Sicurezza
Cybersecurity, ransomware, privacy
- inSicurezzaDigitale.com — Cybersecurity in italiano IT
- SecureBulletin — Cybersecurity news in English EN
- Ransomfeed Daily News — Daily cybersecurity news EN
2.771 voci in archivio · mostrate 1–25 .
Storm-0940 ha usato ConnectWise come arma per Microsoft 365
Un attore tracciato da Microsoft come Storm-0940 ha compromesso le credenziali cloud di ConnectWise, usandole per accedere a centinaia di tenant Microsoft 365 senza bisogno di password degli utenti. U…
Ebury torna in azione: 333 nodi di uscita di Tor trasformati in trappole per le password SSH
Un ricercatore svizzero scopre che un decimo dei nodi di uscita Tor intercettava il traffico SSH ed email in chiaro. Dietro l'attacco, la storica backdoor Linux Ebury, tornata in una nuova versione do…
GitLab Fixes 12-Year-Old CVSS 10 Flaw Enabling Unauthenticated RCE
GitLab has patched a maximum-severity vulnerability that could let an unauthenticated attacker execute code on self-managed servers. The affected code dates to GitLab 7.0, making immediate upgrades an…
Railway Incident May Have Exposed Customer API Keys and Database Secrets
Railway says an unauthorized party may have accessed customer environment variables, including some decrypted secrets. Customers are being urged to rotate credentials immediately while the cloud platf…
Malicious LiteLLM 1.107.0 Package Steals Credentials and Opens RAT Channel
LiteLLM 1.107.0 was compromised on PyPI and in container images, delivering a credential stealer plus a remote-code loading mechanism. Anyone who installed the release should isolate affected systems…
Node.js Patches Brotli RCE and High-Severity TLS and DNS Flaws
New Node.js releases address ten vulnerabilities across supported branches, including a potential Brotli remote code execution flaw and certificate-validation bypasses. Teams should update runtimes, r…
Criminals Lean on AI-Enhanced ‘Antidetect’ Browsers to Run Armies of Fake Accounts
Check Point Research has documented how commercially sold antidetect browsers such as Kameleo, AdsPower, and MultiLogin are being used by criminal groups to disguise thousands of fake accounts as uniq…
Report: Most AI Agents Sit Idle for Months Yet Keep Full Access to Company Systems
A new telemetry-based report from Arrakis Security finds that 76% of AI agents deployed inside organizations haven't run in over 60 days — yet their credentials, permissions, and triggers remain fully…
GoDaddy Forces Mass TLS Certificate Reset After Compliance Lapse Hits 400,000+ Sites
GoDaddy has revoked more than 404,000 SSL/TLS certificates issued under its GoDaddy and Starfield chains after discovering the certificates did not match its published certificate policies, then misse…
Gentlemen Ransomware Gang Disarms Windows Defender and Shreds Backups Before Encrypting Files
Acronis researchers have detailed how the Gentlemen ransomware-as-a-service operation disables Windows Defender, kills backup services, wipes Volume Shadow Copies, and even abuses a vulnerable Lenovo…
PHP2Shell: la difesa comincia prima della patch
Le vulnerabilità critiche annunciate per PHP impongono di ridurre subito l’esposizione. Per i sistemi rimasti su PHP 8.1 e precedenti, il problema comprende anche l’assenza di manutenzione ufficiale…
Fraudsters Turn Open Banking Links Into a Free Stolen-Card Checking Service
Group-IB uncovered a scheme in which criminals abused a spend-management platform's open-banking integration to silently verify stolen card and bank credentials, while the platform unknowingly footed…
Ransomware Negotiator Allegedly Ran Extortion Site for ShinyHunters, FBI Probe Finds
Federal investigators suspect an executive at a major U.S. consulting firm helped ShinyHunters run a pressure site that pushed nearly 100 breached companies toward paying extortion demands. The case…
WP2Shell Chains WordPress Flaws Into Unauthenticated Server Takeover
The WP2Shell technique combines two WordPress Core vulnerabilities to create administrator access and deploy a plugin-based web shell without a login. Operators should upgrade to a fixed release and c…
Compromised eMudhra CA Keys Force Emergency Trust-Store Updates
Eight eMudhra intermediate certificate-authority keys were shown to be compromised, triggering emergency blocks across browsers and software ecosystems. Browsers update quickly, but applications with…
PHP Prepares Emergency Fixes for Two Critical 9.2 Flaws
PHP is preparing security updates for two critical vulnerabilities rated 9.2 under CVSS 4.0. Administrators should inventory exposed PHP systems now and apply the official fixes as soon as affected ve…
Stolen UpdraftCentral Keys Let Attackers Backdoor WordPress Sites
A breach at TeamUpdraft exposed remote-management keys that attackers used to push malicious plugins to connected WordPress sites. Administrators should update UpdraftPlus, remove old connection keys…
Midnight Mimosa Firmware Malware Infects Thousands of Budget Android Phones Worldwide
Researchers have traced a firmware-embedded malware campaign called Midnight Mimosa to thousands of low-cost Android devices across 150+ countries, giving attackers system-level control before a singl…
Ransomware Gangs Lean on Generative AI to Outrun Signature-Based Defenses
New Zscaler research shows ransomware operators increasingly using generative AI to write custom malware, craft near-flawless phishing lures, and sift stolen data faster than ever. The trend is erodin…
Quando il malware “ragiona” come un chatbot: dentro la campagna di spionaggio IA-assistita contro server Linux governativi
Unit 42 ricostruisce CL-UNK-1211, una campagna di sei mesi contro server Linux governativi: una backdoor Go inedita (SysGoRAT), web shell camuffate da Plesk e commenti nel codice che tradiscono l'uso…
Dentro Cairn: lo sciame di agenti IA che ha violato oltre 100 aziende in quattro paesi
Un'istruzione di meno di 100 caratteri e un budget di 5.000 dollari sono bastati a uno sciame di agenti IA per violare oltre 100 aziende e-commerce in USA, Canada, Australia e Giappone, tra cui Deere…
Exploited SiteGuard Flaw Can Elevate Attackers to Root or SYSTEM
Attackers are exploiting CVE-2026-106931, a command-injection flaw in SiteGuard Server Edition's default-enabled statistics feature. Administrators should preserve diagnostic evidence before applying…
Microsoft Tells Enterprises to Treat AI Agents Like Potential Insider Threats
Microsoft is urging organizations to stop assuming AI agents will always behave as intended, warning that agents with broad access to company systems can act unpredictably or be manipulated through hi…
NSA, CISA and NIST Issue New Playbook for Containing AI Agents That Go Rogue
The three agencies have jointly published voluntary guidance covering how organizations should detect, contain, and shut down AI agents that act outside their approved boundaries during training and e…
Lookalike Microsoft Teams Domain Caught Harvesting Employee Login Credentials
Researchers have flagged a newly registered domain, teams-cloud[.]live, that closely mimics the Microsoft Teams sign-in page and interface to trick employees into handing over their credentials. One s…