From the U.S. Department of Justice: Two Virginia men were arrested today for their roles in a conspiracy to destroy government databases hosted by a federal government contractor, among other crimes. According to court documents, brothers Muneeb and Sohaib Akhter, both 34, of Alexandria, Virginia, were indicted on Nov. 13 for conspiring to delete databases……
Microsoft has silently plugged a security flaw that has been exploited by several threat actors since 2017 as part of the company’s November 2025 Patch Tuesday updates, according to ACROS Security’s 0patch. The vulnerability in question is CVE-2025-9491 (CVSS score: 7.8/7.0), which has been described as a Windows Shortcut (LNK) file UI misinterpretation vulnerability that…
A maximum-severity security flaw has been disclosed in React Server Components (RSC) that, if successfully exploited, could result in remote code execution. The vulnerability, tracked as CVE-2025-55182, carries a CVSS score of 10.0. It allows “unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints,” the…
Dysruption Hub reports: Puerto Rico officials say a Thanksgiving-week cyberattack on IT contractor Truenorth Corporation briefly disrupted systems at three major agencies but did not compromise citizen data, even as independent reporting describes a broader ransomware incident. Truenorth Corporation, an IT services firm that runs key systems for multiple Puerto Rico government agencies, was the……
The threat actor known as Water Saci is actively evolving its tactics, switching to a sophisticated, highly layered infection chain that uses HTML Application (HTA) files and PDFs to propagate via WhatsApp a worm that deploys a banking trojan in attacks targeting users in Brazil. The latest wave is characterized by the attackers shifting from…
A critical security flaw impacting a WordPress plugin known as King Addons for Elementor has come under active exploitation in the wild. The vulnerability, CVE-2025-8489 (CVSS score: 9.8), is a case of privilege escalation that allows unauthenticated attackers to grant themselves administrative privileges by simply specifying the administrator user role during registration. It affects versions
One of the most worrying concerns DataBreaches and Protenus reported each year when reporting on breaches of health data was the insider threat. Often the insider threat takes the form of “snooping” out of curiosity. At other times, it may have more nefarious motives, such as obtaining information on an adversary or relative to embarrass……
332 IT and cybersecurity leaders reveal the ransomware realities for manufacturing and production organizations today.
Remember when phishing emails were easy to spot? Bad grammar, weird formatting, and requests from a “Prince” in a distant country? Those days are over. Today, a 16-year-old with zero coding skills and a $200 allowance can launch a campaign that rivals state-sponsored hackers. They don’t need to be smart; they just need to subscribe…
Most people know the story of Paul Bunyan. A giant lumberjack, a trusted axe, and a challenge from a machine that promised to outpace him. Paul doubled down on his old way of working, swung harder, and still lost by a quarter inch. His mistake was not losing the contest. His mistake was assuming that…
