In 2024, 768 vulnerabilities with CVE identifiers were reported as exploited in the wild, a 20% increase from 639 in 2023. VulnCheck called 2024 “a strong year for threat actors exploiting vulnerabilities,” noting that 23.6% of known exploited vulnerabilities (KEVs) were weaponized by or on the day their CVEs were disclosed.
This represents a slight decrease from 2023’s 26.8%, showing that exploitation attempts can occur at any point in a vulnerability’s lifecycle.
By infosecbulletin
/ Tuesday , February 18 2025
Indian government and educational websites, along with reputable financial brands, have experienced SEO poisoning, causing user traffic to be redirected...
Read More
By infosecbulletin
/ Tuesday , February 18 2025
The Cyber Threat Intelligence Unit of BGD e-GOV CIRT has found 600 vulnerable PRTG instances in Bangladesh, affected by the...
Read More
By infosecbulletin
/ Monday , February 17 2025
Amazon Web Services (AWS) has been named in an FIR after a builder claimed damages to the tune of Rs...
Read More
By infosecbulletin
/ Monday , February 17 2025
CISA has issued an urgent warning about a critical zero-day vulnerability in Apple iOS and iPadOS, known as CVE-2025-24200, which...
Read More
By infosecbulletin
/ Monday , February 17 2025
A major IoT data breach has exposed 2.7 billion records, including Wi-Fi network names, passwords, IP addresses, and device IDs....
Read More
By infosecbulletin
/ Sunday , February 16 2025
A serious authentication bypass vulnerability in SonicWall firewalls, called CVE-2024-53704, is currently being exploited, according to cybersecurity firms. The increase...
Read More
By infosecbulletin
/ Sunday , February 16 2025
AMD has released security patches for two high-severity vulnerabilities in its System Management Mode (SMM). If exploited, these could let...
Read More
By infosecbulletin
/ Sunday , February 16 2025
Lazarus Group has initiated a complex global campaign aimed at software developers and cryptocurrency users. Operation Marstech Mayhem uses the...
Read More
By infosecbulletin
/ Saturday , February 15 2025
Every day a lot of cyberattack happen around the world including ransomware, Malware attack, data breaches, website defacement and so...
Read More
By infosecbulletin
/ Saturday , February 15 2025
RedMike (Salt Typhoon) targeted university devices in Bangladesh, likely to access research in telecommunications, engineering, and technology, especially from institutions...
Read More
“During 2024, 1% of the CVEs published were reported publicly as exploited in the wild,” VulnCheck’s Patrick Garrity said. “This number is expected to grow as exploitation is often discovered long after a CVE is published.”
The report comes over two months after the company disclosed that 15 of 60 identified Chinese hacking groups are connected to the exploitation of at least one of the top 15 commonly exploited vulnerabilities in 2023.
“Not surprisingly, the Log4j CVE (CVE-2021-44228) is associated with the most threat actors overall, with 31 named threat actors linked to its exploitation,” Garrity noted late last year, adding the company identified 65,245 hosts potentially vulnerable to the flaw.
Approximately 400,000 internet-accessible systems may be vulnerable to attacks due to 15 security flaws in products from companies like Apache, Atlassian, Barracuda, Citrix, Cisco, Fortinet, Microsoft, Progress, PaperCut, and Zoho.
“Organizations should evaluate their exposure to these technologies, enhance visibility into potential risks, leverage robust threat intelligence, maintain strong patch management practices, and implement mitigating controls, such as minimizing internet-facing exposure of these devices wherever possible,” VulnCheck said.