Cyber Attack

Salesforce said on Wednesday that it’s investigating a breach of “certain customers’ Salesforce data” that was compromised through apps published by Gainsight, a company that sells a platform for other companies to manage their customers. In a notice published late Wednesday, Salesforce said the hacks involve “Gainsight-published applications connected to …

Researchers gathered 3.5 billion WhatsApp phone numbers and personal information by abusing a contact-discovery API without proper rate limiting. This study shows a common tactic used by threat actors to collect user information from unprotected public APIs, even though the researchers haven’t shared the data. Abusing WhatsApp API: The researchers …

CISA warns government agencies to patch Oracle Identity Manager (CVE-2025-61757) due to potential zero-day exploitation. CVE-2025-61757 is a pre-authentication remote code execution vulnerability in Oracle Identity Manager, found by Searchlight Cyber analysts Adam Kues and Shubham Shahflaw. The flaw stems from an authentication bypass in Oracle Identity Manager’s REST APIs, …

The Clop ransomware group published a list that listed 39 new victims on its data leak site in the last 24 hours. This increase in listings suggests a major automated campaign. The Clop ransomware gang has claimed breach of Oracle’s internal systems. This is part of a large extortion campaign …

The Clop ransomware gang claims to have breached Oracle’s internal systems and has listed the company on its dark web leak site. This is part of a large extortion campaign that takes advantage of a serious zero-day vulnerability in Oracle E-Business Suite (EBS), dubbed CVE-2025-61882. Security experts report that Clop …

Since November 14, 2025, hackers launched over 2.3 million attacks on Palo Alto Networks’ GlobalProtect VPN portals, as reported by GreyNoise. A 40-fold increase in activity within 24 hours marks the highest level in 90 days, indicating rising risks to global remote access systems. Attacks aim at the /global-protect/login.esp URI …

Fortinet warned on Friday about a vulnerability in FortiWeb that lets remote, unauthenticated attackers gain admin access to web application firewalls. The bug, labeled CVE-2025-64446 with a CVSS score of 9.1, is a path traversal vulnerability, allowing attackers to run admin commands through specially crafted HTTP or HTTPS requests. Fortinet noted, …

Ransomware attacks rose 30% in October, reaching the second-highest total ever. With 623 attacks, October’s count was only behind February 2025, when a CL0P MFT campaign led to 854 attacks. This marks the sixth straight month of rising ransomware incidents, as stated in Cyble’s blog. Qilin was the most active …

Wiz, a cloud security company, analyzed GitHub repositories of major AI firms and discovered that many had leaked verified secrets that could reveal sensitive information. Leaked secrets are typically found by GitHub’s scanners, repository owners’ scans, and third-party automated scans for marketing. The cloud security firm aimed for a new …

Amazon’s threat intelligence team discovered that attacker exploiting previously undisclosed zero-day vulnerabilities in Cisco Identity Service Engine (ISE) and Citrix systems. This campaign utilized custom malware and showed access to various hidden vulnerabilities, indicating a trend where attackers target essential identity and network access controls. Amazon’s MadPot honeypot service identified …