Author: HackWatchit
Finite State, vendor of software supply chain security for connected devices, announced on Tuesday its expansion into the Europe, Middle East, and Africa (EMEA) region with the formation of a dedicated team. The move underscores Finite State’s commitment to supporting manufacturers and suppliers in navigating the evolving regulatory landscape and strengthening product security. The establishment of the EMEA team comes in response to significant market drivers, including the European Union’s Cyber Resilience Act(CRA), NIS 2, and the Radio Equipment Directive (RED), which are reshaping the cybersecurity requirements for connected devices. By expanding its presence in EMEA, Finite State is positioned…
Words of dissent and support for former CISA director Chris Krebs are starting to emerge from a cybersecurity industry that has mostly kept quiet in the wake of President Trump’s move to remove security clearances from Krebs and his current employer, SentinelOne, and to order the Justice Department (DOJ) to launch investigations into him, his company, and CISA.In recent days, the Electronic Frontier Foundation urged others in the cybersecurity space to speak out against the president’s April 9 memorandum, with Eva Galperin, EFF’s director of cybersecurity, and Jason Kelley, its activism director, writing that “it is critically important for us…
Critical Apache Roller flaw allows to retain unauthorized access even after a password change Pierluigi Paganini April 15, 2025 A critical flaw (CVE-2025-24859, CVSS 10) in Apache Roller lets attackers keep access even after password changes. All versions ≤6.1.4 are affected. A critical vulnerability, tracked as CVE-2025-24859 (CVSS score of 10.0), affects the Apache Roller open-source, Java-based blogging server software. The flaw is a session management issue that impacts in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. An attacker could exploit the flaw to retain unauthorized access even after a password change. The…
American car rental company Hertz has suffered a data breach linked to last year’s exploitation of Cleo zero-day vulnerabilities by a ransomware gang. The breach resulted in information of an unknown number of customers of Hertz and Hertz’s subsidiaries Dollar and Thrifty to be compromised. Hertz data breach notifications “Cleo is a vendor that provides a file transfer platform used by Hertz for limited purposes,” the company shared – though it did not specify what those limited purposes were. “On February 10, 2025, we confirmed that Hertz data was acquired by an unauthorized third party that we understand exploited zero-day…
We’ve spent months analyzing how AI-powered coding assistants like GitHub Copilot handle security risks. The results? Disturbing. The Hidden Risks of AI Code Assistants GitHub Copilot is marketed as a productivity tool for developers, helping them write code faster. However, our vulnerabilities researcher, Fufu Shpigelman, uncovered vulnerabilities that expose a fundamental flaw: guardrails that rely solely on filtering user prompts are easily bypassed. Attackers don’t need complex exploits—they just need the right words. Affirmation Jailbreak: A Single Word Unlocks Dangerous Code One of the most surprising vulnerabilities we found was what we call the Affirmation Jailbreak. By starting a query with…
ATS (Applicant Tracking Software or Applicant Tracking Systems) is one of the most misunderstood concepts in modern-day hiring. And this misunderstanding might be costly for you as a candidate. Most companies use ATS to sort through applications — that’s common knowledge and a fact. But ATS isn’t just some robot gatekeeper rejecting resumes like a lot of hiring gurus would have you believe. It’s also a tool that helps recruiters stay organized, search for specific qualifications, and prioritize candidates. That means that an ATS-friendly resume doesn’t just help you “beat the system” — it makes it easier for recruiters to…
It started over 16 years ago. Cisco Secure Client, then known as AnyConnect, quickly rose to prominence as the go-to VPN solution for organizations worldwide. It became synonymous with reliable, secure remote connectivity, helping businesses bridge the gap between their teams and the resources they needed. But technology never stands still. As threats evolved and workforces became more dynamic, so did Cisco Secure Client. Over the years, it transformed from a trusted VPN client into a multifaceted security tool, offering a range of advanced services through its modular design. Its ability to adapt to modern demands made it an indispensable…
John Strand // Ok, that was a bit of a dramatic title. But, it works. In this Black Hills Information Security (BHIS) webcast, John covers the tips and tricks on how to effectively present technical topics to large and small groups. This presentation includes, but is not limited to: crotch sniffing dogs, heart attacks, how to effectively deal with chafing, don’t drink the water, choosing the right shoes, presenting to management, seriously, chafing is a problem, chickens, getting over impostor syndrome, becoming a PowerPoint ninja, every piece of presenting advice you have ever heard is wrong, using your podium as…
Security and privacy advocates are girding themselves for another uphill battle against Recall, the AI tool rolling out in Windows 11 that will screenshot, index, and store everything a user does every three seconds.When Recall was introduced in May 2024, security practitioners roundly castigated it for creating a gold mine for malicious insiders, criminals, or nation-state spies if they managed to gain even brief administrative access to a Windows device. Privacy advocates warned that Recall was ripe for abuse in intimate partner violence settings. They also noted that there was nothing stopping Recall from preserving sensitive disappearing content sent through…