April 2025 – Page 26

CISA Flags Actively Exploited Vulnerability in SonicWall SMA Devices

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting SonicWall Secure Mobile Access (SMA) 100 Series gateways to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The high-severity vulnerability, tracked as CVE-2021-20035 (CVSS score: 7.2), relates to a case of operating system command injection

Apple Patches Two Actively Exploited iOS Flaws Used in Sophisticated Targeted Attacks

Apple on Wednesday released security updates for iOS, iPadOS, macOS Sequoia, tvOS, and visionOS to address two security flaws that it said have come under active exploitation in the wild.
The vulnerabilities in question are listed below –

CVE-2025-31200 (CVSS score: 7.5) – A memory corruption vulnerability in the Core Audio framework that could allow code execution when processing an audio

Krebs Exits SentinelOne After Security Clearance Pulled

Chris Krebs has resigned from SentinelOne after security clearance withdrawn and an order to review CISA’s conduct under his leadership.

The post Krebs Exits SentinelOne After Security Clearance Pulled appeared first on SecurityWeek.

Over 16,000 Fortinet devices compromised with symlink backdoor

Over 16,000 internet-exposed Fortinet devices have been detected as compromised with a new symlink backdoor that allows read-only access to sensitive files on previously compromised devices. […]

Apple Quashes Two Zero-Days With iOS, MacOS Patches

The vulnerabilities are described as code execution and mitigation bypass issues that affect Apple’s iOS, iPadOS and macOS platforms.

The post Apple Quashes Two Zero-Days With iOS, MacOS Patches appeared first on SecurityWeek.

Google blocked over 5 billion ads in 2024 amid rise in AI-powered scams

Google blocked 5.1 billion ads and suspended more than 39.2 million advertiser accounts in 2024, according to its 2024 Ads Safety Report released this week. […]

Apple fixes two zero-days exploited in targeted iPhone attacks

Apple released emergency security updates to patch two zero-day vulnerabilities that were used in an “extremely sophisticated attack” against specific targets’ iPhones. […]

MITRE CVE Program Gets Last-Hour Funding Reprieve

The US government’s cybersecurity agency CISA has “executed the option period on the contract” to keep the vulnerability catalog operational.

The post MITRE CVE Program Gets Last-Hour Funding Reprieve appeared first on SecurityWeek.

Experts Uncover Four New Privilege Escalation Flaws in Windows Task Scheduler

Cybersecurity researchers have detailed four different vulnerabilities in a core component of the Windows task scheduling service that could be exploited by local attackers to achieve privilege escalation and erase logs to cover up evidence of malicious activities.
The issues have been uncovered in a binary named “schtasks.exe,” which enables an administrator to create, delete, query, change,

Google begins unifying search country domains to Google.com

Google has announced that it’s retiring separate country code top-level domain names like google.co.uk or google.com.br and redirecting users to Google.com. […]

Month: April 2025