Welcome to Cyberlobi News Hub
Top News Sources
Hacker News
- Adobe Releases Patch Fixing 254 Vulnerabilities, Closing High-Severity Security Gapsby [email protected] (The Hacker News) on June 10, 2025 at 6:29 pm
Adobe on Tuesday pushed security updates to address a total of 254 security flaws impacting its software products, a majority of which affect Experience Manager (AEM). Of the 254 flaws, 225 reside in AEM, impacting AEM Cloud Service (CS) as well as all versions prior to and including 6.5.22. The issues have been resolved in AEM Cloud Service Release 2025.5 and version 6.5.23. “Successful
- Researchers Uncover 20+ Configuration Risks, Including Five CVEs, in Salesforce Industry Cloudby [email protected] (The Hacker News) on June 10, 2025 at 6:04 pm
Cybersecurity researchers have uncovered over 20 configuration-related risks affecting Salesforce Industry Cloud (aka Salesforce Industries), exposing sensitive data to unauthorized internal and external parties. The weaknesses affect various components like FlexCards, Data Mappers, Integration Procedures (IProcs), Data Packs, OmniOut, and OmniScript Saved Sessions. “Low-code platforms such as
- FIN6 Uses AWS-Hosted Fake Resumes on LinkedIn to Deliver More_eggs Malwareby [email protected] (The Hacker News) on June 10, 2025 at 4:46 pm
The financially motivated threat actor known as FIN6 has been observed leveraging fake resumes hosted on Amazon Web Services (AWS) infrastructure to deliver a malware family called More_eggs. “By posing as job seekers and initiating conversations through platforms like LinkedIn and Indeed, the group builds rapport with recruiters before delivering phishing messages that lead to malware,” the
- Rust-based Myth Stealer Malware Spread via Fake Gaming Sites Targets Chrome, Firefox Usersby [email protected] (The Hacker News) on June 10, 2025 at 2:20 pm
Cybersecurity researchers have shed light on a previously undocumented Rust-based information stealer called Myth Stealer that’s being propagated via fraudulent gaming websites. “Upon execution, the malware displays a fake window to appear legitimate while simultaneously decrypting and executing malicious code in the background,” Trellix security researchers Niranjan Hegde, Vasantha Lakshmanan
- The Hidden Threat in Your Stack: Why Non-Human Identity Management is the Next Cybersecurity Frontierby [email protected] (The Hacker News) on June 10, 2025 at 11:00 am
Modern enterprise networks are highly complex environments that rely on hundreds of apps and infrastructure services. These systems need to interact securely and efficiently without constant human oversight, which is where non-human identities (NHIs) come in. NHIs — including application secrets, API keys, service accounts, and OAuth tokens — have exploded in recent years, thanks to an
Krebs on Security
- Proxy Services Feast on Ukraine’s IP Address Exodusby BrianKrebs on June 5, 2025 at 10:44 pm
Ukraine has seen nearly one-fifth of its Internet space come under Russian control or sold to Internet address brokers since February 2022, a new study finds. The analysis indicates large chunks of Ukrainian Internet address space are now in the hands of proxy and anonymity services nested at some of America’s largest Internet service providers (ISPs).
- U.S. Sanctions Cloud Provider ‘Funnull’ as Top Source of ‘Pig Butchering’ Scamsby BrianKrebs on May 30, 2025 at 1:55 am
The U.S. government today imposed economic sanctions on Funnull Technology Inc., a Philippines-based company that provides computer infrastructure for hundreds of thousands of websites involved in virtual currency investment scams, commonly known as “pig butchering.” In January 2025, KrebsOnSecurity detailed how Funnull was being used as a content delivery network that catered to cybercriminals seeking to route their traffic through U.S.-based cloud providers.
- Pakistan Arrests 21 in ‘Heartsender’ Malware Serviceby BrianKrebs on May 28, 2025 at 5:41 pm
Authorities in Pakistan have arrested 21 individuals accused of operating “Heartsender,” a once popular spam and malware dissemination service that operated for more than a decade. The main clientele for HeartSender were organized crime groups that tried to trick victim companies into making payments to a third party, and its alleged proprietors were publicly identified by KrebsOnSecurity in 2021 after they inadvertently infected their computers with malware.
- Oops: DanaBot Malware Devs Infected Their Own PCsby BrianKrebs on May 22, 2025 at 9:53 pm
The U.S. government today unsealed criminal charges against 16 individuals accused of operating and selling DanaBot, a prolific strain of information-stealing malware that has been sold on Russian cybercrime forums since 2018. The FBI says a newer version of DanaBot was used for espionage, and that many of the defendants exposed their real-life identities after accidentally infecting their own systems with the malware.
- KrebsOnSecurity Hit With Near-Record 6.3 Tbps DDoSby BrianKrebs on May 20, 2025 at 9:30 pm
KrebsOnSecurity last week was hit by a near record distributed denial-of-service (DDoS) attack that clocked in at more than 6.3 terabits of data per second (a terabit is one trillion bits of data). The brief attack appears to have been a test run for a massive new Internet of Things (IoT) botnet capable of launching crippling digital assaults that few web destinations can withstand. Read on for more about the botnet, the attack, and the apparent creator of this global menace.
Security Week
- Code Execution Flaws Haunt Adobe Acrobat Reader, Adobe Commerceby Ryan Naraine on June 10, 2025 at 6:44 pm
Patch Tuesday: Adobe documents hundreds of bugs across multiple products and warns of code execution, feature bypass risks. The post Code Execution Flaws Haunt Adobe Acrobat Reader, Adobe Commerce appeared first on SecurityWeek.
- Microsoft Patch Tuesday Covers WebDAV Flaw Marked as ‘Already Exploited’by Ryan Naraine on June 10, 2025 at 6:16 pm
Redmond warns that external control of a file name or path in WebDAV “allows an unauthorized attacker to execute code over a network.” The post Microsoft Patch Tuesday Covers WebDAV Flaw Marked as ‘Already Exploited’ appeared first on SecurityWeek.
- Hackers Stole 300,000 Crash Reports From Texas Department of Transportationby Ionut Arghire on June 10, 2025 at 1:13 pm
The Texas Department of Transportation has disclosed a data breach impacting the personal information included in 300,000 crash reports. The post Hackers Stole 300,000 Crash Reports From Texas Department of Transportation appeared first on SecurityWeek.
- Swimlane Raises $45 Million for Security Automation Platformby Ionut Arghire on June 10, 2025 at 12:53 pm
Swimlane has raised $45 million in a growth funding round to fuel its global channel expansion and product innovation. The post Swimlane Raises $45 Million for Security Automation Platform appeared first on SecurityWeek.
- Five Zero-Days, 15 Misconfigurations Found in Salesforce Industry Cloudby Kevin Townsend on June 10, 2025 at 12:00 pm
Security researchers uncover critical flaws and widespread misconfigurations in Salesforce’s industry-specific CRM solutions. The post Five Zero-Days, 15 Misconfigurations Found in Salesforce Industry Cloud appeared first on SecurityWeek.
Help Net Security
- Android Enterprise update puts mobile security firstby Mirko Zorz on June 10, 2025 at 6:00 pm
Google is rolling out new Android Enterprise features aimed at improving mobile security, IT management, and employee productivity. According to Zimperium’s 2025 Global Mobile Threat Report, attackers are now prioritizing mobile devices over desktops. Many security incidents involve smartphones, often due to unsafe apps or unsecured public Wi-Fi. Google’s latest update responds to these risks by adding tighter protections at the device and network levels. Stronger mobile defenses At the heart of the update is … More → The post Android Enterprise update puts mobile security first appeared first on Help Net Security.
- ArmorCode provides enterprises with contextual understanding of their code repositoriesby Industry News on June 10, 2025 at 1:34 pm
ArmorCode launched AI Code Insights, a new set of capabilities that leverages ArmorCode’s agentic AI, Anya, to provide enterprises with contextual understanding of their code repositories, empowering security and development teams to secure what matters most. AI Code Insights directly addresses the critical challenge of “black box” code repositories, transforming them into a source of actionable intelligence. Developers are now leveraging AI to push hundreds of commits daily, often leaving security teams struggling to identify … More → The post ArmorCode provides enterprises with contextual understanding of their code repositories appeared first on Help Net Security.
- Webinar: Cloud security made easy with CIS Hardened Imagesby Help Net Security on June 10, 2025 at 1:00 pm
This webinar is designed for leadership and management professionals looking to enhance their organization’s security posture in the cloud. The authors explore CIS Hardened Images: how they work, the security benefits they offer, and why they’re especially valuable for public sector organizations. Throughout the discussion, you’ll gain a clear understanding of how these pre-configured security solutions align with the CIS Benchmarks to help mitigate risks and ensure compliance with critical frameworks. The webinar breaks down … More → The post Webinar: Cloud security made easy with CIS Hardened Images appeared first on Help Net Security.
- AU10TIX AnyDoc Authentication identifies tampered or forged documentsby Industry News on June 10, 2025 at 12:45 pm
AU10TIX is enhancing its product suite with the launch of AnyDoc Authentication, a capability that exposes forged, tampered, or synthetic non-ID documents that may bypass traditional identity verification methods. AnyDoc harnesses advanced AI, forensic forgery detection, and metadata analysis to empower businesses to detect document fraud, maintain regulatory compliance, and scale secure onboarding. This critical layer of protection supports a diverse range of document types, including utility bills, bank statements, tax filings, business licenses, and … More → The post AU10TIX AnyDoc Authentication identifies tampered or forged documents appeared first on Help Net Security.
- Unpatched Wazuh servers targeted by Mirai botnets (CVE-2025-24016)by Zeljka Zorz on June 10, 2025 at 10:23 am
Two Mirai botnets are exploiting a critical remote code execution vulnerability (CVE-2025-24016) in the open-source Wazuh XDR/SIEM platform, Akamai researchers have warned. What is Wazuh? Wazuh is a popular open-source security information and event management (SIEM) and extended detection and response (XDR) solution that’s widely used for host-based intrusion detection, log analysis, file integrity monitoring, and more. It’s core components are: Wazuh Manager (server component), which analyzes data and triggers alerts. Made to be installed … More → The post Unpatched Wazuh servers targeted by Mirai botnets (CVE-2025-24016) appeared first on Help Net Security.