Aggregator

Threat Attack Update - January 5th, 2026

Insured entities are becoming more sophisticated in their views on how cyber policies fit into their broader risk management plans.

Russia-linked APT UAC-0184 targets Ukrainian military and government bodies via Viber, delivering malicious ZIP files for espionage in 2025. Russia-linked threat actor UAC-0184 (aka Hive0156) is targeting Ukrainian military and government entities, using Viber messages to deliver malicious ZIP files as part of ongoing intelligence-gathering operations in 2025. “Recent monitoring data from the 360 ​​Advanced […]

Ransomware Attack Update - January 5th, 2026

第16期全国开源情报能力培训班将于2026年1月25日在北京开班。本次培训汇聚顶尖专家，聚焦实战需求，旨在系统提升学员的情报意识、OSINT思维与信息敏感性。

这份由美国纽约南区联邦检察官办公室于2026年1月3日提交的密封替代起诉书，指控委内瑞拉前总统尼古拉斯·马杜罗及其同谋者参与跨国毒品恐怖主义阴谋。

搞政权更迭和武装掠夺是资本主义黑帮一贯作风。

1月3日凌晨，多家国际媒体证实，美国三角洲特种部队在加拉加斯展开快速行动，抓获了委内瑞拉总统尼古拉斯·马杜罗。

A vulnerability, which was classified as critical, was found in vm2. Affected is an unknown function. Such manipulation leads to sandbox issue. This vulnerability is listed as CVE-2023-37466. The attack may be performed from remote. There is no available exploit.

A vulnerability labeled as critical has been found in masaakitanaka Booking Package Plugin up to 1.6.27 on WordPress. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to improper access controls. This vulnerability is tracked as CVE-2024-30516. The attack can be launched remotely. No exploit exists.

A vulnerability, which was classified as problematic, has been found in iPhone Webclip Manager Plugin up to 0.5 on WordPress. This impacts an unknown function of the component Setting Handler. The manipulation leads to cross-site request forgery. This vulnerability is documented as CVE-2024-53735. The attack can be initiated remotely. There is not any exploit available.

A vulnerability categorized as problematic has been discovered in Dokan Pro Plugin up to 3.14.5 on WordPress. This issue affects some unknown processing. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2025-39497. It is possible to launch the attack remotely. No exploit is available.

A vulnerability labeled as critical has been found in Entrada Plugin up to 5.7.7 on WordPress. The affected element is an unknown function. Executing a manipulation can lead to sql injection. This vulnerability appears as CVE-2025-39484. The attack may be performed from remote. There is no available exploit.

A vulnerability classified as critical was found in loginwp-pro Plugin up to 4.0.8.5 on WordPress. The impacted element is an unknown function. Executing a manipulation can lead to missing authorization. This vulnerability appears as CVE-2025-39561. The attack may be performed from remote. There is no available exploit.

A vulnerability, which was classified as critical, has been found in LoginWP Pro Plugin up to 4.0.8.5 on WordPress. This impacts an unknown function of the component Setting Handler. Performing a manipulation results in missing authorization. This vulnerability is reported as CVE-2025-46255. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability, which was classified as problematic, has been found in QNAP QuMagie up to 2.8.0. Affected by this issue is some unknown functionality. Performing a manipulation results in cross site scripting. This vulnerability is reported as CVE-2025-62857. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability labeled as critical has been found in ComfyUI-Manager up to 3.37. This issue affects some unknown processing of the component Web Interface. The manipulation results in unprotected alternate channel. This vulnerability is reported as CVE-2025-67303. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

With AI taking the top spot for 2026 government CIO priorities, what are the next-level questions that leaders must focus on regarding AI projects and trends in the new year?  

The post 10 Tough AI Questions for the 2026 Public-Sector CIO appeared first on Security Boulevard.

Are You Guarding Your Machine Identities Effectively? The management of Non-Human Identities (NHIs) is a critical component of cybersecurity strategies for organizations operating in cloud environments. NHIs, essentially machine identities, represent a fusion of encrypted credentials, such as passwords or tokens, and their corresponding permissions. To draw an analogy, think of an NHI as a […]

The post Why being proactive in NHI management is critical for security appeared first on Entro.

The post Why being proactive in NHI management is critical for security appeared first on Security Boulevard.

How Can We Ensure Non-Human Identities Remain Protected? Are your organization’s Non-Human Identities (NHIs) secure from the impending cyber threats lurking in digital corners? While we delve into the intricacies of NHI security, the crucial aspects of managing these machine identities become apparent. Ensuring the safety of NHIs is a multidimensional effort involving end-to-end protection […]

The post What makes Non-Human Identities safe? appeared first on Entro.

The post What makes Non-Human Identities safe? appeared first on Security Boulevard.