Aggregator

微软本周宣布裁员逾九千人，其中 XBox 游戏业务深受影响，有工作室被关闭，多个游戏项目被取消。对此情况，XBox 高管 Matt Turnbull 提出了一项建议：被裁的员工应该用 AI 管理情绪。他的建议发表在 LinkedIn 上，帖子已删除，但内容已被人保存了下来。他表示自己已经试验用 LLM AI 工具（如 ChatGPT 或 Copilot）帮助减少失业带来的情绪和认知负担，称如果不尽力提供最好的建议将是自己的失职。

Cybercriminals are exploiting the economic uncertainty and remote work trends to orchestrate sophisticated employment fraud schemes, with victims losing over $264 million in 2024 alone according to FBI reports. These malicious campaigns, known as “task scams,” represent a rapidly evolving threat landscape where fraudsters weaponize legitimate job-seeking behavior to extract cryptocurrency payments from unsuspecting victims […]

The post Threat Actors Turning Job Offers Into Traps, Over $264 Million Lost in 2024 Alone appeared first on Cyber Security News.

Instagram has adopted an unprecedented approach to web security by implementing daily rotation of TLS certificates that maintain validity periods of just one week, according to a recent technical analysis.  This practice represents a significant departure from industry standards, where certificates typically remain valid for 90 days or longer, suggesting a strategic shift toward enhanced […]

The post Instagram Started Using 1-Week Validity TLS Certificates and Changes Them Daily appeared first on Cyber Security News.

A significant security vulnerability has been discovered in Lenovo’s preloaded Windows operating systems, where a writable file in the Windows directory enables attackers to bypass Microsoft’s AppLocker security framework.  The issue affects all variants of Lenovo machines running default Windows installations and poses serious implications for enterprise security environments. The vulnerability centers around the MFGSTAT.zip […]

The post Writable File in Lenovo’s Windows Directory Enables a Stealthy AppLocker Bypass appeared first on Cyber Security News.

A sophisticated phishing campaign targeting UK citizens has emerged, masquerading as official communications from the Department for Work and Pensions (DWP) to steal sensitive financial information. The campaign, which has been active since late May 2025, represents a significant escalation in social engineering attacks against British residents, exploiting concerns about government benefits and seasonal allowances. […]

The post New Phishing Attack Impersonates as DWP Attacking Users to Steal Credit Card Data appeared first on Cyber Security News.

XWorm has emerged as one of the most versatile and actively distributed remote access trojans in the current threat landscape, establishing itself as a formidable tool in cybercriminals’ arsenals. This sophisticated malware has evolved far beyond traditional RAT capabilities, incorporating advanced features including keylogging, remote desktop access, data exfiltration, and command execution that make it […]

The post XWorm – The Most Active RAT Uses New Stagers and Loaders to Bypass Defenses appeared first on Cyber Security News.

Currently trending CVE - Hype Score: 23 - An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device

A vulnerability, which was classified as critical, was found in libopensc. This affects an unknown part of the component OpenPGP Driver. The manipulation leads to heap-based buffer overflow. This vulnerability is uniquely identified as CVE-2024-8443. The attack can only be initiated within the local network. There is no exploit available.

A vulnerability has been found in WellinTech KingView up to 65.30.17249 and classified as critical. This vulnerability affects unknown code. The manipulation leads to memory corruption. This vulnerability was named CVE-2012-1831. The attack can be initiated remotely. Furthermore, there is an exploit available.

Cybersecurity researchers have uncovered a concerning development as malicious actors began exploiting SHELLTER, a commercial anti-virus and endpoint detection response (EDR) evasion framework, to deploy sophisticated malware payloads. Originally designed for legitimate penetration testing operations, this framework has been weaponized by cybercriminals since late April 2025, marking a significant escalation in evasion capabilities available to […]

The post Threat Actors Abused AV – EDR Evasion Framework In-The-Wild to Deploy Malware Payloads appeared first on Cyber Security News.

A vulnerability has been found in Qualcomm Eudora up to 6.1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Attachment Filename Handler. The manipulation with the input <filename>. leads to path traversal. This vulnerability is known as CVE-2002-2351. The attack can be launched remotely. Furthermore, there is an exploit available.

关键词黑客据彭博社 2 日报道，一名自称于今年 6 月入侵哥伦比亚大学的黑客向媒体提供数据，显示大量涉及学生和

关键词网络攻击据日媒 ITMedia News 今日报道，运营日本爱知全县初中模拟考试的机构“学悠出版”通报，

关键词漏洞据最新消息，一款广泛应用于二十余款音频设备的蓝牙芯片被发现存在安全漏洞，黑客可以利用这些漏洞进行窃听

Cybersecurity threats have emerged so quickly that most companies struggle to keep up and executives are often the…

A vulnerability, which was classified as critical, was found in WellinTech KingView up to 65.30.17249. This affects an unknown part. The manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2012-1830. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability, which was classified as problematic, was found in libssh up to 0.11.1. This affects the function ssh_kdf. The manipulation leads to incorrect calculation. This vulnerability is uniquely identified as CVE-2025-5372. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Tenable Nessus up to 10.8.4 on Windows. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to improper privilege management. This vulnerability is known as CVE-2025-36630. Attacking locally is a requirement. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Cisco Unified Communications Manager and Unified Communications Manager Session Management Edition 15.0.1.13010-1. It has been classified as critical. This affects an unknown part. The manipulation leads to hard-coded credentials. This vulnerability is uniquely identified as CVE-2025-20309. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in libssh up to 0.11.1. Affected by this vulnerability is an unknown functionality of the component base64 Conversion Handler. The manipulation leads to memory corruption. This vulnerability is known as CVE-2025-4877. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.