Aggregator

Jaguar Land Rover (JLR) has confirmed that data was stolen during a major cyberattack that has crippled its global operations, bringing vehicle production to a standstill since early September. The luxury carmaker, a subsidiary of India’s Tata Motors, is now working with cybersecurity specialists to investigate the breach and restore its systems. The cyber incident, […]

The post Jaguar Land Rover Confirms Hackers Stole Data in Ongoing Cyberattack appeared first on Cyber Security News.

CyberVolk ransomware first emerged in May 2024, rapidly evolving into a sophisticated threat aimed at government agencies and critical infrastructure in countries perceived as hostile to Russian interests. Leveraging a dual-layer symmetric encryption process, this malware has inflicted significant operational disruptions on scientific institutions and public services across Japan, France, and the United Kingdom. The […]

The post CyberVolk Ransomware Attacking Windows System in Critical Infrastructure and Scientific Institutions appeared first on Cyber Security News.

在新冠疫情高峰时期，全世界据估计每月使用 1290 亿个一次性口罩，这些口罩主要由聚丙烯等塑料制成。由于缺乏回收流程，大部分口罩要么被填埋要么散落在世界各地，研究显示陆地和水生环境都存在大量一次性口罩。而这些丢弃的口罩如今已经开始降解，可能会成为化学定时炸弹。研究人员将不同类型的口罩浸泡在水中，发现所有口罩都会渗出微塑料，其中 FFP2 和 FFP3 口罩的微塑料最多，它们释放的微塑料量是其它口罩的四到六倍。此外口罩还会释放出干扰内分泌的化学物质双酚B（bisphenol B），被人类和动物身体吸收之后，其作用会类似雌激素。研究人员根据口罩的产量估计它们会向环境释放 128-214 公斤的双酚B。

Security researchers have recently observed a surge in sophisticated fileless malware campaigns targeting enterprise environments. AsyncRAT, a powerful Remote Access Trojan, leverages legitimate system tools to execute malicious payloads entirely in memory, effectively sidestepping traditional disk-based defenses. Emergence of this threat underscores the evolving tactics employed by cyber adversaries to maintain stealth and persistence on […]

The post AsyncRAT Uses Fileless Loader to Bypass Detections and Gain Remote Access appeared first on Cyber Security News.

Криптоплатформа подтвердила взлом.

Alleged Data Sale of Municipality of Canegrate

LevelBlue Labs reports AsyncRAT delivered through a fileless attack chain using ScreenConnect, enabling credential theft and persistence.

A vulnerability was found in Shopware Platform and Storefront and classified as problematic. Affected by this issue is some unknown functionality of the component 404 Page Handler. Such manipulation leads to use of cache containing sensitive information. This vulnerability is listed as CVE-2024-27917. The attack must be carried out from within the local network. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability identified as problematic has been detected in Shopware Security Plugin up to 6.5.8.7/6.6.1.0 on Symfony. Affected by this vulnerability is an unknown functionality of the file /store-api/account/logout. This manipulation causes session expiration. This vulnerability is registered as CVE-2024-31447. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

A vulnerability identified as problematic has been detected in vercel next.js up to 13.5.0. The impacted element is an unknown function of the component HTTP Request Handler. The manipulation leads to http request smuggling. This vulnerability is traded as CVE-2024-34350. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability was found in vercel next.js up to 14.1.0. It has been declared as critical. Affected is an unknown function. The manipulation results in server-side request forgery. This vulnerability is cataloged as CVE-2024-34351. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in workos authkit-nextjs up to 0.13.1 and classified as problematic. This affects an unknown part. Executing manipulation can lead to sensitive information in log files. This vulnerability is tracked as CVE-2024-51752. The attack is restricted to local execution. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability described as critical has been identified in vercel next.js up to 14.2.14. The impacted element is an unknown function. Executing manipulation can lead to improper authorization. This vulnerability is registered as CVE-2024-51479. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

A vulnerability identified as problematic has been detected in vercel next.js up to 13.5.7/14.2.20/15.1.1. This issue affects some unknown processing of the component HTTP Request Handler. This manipulation causes allocation of resources. This vulnerability appears as CVE-2024-56332. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in Shopware up to 6.5.8.17/6.6.10.3/6.7.0.0-rc1. This issue affects some unknown processing of the file /store-api/account/recovery-password of the component API Endpoint. The manipulation leads to observable response discrepancy. This vulnerability is uniquely identified as CVE-2025-30150. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in Shopware up to 6.5.8.17/6.6.10.3/6.7.0.0-rc1. Impacted is an unknown function of the component Long Password Handler. The manipulation results in denial of service. This vulnerability was named CVE-2025-30151. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

A vulnerability was found in Shopware. It has been classified as problematic. Affected is an unknown function of the component Newsletter Handler. The manipulation leads to improper control of interaction frequency. This vulnerability is uniquely identified as CVE-2025-32378. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

A vulnerability, which was classified as critical, has been found in vercel Next.js up to 14.2.24/15.2.2. This impacts an unknown function of the component Header Handler. This manipulation of the argument x-middleware-subrequest causes improper authorization. This vulnerability is registered as CVE-2025-29927. Remote exploitation of the attack is possible. Furthermore, an exploit is available. It is advisable to upgrade the affected component.

Google is integrating C2PA Content Credentials into the Pixel 10 camera and Google Photos, to help users distinguish between authentic, unaltered images and those generated or edited with artificial intelligence technology. [...]