Author: HackWatchit

The Dutch National Cyber Security Centre (NCSC-NL) confirmed a sophisticated cyberattack that breached multiple Dutch critical organizations, exploiting a vulnerability with the characteristic CVE-2025-6543 in Citrix NetScaler. Since detecting the exploitation of the Citrix vulnerability on July 16, the NCSC has carried out extensive investigations. However, significant uncertainty remains over which organizations have been compromised, whether the threat actor is still active, and the full extent of the attack’s impact. The NCSC identifies the attacks as the work of one or more actors using sophisticated methods. For example, the vulnerability was exploited as a zero-day vulnerability, and traces were actively…

A recent report from the Department of Justice Inspector General warns that several recent compromises involving “ubiquitous technical surveillance” (UTS), the distributed collection and analysis of data, including call logs, phone geolocation data, and payment information have put agents and investigations in the cross-hairs of criminals and state actors. Per the report, “the FBI is aware of prior and ongoing UTS compromises that have impacted FBI operations, threatened the safety of its sources, and are currently being used by adversaries to challenge the United States Government on a global scale. Some within the FBI and partner agencies like the CIA have…

The National Institute of Standards and Technology (NIST) has finalized a lightweight cryptography standard to protect even the smallest networked devices from cyberattacks. Published as Ascon-Based Lightweight Cryptography Standards for Constrained Devices (NIST Special Publication 800-232), the standard offers tools for securing data created and transmitted by billions of IoT devices, along with other small electronics such as RFID tags and medical implants. These technologies often have far less computing power than smartphones or laptops, yet still need strong protection. Lightweight cryptography is designed for these resource-limited environments. “We encourage the use of this new lightweight cryptography standard wherever resource…

A poisoned Google Calendar invite that can hijack your smart home, a man is hospitalised after ChatGPT told him to season his food with… pesticide, and some thoughts on Superman’s latest cinematic outing. All this and more is discussed in the latest edition of the “Smashing Security” podcast by cybersecurity veterans Graham Cluley, joined this week by special guest Dave Bittner from The Cyberwire. Warning: This podcast may contain nuts, adult themes, and rude language. Host: Graham Cluley:  @grahamcluley.com  @[email protected] Guest: Dave Bittner:  @[email protected] Episode links: Sponsored by: Proton – Break free from Gmail. You should be able to choose…

Google Gemini’s one of the most powerful features is Deep Research, but up until now, it has been strictly limited to the Gemini interface. This could change soon. With Deep Research in Gemini, you can search about pretty much anything, including scholars, existing research papers, and more. Google describes Deep Research as an agentic Research Assistant that can browse up to hundreds of websites on your behalf, think through its findings, and create insightful multi-page reports in minutes. “With the Gemini 2.5 model, Deep Research is even better at all stages of research, from planning to delivering even more insightful…

There are a few universal rules that apply in the ongoing cybersecurity arms race between attackers and security companies. The first, and most important rule, is that technological evolution that boosts the ability of threat actors to execute their attacks also enhances the effectiveness of cybersecurity tools. Looking at the last three years of AI and machine learning development is proof of this, because as attackers leverage AI to create new methods to infiltrate and exploit their targets, those same models are making threat detection and prevention more efficient than ever. Agentic AI, or autonomous AI, is widely considered the…

Kaspersky reports Efimer Trojan infecting thousands, swapping crypto wallets, brute-forcing sites, and spreading through torrents and phishing. Cybercriminals are getting more creative with their scams, and the latest example comes from a malware operation known as Efimer. First spotted by Kaspersky in October 2024 and still active and spreading in 2025, the Trojan has been stealing cryptocurrency, spreading through hacked WordPress sites, torrents and targeted phishing emails. Phishing Emails Posing as Legal Notices The phishing emails in the most recent campaign pretend to come from lawyers at a large company, warning recipients that their domain name violates trademarks. The message…

discuss how you can perform automatic evaluations using LLM as a judge. LLMs are widely used today for a variety of applications. However, an often underestimated aspect of LLMs is their use case for evaluation. With LLM as a judge, you utilize LLMs to judge the quality of an output, whether it be giving it a score between 1 and 10, comparing two outputs, or providing pass/fail feedback. The goal of the article is to provide insights into how you can utilize LLM as a judge for your own application, to make development more effective. This infographic highlights the contents…

Critical FortiSIEM flaw under active exploitation, Fortinet warns Pierluigi Paganini August 13, 2025 Fortinet warns of a critical FortiSIEM vulnerability, tracked as CVE-2025-25256, that is actively exploited in attacks in the wild. Fortinet warns customers of a critical vulnerability, tracked as CVE-2025-25256 (CVSS score of 9.8), affecting FortiSIEM for which an exploit exists in the wild. Fortinet gave no details about the exploit, noting it leaves no clear Indicators of Compromise (IoCs). The flaw is an OS command injection flaw that could allow unauthenticated attackers to run arbitrary code or commands via crafted CLI requests. “An improper neutralization of special elements…