Wireshark 4.4.7 has been released, fixing one vulnerability (CVE-2025-5601) and eight bugs, enhancing secure network traffic analysis. It's impressive to see such a proactive approach in maintaining the tool's reliability for users. What challenges have others faced with updates like this?

MISP versions 2.4.211 and 2.5.13 have been released, addressing critical vulnerabilities like SMIME Path Traversal and enhancing search functionality and API features. The shift to token-based queries is a smart move for complex searches, improving user experience significantly.

Blitz malware has emerged as a new threat, spreading through backdoored game cheats on Telegram and leveraging AI code repositories for its command and control. It not only steals information but also drops a Monero miner. The use of Hugging Face Spaces for C2 is particularly clever.

Google's Threat Intelligence Group revealed a new vishing threat targeting Salesforce data, where attackers impersonate IT support to gain access to sensitive information. This underscores the growing sophistication of social engineering tactics—how are your teams addressing this risk?

A critical out-of-bounds write vulnerability, CVE-2025-5688, has been found in FreeRTOS-Plus-TCP, affecting versions 2.3.4 to 4.3.1. It’s triggered by long DNS names and requires an immediate upgrade to version 4.3.2. This highlights the need for detailed audits in embedded systems.

A wave of vulnerabilities in vBulletin, linked to PHP 8.1 changes, has been identified, allowing private methods to be executed by default. Exploits have already been observed, emphasizing the need for vigilant patch management. It's crucial to review your deployments now.

Unit 42 reported a DNS misconfiguration in Azure OpenAI that could have led to cross-tenant data leaks and MitM attacks. Microsoft has fixed the issue, but it highlights the need for continuous audits of cloud configurations. Subtle flaws can have big implications.

Unit 42's study reveals that LLM guardrails vary significantly in effectiveness across platforms, with blocking rates for harmful content ranging from 50% to over 90%. Role-playing tactics often bypass filters, exposing a critical gap in their design. It's essential we address this.

A new threat involves a trojanized SSH client exploiting OpenSSH on Windows, creating a backdoor via a file named "dllhost.exe." It highlights the risks of common system tools being weaponized. I'm curious how teams monitor these default binaries for malicious activity.

APT41 is using Google Calendar as a command and control mechanism through their malware "TOUGHPROGRESS," targeting sectors like government and media. This tactic highlights the clever manipulation of legitimate services for malicious purposes. Have you seen similar techniques in your work?

Adversaries are using Alternate Data Streams (ADS) in NTFS to hide malicious data within regular files, making detection challenging. Tools like PowerShell can execute binaries from these streams, posing a significant risk. It's crucial to integrate ADS awareness into defense strategies.

A recent study from SANS highlights the use of AI, like ChatGPT, in analyzing cyber attacks on a Raspberry Pi honeypot. It revealed insights into reconnaissance commands and potential data harvesting for Telegram credentials. AI's iterative input was key to refining its analysis.

Netgate has released pfSense Community Edition 2.8.0, featuring enhanced security, performance, and usability, along with critical fixes for vulnerabilities. The new PPPoE driver is particularly impressive for multi-gigabit users. Just remember to back up and follow the upgrade guide closely.

Suricata 8 has introduced the entropy keyword, enhancing threat detection by identifying high-entropy data patterns indicative of encrypted payloads. This integration of Shannon entropy is a game-changer for analysts. I'm curious to see how teams will leverage this feature in real-world scenarios.

Cybercriminals from group UNC6032 are exploiting the AI hype with fake websites that masquerade as popular AI tools, distributing malware instead. Thousands of malicious ads have reached millions on social media, highlighting how effective these platforms can be for targeted attacks.

A vulnerability (CVE-2025-5279) was found in the Amazon Redshift Python Connector, affecting versions 2.0.872 to 2.1.6, due to skipped SSL validation with the BrowserAzureOAuth2CredentialsProvider. Upgrading to 2.1.7 is crucial. It's a reminder of how small oversights can lead to big risks.

pfSense Plus is now available on the Azure Marketplace, enhancing cloud security with its robust firewall, VPN, and routing capabilities. The straightforward subscription model is a game changer, eliminating hidden fees. Have you tried it on Azure? I'd love to hear your experiences.

SVG images are emerging as a novel method for steganography, allowing hidden messages to be embedded without visual distortion. This technique leverages SVG's XML format for detailed data manipulation. It's intriguing how this could change the landscape of data concealment.

A new variant of crypto scam is exploiting greed by luring victims with fake wallet balances and requiring costly "VIP" memberships to access funds. This scheme cleverly adds hurdles to drain victims while masquerading as an opportunity. The creativity in these scams is striking.

A discussion on ethical internet scanning highlights the need for proper identification to avoid disruptions, as noted by Johannes Ullrich from SANS. Including an identification URL in probe packets is crucial for accountability. Proactive identification can foster collaboration among researchers.

Malware authors are using AutoIT scripts with multi-layer obfuscation to deliver a Remote Access Trojan, starting with "1. Project & Profit.exe." This highlights the ongoing challenge of detecting sophisticated threats. The layered approach is particularly concerning.

Android is enhancing security in 2025 with real-time protections against scams and fraud, including new in-call safeguards and AI-powered scam detection. The focus on user privacy is commendable. I'm curious how other teams are adapting to these changes.

Google has launched Advanced Protection for Android 16, enhancing security for users like journalists and public figures against sophisticated threats. Features include intrusion logging and upcoming USB protection. It's impressive how accessible top-tier security has become.

Netgate has released critical security updates for pfSense Plus 24.11 and CE 2.7.2, addressing multiple vulnerabilities including XSS and command injection. It's crucial to apply these patches to strengthen your defenses, especially with new versions on the horizon.

Unit 42 reports that Muddled Libra has evolved its tactics, expanding from telecom to financial and hospitality sectors. Their use of AI for voice spoofing in social engineering is particularly concerning. This adaptability makes them a significant threat to sensitive data environments.

Unit 42 has identified DarkCloud Stealer, an advanced info-stealer that uses obfuscated AutoIt scripts to bypass security measures. It's primarily distributed through phishing campaigns targeting government organizations. The use of AutoIt for evasion is a concerning trend in malware development.

Web scanning activity has surged, targeting the SonicWall CVE-2021-20016 vulnerability, with a tenfold increase in scans over the last two weeks. This trend highlights the persistent interest from threat actors. Monitoring specific subnets and URLs is crucial for network security.

MISP has released updates 2.4.209 and 2.5.11, enhancing security with a stateless workflow engine, improved OIDC support, and new IP tools. The collaboration at hackathon.lu 2025 really drove these changes. Excited to see how these features improve user experience and security.

Microsoft's May 2025 Patch Tuesday addresses 78 vulnerabilities, including 11 critical ones. Notably, CVE-2025-30397 is actively exploited, allowing remote code execution in Edge's IE mode. The focus on Office and Remote Desktop highlights ongoing threats that demand our attention.

Forty percent of attacks are targeting IoT devices with default passwords, leveraging an old Netgear vulnerability to deploy the Mirai/Gafgyt botnet. It's astonishing that despite ongoing awareness, default credentials remain a major security flaw in 2025.

Apple's recent update addresses 65 vulnerabilities across its ecosystem, including CVE-2025-31200, which is actively exploited via crafted audio files. Notably, older systems received essential patches too. It's intriguing to see this balance of security and legacy support in action.

A critical vulnerability (CVE-2025-31324) in SAP NetWeaver's Visual Composer Framework allows unauthenticated users to upload files, leading to full system compromise. It highlights the need for robust access control and monitoring—curious how teams are addressing this risk.

A new technique leverages steganography to embed .NET malware within bitmap resources of applications, targeting the financial and logistics sectors. The multi-stage payload delivery makes detection challenging. I'm intrigued by the subtlety of this attack flow.

The latest CIS Benchmarks update for 2025 includes revisions for Azure Kubernetes, Microsoft Intune, and Red Hat Enterprise Linux, enhancing security configurations across platforms. The unconventional use of CAPTCHA by attackers is particularly noteworthy—definitely a trend to monitor.

Unit 42 revealed an Iranian cyber espionage operation where attackers impersonated a German model agency to target dissidents and journalists. They used a fake domain and obfuscated JavaScript to collect visitor data. The sophistication of these tactics is alarming.

A recent discovery reveals "modular" malware that dynamically expands its capabilities, like a Discord RAT loading DLLs from a remote server for specific tasks. This design minimizes detection and enhances effectiveness. It's fascinating how these threats evolve on demand.

Unit 42 has revealed a targeted Lampion malware campaign against Portuguese government, finance, and transport sectors, using ClickFix lures to execute malicious PowerShell commands. The obfuscation techniques are impressive, highlighting the need for advanced detection strategies.

A newly discovered Python-based infostealer features an embedded Flask web server for phishing, enhancing traditional credential harvesting methods. It also uses antidebugging techniques and encrypts data for exfiltration via Telegram. The innovation in phishing tactics is noteworthy.

Kali Linux users may face update errors due to a missing signing key (827C8569F2518CC677FECA1AED65462EC8D5E4C5). To resolve this, manually download and install the new key. It's a reminder of the importance of robust key management in our systems. Curious how others are handling this.

A critical vulnerability (CVE-2024-7399) in Samsung's MagicINFO 9 is being exploited by the Mirai botnet, allowing remote code execution via a file upload flaw. Organizations must ensure their systems are patched. It's alarming to see Mirai adapting to exploit popular software.

UNC3944, also known as Scattered Spider, has shifted from SIM swap attacks to ransomware, impacting sectors like finance and retail. Despite a decline in activity due to law enforcement, their social engineering tactics highlight a critical vulnerability. Organizations must stay vigilant.

AWS has disclosed CVE-2025-4318, a critical input validation flaw in Amplify Studio that allows authenticated users to execute arbitrary JavaScript. Users should upgrade to version 2.20.3 immediately. It's a stark reminder of the risks posed by overlooked validation in code.

Major organizations like Co-op, Harrods, and Marks & Spencer have faced cyberattacks from Scattered Spider and DragonForce, while Ascension in the US suffered a data breach linked to Cl0p ransomware. The sophistication of these coordinated attacks is alarming and highlights evolving tactics.

Didier Stevens has launched a steganography challenge featuring a PNG image of a stegosaurus with a hidden message. Participants can decode it using his unique tools on GitHub. It's intriguing to see how steganography continues to evolve in our digital age.

The Center for Internet Security's Q1 2025 report highlights SocGholish as the leading malware, responsible for 48% of detections, primarily via malvertising. New threats like TeleGrab and VenomRAT are emerging. It's intriguing how attackers are exploiting CAPTCHA flows to deceive users.

A recent report highlights a surge in ransomware attacks targeting healthcare organizations, with a focus on exploiting vulnerabilities in outdated systems. This trend is alarming as it jeopardizes patient safety and data integrity. We need to prioritize timely updates and robust defenses.

Didier Stevens shared a guide on using format-bytes.py to decode hidden payloads in PNG images via LSB steganography. This technique can reveal embedded data, like PE files, and verify integrity with tools like file-magic.py. It's a practical approach for SOC teams to enhance detection capabilities.

Check Point's latest report reveals a surge in AI-driven phishing campaigns on the dark web, with attackers using techniques like LLM poisoning and deepfakes to undermine identity verification. It's striking how AI is both a tool for attackers and a means for defense. Curious how teams are adapting.

SocGholish remains the top malware in Q1 2025, making up 48% of detections, while newcomers like TeleGrab and VenomRAT are gaining traction. The evolving landscape highlights the need for robust defenses—especially against these persistent threats.

SonicWall devices are facing renewed web scanning activity linked to the CVE-2021-20016 vulnerability, with notable IPs probing for unauthorized access. This resurgence highlights potential patch management gaps. It's crucial for organizations to monitor traffic from these IPs.