Google has released the May 2025 security updates for Android with fixes for 45 security flaws, including an actively exploited zero-click FreeType 2 code execution vulnerability. […]
Hacker Conversations: John Kindervag, a Making not Breaking Hacker
John Kindervag is best known for developing the Zero Trust Model. He is a hacker, but not within our common definition of a hacker today.
The post Hacker Conversations: John Kindervag, a Making not Breaking Hacker appeared first on SecurityWeek.
Microsoft unveils new AI agents that can modify Windows settings
Today, Microsoft announced new Windows experiences for Copilot+ PCs, including AI agents that will make changing settings on your Windows computer easier. […]
Second Wave of Attacks Hitting SAP NetWeaver After Zero-Day Compromise
Threat actors are revisiting SAP NetWeaver instances to leverage webshells deployed via a recent zero-day vulnerability.
The post Second Wave of Attacks Hitting SAP NetWeaver After Zero-Day Compromise appeared first on SecurityWeek.
US Charges Yemeni Man for Black Kingdom Ransomware Attacks
Rami Khaled Ahmed, a 36-year-old from Yemen, has been charged for launching ransomware attacks between 2021 and 2023.
The post US Charges Yemeni Man for Black Kingdom Ransomware Attacks appeared first on SecurityWeek.
Samsung MagicINFO Vulnerability Exploited Days After PoC Publication
Threat actors started exploiting a vulnerability in Samsung MagicINFO only days after a PoC exploit was published.
The post Samsung MagicINFO Vulnerability Exploited Days After PoC Publication appeared first on SecurityWeek.
Third Parties and Machine Credentials: The Silent Drivers Behind 2025’s Worst Breaches
It wasn’t ransomware headlines or zero-day exploits that stood out most in this year’s Verizon 2025 Data Breach Investigations Report (DBIR) — it was what fueled them. Quietly, yet consistently, two underlying factors played a role in some of the worst breaches: third-party exposure and machine credential abuse.
According to the 2025 DBIR, third-party involvement in breaches doubled
According to the 2025 DBIR, third-party involvement in breaches doubled
Critical Vulnerability in AI Builder Langflow Under Attack
CISA warns organizations that threat actors are exploiting a critical-severity vulnerability in low-code AI builder Langflow.
The post Critical Vulnerability in AI Builder Langflow Under Attack appeared first on SecurityWeek.
Microsoft Warns of Attackers Exploiting Misconfigured Apache Pinot Installations
Misconfigured Apache Pinot instances can and have enabled threat actors to gain access to sensitive information.
The post Microsoft Warns of Attackers Exploiting Misconfigured Apache Pinot Installations appeared first on SecurityWeek.
Microsoft Warns Default Helm Charts Could Leave Kubernetes Apps Exposed to Data Leaks
Microsoft has warned that using pre-made templates, such as out-of-the-box Helm charts, during Kubernetes deployments could open the door to misconfigurations and leak valuable data.
“While these ‘plug-and-play’ options greatly simplify the setup process, they often prioritize ease of use over security,” Michael Katchinskiy and Yossi Weizman from the Microsoft Defender for Cloud Research team
“While these ‘plug-and-play’ options greatly simplify the setup process, they often prioritize ease of use over security,” Michael Katchinskiy and Yossi Weizman from the Microsoft Defender for Cloud Research team