Author: HackWatchit

SharePoint zero-day CVE-2025-53770 actively exploited in the wild Pierluigi Paganini July 21, 2025 Microsoft warns of ongoing active exploitation of a SharePoint zero-day vulnerability, tracked as CVE-2025-53770. Microsoft warns of a SharePoint zero-day vulnerability, tracked as CVE-2025-53770 (CVSS score of 9.8), which is under active exploitation. Unfortunately, the flaw has yet to be addressed. The vulnerability is a deserialization of untrusted data in on-premises Microsoft SharePoint Server, an unauthorized attacker could exploit the vulnerability to execute code over a network. The flaw was discovered by Viettel Cyber Security via Trend Micro’s ZDI. “Microsoft is aware that an exploit for CVE-2025-53770…

Context have evolved from basic search tools to AI assistants that code, write, and research. Now they’re accessible through smartphone apps via internet APIs, putting powerful AI at everyone’s fingertips. These systems are becoming an integral part of our daily lives. People are using AI assistants for seeking advice for personal relationships, fact-checking to form opinions (though it clearly states it can make mistakes), diet plans and next holiday destinations. As more and more powerful models are launched, the question of trust arises and models are more scrutinized to make sure the responses produced by them are trustworthy and aligned…

Recent updates from the National Institute of Standards and Technology (NIST) have brought critical attention to a crucial yet often overlooked component of network security: the Domain Name System (DNS). The proposed revision to NIST Special Publication 800-81r3 signals a significant shift in how organizations should approach cybersecurity. What was once viewed as primarily a network service is now recognized as a powerful tool for defending against increasingly sophisticated cyber threats: Secure DNS is foundational to cybersecurity and a key element of zero trust architectures. DNS plays a fundamental role in how the internet functions, serving as the backbone of…

Microsoft has released emergency SharePoint security updates for two zero-day vulnerabilities tracked as CVE-2025-53770 and CVE-2025-53771 that have compromised services worldwide in “ToolShell” attacks. In May, during the Berlin Pwn2Own hacking contest, researchers exploited a zero-day vulnerability chain called “ToolShell,” which enabled them to achieve remote code execution in Microsoft SharePoint. These flaws were fixed as part of the July Patch Tuesday updates; However, threat actors were able to discover two zero-day vulnerabilities that bypassed Microsoft’s patches for the previous flaws. Using these flaws, the threat actors have been conducting ToolShell attacks on SharePoint servers worldwide, impacting over 54 organizations so far.…

Palo Alto, California, 17th July 2025, CyberNewsWire The post SquareX Collaborates with Top Fortune 500 CISOs to Launch The Browser Security Field Manual at Black Hat appeared first on Security Boulevard.

For years, decentralization was crypto’s talisman. It stood for resilience, neutrality, and openness — a system immune to capture or control. But it was overused, underdefined, and has now diluted into near-meaninglessness.Now, there is a new pretender: verification.Protocols today tout verification just as they once claimed to be decentralized. The promise is familiar: you don’t need to trust anyone — you can check for yourself. But as with decentralization, the surface claim obscures much — most users can’t verify anything in practice, and most systems aren’t designed to make that feasible.Verification Requires More Than AccessCrypto systems pride themselves on being…

Aircraft systems are getting more connected and ground operations increasingly integrated, and attackers are taking notice. They’re shifting from minor disruptions to targeting critical systems with serious intent. Any time an aircraft transmits data, whether it’s flight position updates or maintenance alerts, it is vulnerable to interception by third parties. In several recent cases, cyber incidents have grounded flights, exposed sensitive data, and led to significant financial losses. The main threat actors behind these attacks are nation-state APT groups, organized cybercriminals, and hacktivists. Cybersecurity threats to the aviation industry Industry-wide vulnerabilities: SecurityScorecard found that the aviation industry’s average cybersecurity score…

U.S. CISA adds Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities catalog Pierluigi Paganini July 20, 2025 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Fortinet FortiWeb flaw, tracked as CVE-2025-25257, to its Known Exploited Vulnerabilities (KEV) catalog. Hackers began exploiting the critical Fortinet FortiWeb flaw CVE-2025-25257 (CVSS score of 9.6) on the same day a proof-of-concept (PoC) exploit was published, leading to dozens of compromised systems. Exploitation of Fortinet’s CVE-2025-25257 began on July 11 after the PoC was published. The flaw is a SQL injection vulnerability in…

The retailer will stop the practice of matching the prices of products from rival retailers like Walmart and Amazon beginning July 28, Retail Dive reported Friday (July 18). The company has seen that shoppers “overwhelmingly price match Target and not other retailers,” a Target spokesperson told the news outlet. “We’re always working to deliver consumers outstanding value and give them confidence to choose Target, with our everyday low prices, affordable and quality-focused owned brands, incredible deals, free-to-join membership program, Target Circle, and more,” the company said. With the soon-to-be-discontinued policy, Target matches prices on identical qualifying items from Amazon and…