soc

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.  CVE-2026-3502 TrueConf Client Download of Code Without Integrity Check Vulnerability  This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.  Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited […]

Trivy-Linked Cisco Breach & ShinyHunters’ Stolen Data ClaimCisco is facing fresh scrutiny after a breach of its internal development environment was linked to the Trivy supply chain compromise. A ShinyHunters extortion claim has since surfaced, alleging theft of Salesforce data, GitHub repositories, and AWS assets.This post outlines what is currently known, what remains unverified, and where the […]

The agency has not named the problematic foreign-made applications, but TikTok and Temu come to mind. The post FBI Warns of Data Security Risks From China-Made Mobile Apps appeared first on SecurityWeek.

Jonathan Spalletta exploited smart contract vulnerabilities to steal approximately $55 million in cryptocurrency and cause Uranium to shut down. The post US Charges Uranium Crypto Exchange Hacker appeared first on SecurityWeek.

Phishing remains one of the most effective tools in the cybercriminal arsenal, especially when threat actors abuse the credibility of trusted institutions and familiar digital services to increase victim interaction. In late March 2026, CERT-UA revealed a phishing campaign tracked as UAC-0255 in which attackers impersonated the agency and attempted to infect organizations across Ukraine’s […]

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-5281 Google Dawn Use-After-Free Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of […]

CVE-2025-53521: F5 BIG-IP APM Flaw Reclassified as Unauthenticated RCE CVE-2025-Adresse geschuetzt F5 BIG-IP Access Policy Manager (APM) that was initially treated as a denial-of-service condition in 2025, then reclassified recently as a potential unauthenticated remote code execution (RCE) issue in certain deployments. BIG-IP APM often sits directly in the authentication and remote access path, so a pre-auth […]