InfoSecBulletin Cybersecurity for mankind
In 2024, 768 vulnerabilities with CVE identifiers were reported as exploited in the wild, a 20% increase from 639 in 2023. VulnCheck called 2024 “a strong year for threat actors exploiting vulnerabilities,” noting that 23.6% of known exploited vulnerabilities (KEVs) were weaponized by or on the day their CVEs were disclosed.
This represents a slight decrease from 2023’s 26.8%, showing that exploitation attempts can occur at any point in a vulnerability’s lifecycle.
768 Exploited CVEs in 2024, a 20% Increase from 639 in 2023
.Gov Domains Weaponized in Phishing Surge
RedSentry presents
Hacked 101 Seminar Successfully Ended at UITS
US scientists claim to replicate DeepSeek for $30 dubbed “TinyZero,”
ChatGPT, DeepSeek, Qwen 2.5-VL Vulnerable to AI Jailbreaks
Paragon Attack WhatsApp With New Zero-Click Spyware
Everything I Say Leaks,’ Zuckerberg Says in Leaked Meeting Audio
Indian tech giant Tata Tech hit by ransomware attack
Vulnarabilitties found in Cisco webex and VMware Aria operation
Microsoft to boost M365 bounty program rewards Up to $27,000
“During 2024, 1% of the CVEs published were reported publicly as exploited in the wild,” VulnCheck’s Patrick Garrity said. “This number is expected to grow as exploitation is often discovered long after a CVE is published.”
The report comes over two months after the company disclosed that 15 of 60 identified Chinese hacking groups are connected to the exploitation of at least one of the top 15 commonly exploited vulnerabilities in 2023.
“Not surprisingly, the Log4j CVE (CVE-2021-44228) is associated with the most threat actors overall, with 31 named threat actors linked to its exploitation,” Garrity noted late last year, adding the company identified 65,245 hosts potentially vulnerable to the flaw.
Approximately 400,000 internet-accessible systems may be vulnerable to attacks due to 15 security flaws in products from companies like Apache, Atlassian, Barracuda, Citrix, Cisco, Fortinet, Microsoft, Progress, PaperCut, and Zoho.
“Organizations should evaluate their exposure to these technologies, enhance visibility into potential risks, leverage robust threat intelligence, maintain strong patch management practices, and implement mitigating controls, such as minimizing internet-facing exposure of these devices wherever possible,” VulnCheck said.
