Sophos captures multiple honors at SE Labs Awards 2025
Sophos has been recognized for defending customers of all sizes against today’s complex cyberattacks, achieving four prestigious awards at the SE Labs Awards 2025.
Microsoft on Monday attributed a threat actor it tracks as Storm-1175 to the exploitation of a critical security flaw in Fortra GoAnywhere software to facilitate the deployment of Medusa ransomware. The vulnerability is CVE-2025-10035 (CVSS score: 10.0), a critical deserialization bug that could result in command injection without authentication. It was addressed in version 7.8.4,…
U.S. cybersecurity company F5 on Wednesday disclosed that unidentified threat actors broke into its systems and stole files containing some of BIG-IP’s source code and information related to undisclosed vulnerabilities in the product. It attributed the activity to a “highly sophisticated nation-state threat actor,” adding the adversary maintained long-term, persistent access to its network. The
Are you a security researcher or a journalist in the cybersecurity/cybercrime space? DataBreaches.net and Zack Whittaker at this.weekinsecurity.com are conducting a survey on the types of threats that researchers and journalists have experienced, including legal threats or legal process and threats of violence by cybercriminals. The survey is at https://forms.gle/. Please complete the survey and……
Today’s reminder of the insider threat comes to us from Battlefords Union Hospitals in Canada. Battlefords Now reports that between October 1, 2024 and April 4, 2025, an operating room scheduler accessed the MedAccess EHR system to look at personal and primary care medical information for hundreds of patients without a legitimate purpose. That same…
Cybersecurity researchers have disclosed details of an active web traffic hijacking campaign that has targeted NGINX installations and management panels like Baota (BT) in an attempt to route it through the attacker’s infrastructure. Datadog Security Labs said it observed threat actors associated with the recent React2Shell (CVE-2025-55182, CVSS score: 10.0) exploitation using malicious NGINX
As part of the latest “season” of Operation Endgame, a coalition of law enforcement agencies have taken down about 300 servers worldwide, neutralized 650 domains, and issued arrest warrants against 20 targets. Operation Endgame, first launched in May 2024, is an ongoing law enforcement operation targeting services and infrastructures assisting in or directly providing initial…