Author: HackWatchit

Zoom patches critical Windows flaw allowing privilege escalation Pierluigi Paganini August 14, 2025 Zoom fixed a critical Windows client flaw (CVE-2025-49457, CVSS 9.6) involving an untrusted search path that could enable privilege escalation. Cloud-based video conferencing and online collaboration platform Zoom addressed a critical security flaw, tracked as CVE-2025-49457 (CVSS score of 9.6) in Zoom Clients for Windows. An unauthenticated user can exploit the vulnerability to conduct an escalation of privilege via network access. “Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.” reads the advisory…

The second Trump administration has its first federal cybersecurity debacle to deal with.A breach of the United States federal judiciary’s electronic case filing system, discovered around July 4, has pushed some courts onto backup paper-filing plans after the hack compromised sealed court records and possibly exposed the identities of confidential informants and cooperating witnesses across multiple US states.More than a month after the discovery of the breach—and in spite of recent reports from The New York Times and Politico that Russia was involved in perpetrating the hack—it is still unclear exactly what happened and which data and systems were affected.Politico…

Two vulnerabilities (CVE-2025-8875, CVE-2025-8876) in N-central, a remote monitoring and management (RMM) solution by N-able that’s popular with managed service providers, are being exploited by attackers. There are no public reports of exploitation, but the confirmation came from the US Cybersecurity and Infrastructure Security Agency (CISA), which added the flaws to its Known Exploited Vulnerabilities catalog and ordered US federal civilian agencies to mitigate them within a week. About the vulnerabilities (CVE-2025-8875, CVE-2025-8876) N-able N-central is used by managed service providers (MSPs) and IT teams to keep track of, update, and secure large fleets of endpoints from a central dashboard.…

Microsoft has resolved a known issue preventing the August 2025 Windows 11 24H2 cumulative update from being delivered via Windows Server Update Services (WSUS). Introduced almost twenty years ago, WSUS helps IT administrators defer, approve, and schedule updates for Microsoft products on enterprise networks from a single local update server, rather than having each endpoint update from Redmond’s servers. Microsoft confirmed the known issue yesterday evening, one day after widespread reports from Windows administrators regarding 0x80240069 errors when installing the Windows 11 24H2 KB5063878 update. Those affected also reported finding new entries in the Windows Event Log, which included “Service…

Fake Minecraft clone Eaglercraft 1.12 Offline spreads NjRat spyware stealing passwords, spying via webcam and microphone, warns Point Wild security team. Point Wild’s Lat61 Threat Intelligence Team has uncovered a new cyber threat targeting fans of the popular game Minecraft. Malware disguised as a Minecraft installer is infecting computers, allowing hackers to steal personal data. This research provided to Hackread.com by Point Wild should not come as a surprise, as in 2021, Minecraft was already declared the most malware-infected game ever. As for the ongoing threat, the malware is hidden inside an unofficial browser-based Minecraft clone called Eaglercraft 1.12 Offline,…

weaving its way into the spotlight over the past few years, as organizations try to find alternatives to centralized data architectures. I’ve had a front-row seat to watch early adopter teams come to grips with this paradigm shift. I’ll highlight some of early adopter realities that come with being early to the Mesh party. Over the past few months, I’ve stitched together insights from several conversations with Data Mesh practitioners to see if our threads align. This post highlights the main observations that I see in real implementations.  What is Data Mesh? For these early adopter insights to resonate with you,…

In an era where billions of connected devices form the nervous system of critical infrastructure, embedded IoT systems have become prime targets for cybercriminals, particularly given their enormous collective attack surface. IoT Analytics projects that the number of connected IoT devices will reach 18.8 billion by the end of 2024, up from approximately 16.6 billion.. The post Rethinking Embedded IoT Security: Why Traditional IT Protections Fall Short appeared first on Security Boulevard.

U.S. CISA adds Microsoft Internet Explorer, Microsoft Office Excel, and WinRAR flaws to its Known Exploited Vulnerabilities catalog Pierluigi Paganini August 14, 2025 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Internet Explorer, Microsoft Office Excel, and WinRAR flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Microsoft Internet Explorer, Microsoft Office Excel, and WinRAR flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws: CVE-2013-3893 Microsoft Internet Explorer Resource Management Errors Vulnerability CVE-2007-0671 Microsoft Office Excel Remote Code Execution Vulnerability CVE-2025-8088 RARLAB WinRAR Path Traversal Vulnerability CVE-2013-3893 – The flaw…

Since its launch last October, Beluga has become one of the leading platforms for educating users on the best projects in crypto. Beluga’s investors include many of the top crypto and FinTech VCs as well as key execs from Coinbase, Ripple, Kraken, Blockchain, MoonPay, etc. Essentially, Beluga is trying to become “The NerdWallet for Crypto”, which is much needed as users can’t keep up with the latest in crypto. The site has been getting great traction and their free newsletter already has 100K subscribers with its tagline “We live and breathe crypto, so you don’t have to.” The site is…