Author: HackWatchit

Atlassian fixed critical flaws in Confluence and Crowd Pierluigi Paganini February 21, 2025 Australian software firm Atlassian patched 12 critical and high-severity flaws in Bamboo, Bitbucket, Confluence, Crowd, and Jira. Software firm Atlassian released security patches to address 12 critical- and high-severity vulnerabilities in Bamboo, Bitbucket, Confluence, Crowd, and Jira products. The most severe vulnerabilities addressed by the company are: CVE-2024-50379 – (CVSS score of 9.8) – RCE (Remote Code Execution) org.apache.tomcat:tomcat-catalina Dependency in Confluence Data Center and Server in Confluence Data Center. The flaw is a TOCTOU race condition in Apache Tomcat that allows RCE on case-insensitive file systems…

TopSec data leak: 7000+ documents expose potential Chinese government surveillance and censorship practices. Learn about the key findings and implications. A data leak from TopSec, a prominent Chinese cybersecurity firm, has exposed details about the company’s operations and its probable involvement in internet censorship for the Chinese government.  This was revealed by SentinelOne whose SentinelLABS threat research team analysed the leaked data including over 7,000 lines of work logs and code used for DevOps practices.  The data revealed scripts connecting to Chinese government hostnames, academic institutions, and news sites, suggesting TopSec’s services extend to a wide range of organizations. The…

SandboxAQ, MITRE, and The Linux Foundation’s Post-Quantum Cryptography Alliance announce RWPQC 2025, the third gathering of top minds dedicated to the intersection of cybersecurity and post-quantum cryptography (PQC). The annual event runs March 24–25, 2025, at the National Palace of Culture in Sofia, Bulgaria, providing a setting for knowledge sharing and collaboration. Coinciding with the Real World Crypto (RWC) annual conference, RWPQC 2025 brings together leading experts, policymakers, and industry pioneers to address the urgent challenges posed by quantum threats to modern encryption. It will feature research, real-world applications, and strategic discussions shaping the future of cryptographic security in the…

An Android malware app called SpyLend has been downloaded over 100,000 times from Google Play, where it masqueraded as a financial tool but became a predatory loan app for those in India. The app falls under a group of malicious Android applications called “SpyLoan,” which pretend to be legitimate financial tools or loan services but instead steal data from devices for use in predatory lending. These apps lure users with promises of quick and easy loans, often requiring little documentation and offering attractive terms. However, upon installation, they request excessive permissions, allowing the apps to steal personal data such as contacts,…

Be sure to read PART 1! Metadata and a New-Fashioned Bank Robbery Let’s face it, some cases are just more interesting than others and, when you do incident response for a living, you’ve got to find joy in your work where you can. Sometimes, after the initial call with a customer, you just want the case. You’d almost do it for free (we don’t suck at capitalism quite that much!) because of the allure, the mystery, the challenge. This was one of those cases. The customer was a financial services institution with locations throughout the United States, highly regulated, with…

Versa releases Versa Sovereign SASE, allowing enterprises, governments, and service providers to deploy customized networking and security services directly from their own infrastructure in a “do-it-yourself” model. This approach addresses the growing demand for greater control amidst evolving data privacy regulations, heightened security threats, and challenges posed by reliance on third-party SaaS infrastructure. The benefits of Versa Sovereign SASE include: Increased privacy and control – The isolated and customizable solution allows organizations to build and manage their SASE environment on their own infrastructure, ensuring greater autonomy and data protection. Reduced risk of service disruption –Elimination of operational risks and costs…

You crack open your credit card statement and something seems … off. Maybe it’s a couple of small online purchases that make you think, “Hmm, that’s strange.” Or maybe a statement shows up in your mailbox — one for a card that you don’t own at all. That calls for a huge “What the heck???” Sure enough, you’re looking at cases of identity fraud and theft. And there’s a difference between identity fraud and identity theft. It’s subtle. And because of that, they often get used interchangeably. Each one can really sting but in different ways. Identity fraud is… When…

A newly identified threat activity cluster leveraged the already-patched Check Point vulnerability CVE-2024-24919 (fixed in May 2024) to deploy ShadowPad. Reports indicate that, in a small number of cases, this initial infection also resulted in the deployment of NailaoLocker ransomware. No new vulnerability was exploited—only the previously disclosed and patched one. Customers who have not yet implemented the patch should follow the instructions here. This will prevent attackers from getting VPN credentials, which is the first step in the infection chain. The campaign targeted various organizations, mainly in Europe, Africa, and the Americas. The most targeted sector was manufacturing. Check…

Are You Aware of the Risks Associated with Secrets Sprawl? You understand the inherent risks associated with secrets sprawl. You have likely dealt with serious repercussions due to lack of visibility and poor secrets lifecycle management, experiencing firsthand how these scenarios can lead to grave security breaches. But have you ever paused to think how much an effective secrets sprawl control could make you feel relieved? A new concept has emerged that offers a compelling solution to these challenges: Non-Human Identities (NHIs) and Secrets Security Management. This methodology focuses on the end-to-end protection of NHIs and their associated secrets, providing…