My Courses
-
A summary of the key announcements from vendors at Black Hat USA 2025 (Part 1).
The 2025 edition of the Black Hat conference in Las Vegas has become a significant platform for numerous companies to showcase their latest products and services. This year’s event highlights a diverse range of innovations aimed at enhancing cybersecurity measures across various sectors. Attendees are witnessing cutting-edge technologies and solutions designed to address the evolving…
-
Misconfigurations Should Not Be Considered Vulnerabilities: The Expensive Misunderstanding Surrounding Security Threats.
In SaaS security discussions, the terms “misconfiguration” and “vulnerability” are frequently used interchangeably, yet they represent distinct concepts. Misunderstanding this difference can lead to significant security risks. This confusion is not merely a matter of semantics; it highlights a broader misunderstanding of the shared responsibility model in SaaS environments, where the division of responsibilities between…
-
Cybercriminals have the ability to access IIS machine keys by taking advantage of a vulnerability in SharePoint’s deserialization process.
Hackers are employing a sophisticated attack method that exploits a deserialization vulnerability in SharePoint to steal Internet Information Services (IIS) Machine Keys. This exploitation allows attackers to bypass security measures, forge trusted data, and ultimately achieve persistent Remote Code Execution (RCE) on compromised servers. According to SANS researcher Bojan Zdrnja, the attack initiates with the…
-
The August 2025 update for Android addresses a Qualcomm vulnerability that has been exploited.
The Android August 2025 security update addresses a critical vulnerability affecting the Adreno GPU, which was confirmed to have been exploited as early as June. This update is crucial for users, as it mitigates risks associated with the Qualcomm vulnerability that could potentially compromise device security. By implementing this patch, Android aims to enhance the…
-
How Leading CISOs Manage Their SOCs to Avoid Alert Overload and Ensure No Genuine Incidents are Overlooked
Security Operations Centre (SOC) teams often find themselves overwhelmed by alerts, despite significant investments in security tools. False positives accumulate, stealthy threats evade detection, and critical incidents can become obscured in the noise. Leading Chief Information Security Officers (CISOs) have recognised that the solution does not lie in simply adding more tools to SOC workflows.…
-
Well-known Chollima APT hackers are targeting job applicants and organizations to distribute JavaScript-based malware.
The North Korean-linked Famous Chollima APT group has emerged as a sophisticated threat actor, orchestrating targeted campaigns against job seekers and organisations through deceptive recruitment processes. Active since December 2022, this advanced persistent threat has developed an intricate multi-stage attack methodology that exploits the trust inherent in professional networking and job-seeking activities. The group’s operations…
-
Chanel, a leading fashion brand, has been targeted in a series of cyberattacks linked to vulnerabilities in Salesforce.
Chanel has become the latest victim of a sophisticated cybercrime campaign targeting major corporations through their Salesforce customer relationship management systems. The company confirmed on July 25, 2025, that unauthorized threat actors breached a database containing personal information of U.S. customers who contacted their client care centre. The breach exposed limited but sensitive customer data,…
-
SonicWall is actively searching for zero-day vulnerabilities following a significant increase in attacks targeting firewalls.
Threat actors are reportedly exploiting a zero-day vulnerability in SonicWall firewalls, leading to a new wave of ransomware attacks. This alarming trend has prompted SonicWall to actively search for the zero-day flaw amid a surge in firewall exploitation. Cybercriminals are increasingly targeting these vulnerabilities to gain unauthorised access to networks, potentially compromising sensitive data and…
-
Microsoft is providing a $5 million prize at the Zero Day Quest hacking competition.
Microsoft has announced an exciting opportunity for cybersecurity researchers and ethical hackers with its upcoming Zero Day Quest competition, set to take place in spring 2026. The tech giant is offering a staggering $5 million in rewards for the discovery of high-impact security flaws specifically related to cloud and artificial intelligence technologies. This initiative aims…
-
A campaign utilizing artificial intelligence has created 15,000 counterfeit TikTok Shop websites that distribute malware and steal cryptocurrency.
Cybersecurity researchers have uncovered a widespread malicious campaign targeting TikTok Shop users globally, aiming to steal credentials and distribute trojanized applications. Threat actors exploit the official in-app e-commerce platform through a dual attack strategy that combines phishing and malware. The core tactic involves creating deceptive replicas of TikTok Shop, tricking users into believing they are…