Author: HackWatchit

Chennai, India, July 25th, 2025, CyberNewsWire xonPlus, a real-time digital risk alerting system, officially launches today to help security teams detect credential exposures before attackers exploit them. The platform detects data breaches and alerts teams and systems to respond instantly. Built by the team behind XposedOrNot, an open-source breach detection tool used by thousands, xonPlus gives organizations instant visibility when their email addresses or domains appear in breach dumps or dark web forums. Every day, credentials are exposed in data breaches, often without the affected organizations being immediately aware. In many cases, security teams are first alerted to incidents through…

Application-layer attacks have become one of the most common and consequential methods adversaries use to gain access and compromise organizations, according to Contrast Security. These attacks target the custom code, APIs, and logic that power applications, often slipping past detection tools such as Endpoint Detection and Response (EDR) and network-based defenses such as Web Application Firewalls (WAFs). The average application is targeted by attacks more than 14,000 times each month (Source: Contrast Security) Enterprise security’s risk lies in the application layer Recent reports from Verizon (DBIR 2025) and Google Mandiant (M-Trends 2025) confirm what many security leaders already suspect: components…

Stealth backdoor found in WordPress mu-Plugins folder Pierluigi Paganini July 24, 2025 A new stealth backdoor has been discovered in the WordPress mu-plugins folder, granting attackers persistent access and control over compromised sites. Sucuri researchers found a stealthy backdoor hidden in WordPress’s “mu-plugins” folder. These plugins auto-run and allow attackers to stay hidden in admin, and maintain persistence. “must-use plugins” are special WordPress plugins that cannot be deactivated from the WordPress admin panel.The experts found a malicious PHP file (“wp-index.php”) in the mu-plugins folder acting as a loader. It fetches an obfuscated (ROT13) payload, then stores it in the WordPress…

Never miss a new edition of The Variable, our weekly newsletter featuring a top-notch selection of editors’ picks, deep dives, community news, and more. Fine-tuning? RAG? Chain-of-thought? We suspect that for many of our readers, these LLM-optimization approaches—as relevant as they might still be—feel a tad stale.   If you’d like to catch up on cutting-edge topics in the sprawling world of large language models, read on. This week’s Variable highlights three recent articles that will help you create powerful LLM workflows and overcome emerging challenges. How to Create an LLM Judge That Aligns with Human Labels Evaluating the quality of LLM outputs…

BforeAI today disclosed the discovery of a phishing campaign that is leveraging the same core infrastructure to spoof multiple domains. The post BforeAI Identifies Phishing Campaign Using Same Infrastructure Across Multiple Domains appeared first on Security Boulevard.

What If Crypto Spoke Your Language? Crypto has long claimed to be global. But for many users in Spain and Catalonia, accessing crypto services still means operating in English, a language barrier that excludes many potential users. This week, Barcelona-based startup Venga is attempting to fix that. Venga has become the first crypto app to offer its entire user interface in both Spanish and Catalan, in addition to English. But this is not just a language update, it is the public release of a product designed from the ground up for local, multilingual communities.And behind the language is a fully…

Insurance company Allianz Life has confirmed that the personal information for the “majority” of its 1.4 million customers was exposed in a data breach that occurred earlier this month. “On July 16, 2025, a malicious threat actor gained access to a third-party, cloud-based CRM system used by Allianz Life Insurance Company of North America (Allianz Life),” an Allianz Life spokesperson told BleepingComputer. “The threat actor was able to obtain personally identifiable data related to the majority of Allianz Life’s customers, financial professionals, and select Allianz Life employees, using a social engineering technique.” “We took immediate action to contain and mitigate…

What if after finishing a meeting with a colleague you would already have all your discussed items in your project-management tool? No need for writing anything down during the meeting, nor to manually create corresponding tickets! That was the thought of this short experimental project. In this step-by-step guide we will create the Python application “TaskPilot” using OpenAI’s Agents SDK to automatically create Jira issues given a meeting transcript. The Challenge: From Conversation to Actionable Tasks Given the transcript of a meeting, create issues in a Jira project automatically and corresponding to what was discussed in the meeting. The Solution:…

In April 2025, Hackread.com exclusively reported that the Medusa ransomware group had claimed responsibility for breaching the National Association for Stock Car Auto Racing (NASCAR) and was demanding a $4 million ransom. NASCAR has now confirmed that its systems were indeed compromised, validating Hackread.com’s earlier reporting. Medusa Ransomware’s dark web leak site (Credit: Hackread.com) According to the data breach notification filed with the Office of the Maine Attorney General, the incident occurred on March 31, 2025, and was discovered on June 24, 2025. However, Hackread.com had alerted NASCAR about Medusa’s breach claims on April 8, 2025, but the company neither…