Author: HackWatchit

A new report by VulnCheck exposes a critical command injection flaw (CVE-2025-53652) in the Jenkins Git Parameter plugin. Find out how this vulnerability, initially rated as medium, could allow hackers to achieve remote code execution and compromise thousands of unauthenticated Jenkins servers. A new security analysis from the firm VulnCheck has revealed that a vulnerability in the popular Jenkins automation server is more dangerous than previously thought. The flaw, officially identified as CVE-2025-53652, was initially rated as a medium-level threat but has been found to allow for a severe type of attack known as command injection. This could potentially let…

Software as a Service (SaaS) is the prevalent software distribution model in the tech industry. Whether you are a young startup founder or a mature business owner, ensuring a robust security posture within the system is crucial. Moreover, privacy regulations and compliance requirements necessitate the need for a strict approach towards security in a SaaS organization. SaaS systems typically consist of multiple components and overall system security involves many aspects. Top considerations include effective identity and access control policies, data security, monitoring, compliance and privacy policies. Authentication and Authorization Authentication and authorization form the backbone of security in SaaS applications.…

Cybercriminals are getting better at lying. That’s the takeaway from a new LevelBlue report, which outlines how attackers are using social engineering and legitimate tools to quietly move through environments before they’re caught. Data showing at what stage an incident was detected (Source: LevelBlue) In that short window, the number of customers affected by security incidents nearly tripled. The rate jumped from 6 percent in late 2024 to 17 percent in early 2025. More than half of those incidents began at the initial access stage. Once attackers were in, they moved quickly. The average time between compromise and lateral movement…

The Salt team has spent the last 5-10 years producing blogs, comparison documents and webinars which highlight our credentials versus consumer apps. To get the message across we frequently reference real-life issues our customers have faced – without naming the customer in order to protect their reputation. However, several recent events have done such a great job at highlighting the dangers of using consumer messaging apps for sensitive discussions that I feel like taking the rest of the week off in order to enjoy some Spring sunshine. But before I go… On Monday 24th March 2025, the Atlantic ran a story,…

Major banks are adopting public blockchains at an accelerating pace. Financial institutions are moving beyond pilot programs on private networks to live deployments on permissionless blockchains. Today, major financial institutions are issuing stablecoins and tokenizing real world assets (stocks, bonds, ect.) directly on public blockchains . Stablecoin transaction volumes now exceed the combined throughput of Visa and Mastercard, marking blockchain’s emergence as the new backbone of digital payments infrastructure. Bringing enterprise security to Cardano mainnet This massive growth comes with its set of security challenges. Institutions can’t interact safely with public blockchains, which have become increasingly adversarial environments. There’s a…

In this Help Net Security video, Ngaire Elizabeth Guzzetti, Technical Director Supply Chain at CyXcel, discusses why a third of U.S. organizations don’t trust third-party vendors to manage critical risks and what that means for supply chain security. She breaks down the root causes of this trust gap, including poor visibility, inadequate governance, and the growing complexity introduced by AI. Guzzetti also shares practical guidance for building more resilient vendor relationships through tiered oversight, continuous monitoring, and co-resilience strategies.

Why Do We Talk So Much About Muddled Libra? Many articles and presentations have covered the tactics, techniques and procedures of the group that Unit 42 tracks as Muddled Libra. Known for social engineering tactics, the group recently attacked organizations in industries including government, retail, insurance and aviation. There’s an undeniable impact for the group’s victims, but I’ve also been pondering why this group seems to receive more media attention than other groups that also partner with Ransomware-as-a-Service (RaaS) programs. There are other affiliates that heavily target English-speaking countries, and that are just as fast and impactful. Reading Trend 3…

The U.S. Federal Judiciary confirms that it suffered a cyberattack on its electronic case management systems hosting confidential court documents and is strengthening cybersecurity measures. The organization stated that, while most documents in the system are public, certain sealed filings contain sensitive information that is now protected with stricter access controls aimed at blocking hackers. “The federal Judiciary is taking additional steps to strengthen protections for sensitive case documents in response to recent escalated cyberattacks of a sophisticated and persistent nature on its case management system,” reads the announcement. “The Judiciary is also further enhancing security of the system and…

Context using Large Language Models (LLMs), In-Context Learning (ICL), where input and output are provided to LLMs to learn from them before handling the next input, has proven to be very effective in guiding the LLM in the right direction. Multiple ICL strategies have been developed. Some popular ones are one-shot (provide one example), few-shot (provide multiple examples), chain-of-thought (showing step-by-step reasoning in examples) …etc. Let’s take a simple example to better understand in-context learning. When you ask a LLM, “What animal makes the sound ‘moo’ and what is its type?” you might be expecting an answer as “Cow, mammal.” But…