Author: HackWatchit

U.S. CISA adds Fortinet FortiOS/FortiProxy and GitHub Action flaws to its Known Exploited Vulnerabilities catalog Pierluigi Paganini March 19, 2025 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiOS/FortiProxy and GitHub Action flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2025-24472 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability CVE-2025-30066 tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability In February, Fortinet warned that threat actors were exploiting a new zero-day vulnerability, tracked as CVE-2025-24472 (CVSS score of 8.1), in FortiOS and FortiProxy to hijack Fortinet firewalls. The vulnerability is an authentication bypass issue…

Bengaluru, India, March 19th, 2025, CyberNewsWire Moving Beyond Detection to Real-Time, Automated Security Across Workloads, Cloud, and Infrastructure  SecPod, a global cybersecurity provider, has announced the General Availability of Saner Cloud, a Cloud-Native Application Protection Platform designed to provide automated remediation and workload security across multi-cloud environments. Unlike conventional security solutions that focus primarily on detection, Saner Cloud integrates security using AI-driven automation to remediate threats in real-time. Security teams have long faced challenges managing disparate security solutions across cloud workloads, IT infrastructure, and endpoints, often resulting in fragmented operations and a high volume of unresolved alerts. Saner Cloud is…

Kali Linux 2025.1a is now available. This release enhances existing features with improvements designed to streamline your experience. 2025 theme refresh Kali Linux 2025.1a introduces an annual theme refresh, maintaining a modern interface. This year’s update debuts a redesigned theme aimed at enhancing the user experience from startup. Users can expect notable visual updates, including an improved boot menu, a refined login screen, and a selection of new desktop wallpapers for both Kali and Kali Purple editions. KDE Plasma 6.2 The new version of Kali introduces Plasma 6, marking a significant upgrade from the previously included Plasma 5.27. With version…

Researchers from multiple firms say that the campaign seems to come from a loosely connected ecosystem of fraud groups rather than one single actor. Each group has its own versions of the Badbox 2.0 backdoor and malware modules and distributes the software in a variety of ways. In some cases, malicious apps come preinstalled on compromised devices, but in many examples that the researchers tracked, attackers are tricking users into unknowingly installing compromised apps.The researchers highlight a technique in which the scammers create a benign app—say, a game—post it in Google’s Play Store to show that it’s been vetted, but…

The post Talkin’ About Infosec News – 9/9/2022 appeared first on Black Hills Information Security.

The principle of least privilege (PoLP), is a security measure used to protect sensitive data and systems. This principle guarantees that systems, apps, and users have the bare minimum access required to carry out their tasks. Putting the least privilege concept into practice should be a primary goal for enterprises as they strive to improve their data security.  What is the Principle of Least Privilege (PoLP)?  The principle of least privilege states that any user, program, or process should only have the minimal amount of system and network access required to carry out its purpose. Least privilege is a cybersecurity…

State-sponsored threat actors and cybercrime groups from North Korea, Iran, Russia, and China have been exploiting a zero-day Windows vulnerability with no fix in sight for the last eight years, researchers with Trend Micro’s Zero Day Initiative have warned on Tuesday. The vulnerability, which doesn’t have a CVE number but is being tracked as ZDI-CAN-25373 by ZDI researchers, allowed attackers to surreptitiously execute malicious commands on a victim’s machine and deliver a variety of malware payloads. About ZDI-CAN-25373 The attackers exploited ZDI-CAN-25373 by creating malicious .lnk (Windows shortcut) files with command line arguments embedded in their Target field. These arguments…

Cyber threat intelligence firm PRODAFT has identified two critical OS command injection vulnerabilities in mySCADA myPRO Manager, a widely used SCADA (supervisory control and data acquisition) management system. These flaws, discovered by PRODAFT’s research team, enable remote attackers to execute arbitrary commands, posing a significant risk to industrial control networks and potentially disrupting industrial operations. “These vulnerabilities, if exploited, could grant unauthorized access to industrial control networks, potentially leading to severe operational disruptions and financial losses,” PRODAFT researchers detailed in a Tuesday post. The vulnerabilities have been rated 9.3 on the CVSS v4 scoring system. They include CVE-2025-20014, which is…

A malware operation dubbed ‘DollyWay’ has been underway since 2016, compromising over 20,000 WordPress sites globally to redirect users to malicious sites. The campaign has evolved significantly in the past eight years, leveraging advanced evasion, re-infection, and monetization strategies. According to GoDaddy researcher Denis Sinegubko, DollyWay has been functioning as a large-scale scam redirection system in its latest version (v3). However, in the past, it has distributed more harmful payloads like ransomware and banking trojans. “GoDaddy Security researchers have uncovered evidence linking multiple malware campaigns into a single, long-running operation we’ve named ‘DollyWay World Domination’,” explains a recent report by Godaddy. “While previously…