level Access
Magento stores worldwide were breached after attackers exploited CVE-2025-54236 to reuse session tokens and gain full system control.| Cyber Security News
CISA Warns of FortiCloud SSO Authentication Bypass Vulnerability Exploited in Attacks
CISA has issued a warning about a critical authentication bypass vulnerability in multiple Fortinet products, actively exploited in the wild.| Cyber Security News
Fortinet Disables FortiCloud SSO Following 0-day Vulnerability Exploited in the Wild
Fortinet temporarily disabled its FortiCloud Single Sign-On (SSO) service after confirming active exploitation of a zero-day authentication bypass vulnerability in multiple products.| Cyber Security News
Instagram, Facebook, and WhatsApp to Test New Premium Subscriptions
Meta is gearing up to roll out premium subscription tiers across its flagship apps, Instagram, Facebook, and WhatsApp, offering users exclusive features to boost productivity, creativity, and AI-driven interactions.| Cyber Security News
New Malware Toolkit Sends Users to Malicious Websites While the URL Stays the Same
Stanley browser malware shows fake sites while keeping real URLs, tricking users into stealing logins and financial data.| Cyber Security News
48M Gmail, 6.5M Instagram Exposed Online From Unprotected Database
A huge unsecured database exposing 149 million stolen logins was discovered online, endangering users across major platforms.| Cyber Security News
U.S Community Health Center Hacked - 1 Million Patients Data Stolen
Community Health Center, Inc. (CHC), a Connecticut-based federally qualified health center, has disclosed a data breach following a criminal cyberattack on its systems.| Cyber Security News
Hackers Use ‘rn’ Typo Trick to Impersonate Microsoft and Marriott in New Phishing Attack
A sophisticated "homoglyph" phishing campaign targeting customers of Marriott International and Microsoft. Attackers are registering domains that replace the letter "m" with the combination "rn" (r + n), creating fake websites that look nearly identical to the real ones.| Cyber Security News
Threat Actors Leverage SharePoint Services in Sophisticated AiTM Phishing Campaign
Microsoft Defender researchers have exposed a sophisticated adversary-in-the-middle (AiTM) phishing campaign targeting energy sector organizations.| Cyber Security News
MacSync macOS Infostealer Leverage ClickFix-style Attack to Trick Users Pasting a Single Terminal Command
MacSync macOS malware targets crypto users, stealing data via social engineering that tricks victims into running Terminal commands.| Cyber Security News
Cyber Security News - Computer Security | Hacking News | Cyber Attack News
Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis.| Cyber Security News
UPS Hacked - Attackers Using Smishing To Harvest Data
UPS shipping and logistics recently faced a security incident after finding an unauthorized access issue on their internal audit.| Cyber Security News
SpyCloud’s 2025 Identity Exposure Report Reveals the Scale and Hidden Risks of Digital Identity Threats
The average corporate user now has 146 stolen records linked to their identity, an average 12x increase from previous estimates.| Cyber Security News
How to Conduct a Secure Code Review - Tools and Techniques
Secure Code Review - Secure code review represents a critical security practice that systematically examines software source code to identify| Cyber Security News
Privacy Policy
Who we are Our website address is : https://cybersecuritynews.com. What personal data we collect and why we collect it Comments When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection. An anonymized string created […]| Cyber Security News
.webp)
Understanding OWASP Top 10 - Mitigating Web Application Vulnerabilities
OWASP Top 10 - The OWASP Top 10 2021 represents the most critical web application security risks facing organizations today, with significant| Cyber Security News
Securing Virtualized Environments - Hypervisor Security Best Practices
Hypervisor Security - Hypervisor security represents a critical foundation for protecting virtualized infrastructure, as a single compromise.| Cyber Security News
The Best Protected Website Builder in 2025: Which Platform Keeps Your Site Truly Safe
When choosing a website builder, most people tend to focus on the cost and ease of use. But while these are crucial, it’s important to also consider the security provided to your website.| Cyber Security News
10 Best Password Managers in 2025
10 Best Password Management Tools - 1. Google Password Manager 2. LastPass, 3. Keeper, 4. Bitwarden, 5. KeePass, 6. RoboForm, 7. NordPass| Cyber Security News
%20Server-1-1.webp)
What is Command and Control(C2) Server - A Detailed Overview
This full name is Command-and-control servers. The hackers to mainly use this communication with a target network by using the system| Cyber Security News
Social Engineering Tactics - Training Employees to Stay Safe
Social Engineering Tactics - As cybercriminals become ever more sophisticated, any organization's greatest vulnerability is its firewalls.| Cyber Security News
MuddyWater Hackers Abusing RMM Tool to Deliver Malware
MuddyWater has been observed exploiting a legitimate RMM tool, Atera Agent, to conduct a sophisticated malware delivery campaign.| Cyber Security News
Reddit to Block Internet Archive as AI Companies Have Scraped Data From Wayback Machine
Reddit has announced plans to significantly restrict the Internet Archive's Wayback Machine from indexing its platform, citing concerns that AI companies have been exploiting the archival service to circumvent Reddit's data protection policies.| Cyber Security News
Detecting And Responding To New Nation-State Persistence Techniques
Nation-state cyber threats have evolved dramatically over the past decade, with attackers employing increasingly sophisticated persistence techniques to maintain long-term access within targeted environments. These advanced persistent threats (APTs) are often orchestrated by government-backed groups with significant resources, making them particularly dangerous for critical infrastructure, government agencies, and large enterprises. This article explores the changing […]| Cyber Security News
ChatGPT Vulnerability Lets Attackers Embed Malicious SVGs & Images in Shared Chats
A critical security vulnerability in ChatGPT has been discovered that allows attackers to embed malicious SVG (Scalable Vector Graphics) and image files directly into shared conversations, potentially exposing users to sophisticated phishing attacks and harmful content.| Cyber Security News
Malware Obfuscation Techniques - A Complete Guide
Obfuscation in malware refers to disguising code to make it difficult to understand or detect. It acts as digital camouflage, allowing malicious software to blend in with legitimate processes and files.| Cyber Security News
Apple Security Update: Multiple Vulnerabilities in macOS & iOS Patched
Apple has released critical security updates for macOS Sequoia, addressing multiple vulnerabilities that could allow malicious applications to access sensitive user data.| Cyber Security News
Top 10 Best Zero Trust Security Vendors - 2025
The Best Zero-Trust Security Vendors: 1. Check Point’s SASE 2. Zscaler 3. Palo Alto Networks Prisma Access 4. Cloudflare One| Cyber Security News
What is Authentication?Types, Roles & How it Works!
Authentication is verifying a user's or system's identity. Types - Single-Factor Authentication and Two-Factor Authentication.| Cyber Security News
CryptoCore, Sophisticated Cryptocurrency Scam Attacking Users To Drain Wallets
Cryptocurrency scams have changed along with digital currencies and they now employ technological advancements like AI and deepfakes in their| Cyber Security News
PyRIT : Automated AI Toolkit For Security Professionals
A new python automation framework has been released for risk identification in generative AI. This new framework has been named "PyRIT" which| Cyber Security News
.webp)
Top 10 Vulnerabilities for Large Language Models
When considering the efficacy of large language models (LLMs) for AI training, there are a lot of factors to bear in mind.| Cyber Security News
Security measures that help protect your crypto - Cyber Security News
Over the past decade, the crypto industry has gone mainstream, achieving incredible levels of popularity. Traders have rushed to add different digital coins to their portfolios, both for diversification and lured in by the promise of profit. Over 2020 and 2021, the prices of both Bitcoin and altcoins have reached new heights, with BTC climbing […]| Cyber Security News
Massive Midnight Blizzard Phishing Attack Via Weaponized RDP Files
Threat actors impersonate trusted entities to deceive individuals into revealing sensitive information in phishing attacks.Phishing attacks.| Cyber Security News
New Attack Abusing Kerberos Delegation in Active Directory Networks
A new attack vector exploiting vulnerabilities in Kerberos delegation within Active Directory (AD) networks has been uncovered.| Cyber Security News