February, 2025

• 27 February

  Botnet Powered by 130,000 Devices Targets Microsoft 365 Accounts

  

  A China-linked botnet is targeting Microsoft 365 accounts with widespread password spraying attacks, according to a report by SecurityScorecard. A security firm reports that a botnet with over 130,000 compromised devices is targeting Microsoft 365 accounts through non-interactive sign-ins using Basic Authentication. “Non-interactive sign-ins, commonly used for service-to-service authentication, legacy …

  Read More »
• 26 February

  HaveIBeenPwned Added 244 Million Passwords Stolen By Infostealers

  

  A breach notification site has added millions of new passwords and email addresses obtained from infostealer malware. Troy Hunt, founder of HaveIBeenPwned (HIBP), added 244 million new passwords and 284 million new email accounts to the database after analyzing 1.5TB of stolen logs posted on Telegram. Hunt identified an account called …

  Read More »
• 26 February

  Hackers Exploits RCE flaw in Cisco Small Business Router

  

  Cybersecurity researchers have discovered a campaign exploiting a remote command execution vulnerability, CVE-2023-20118, in Cisco Small Business Routers. This vulnerability affects models RV016, RV042, RV042G, RV082, RV320, and RV325. The flaw in these devices is their web-based management interface, which has poor input validation. This allows unauthorized attackers to run …

  Read More »
• 26 February

  CISA Alerts For Active Exploited Zimbra and Microsoft flaw

  

  CISA has added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog, urging organizations to quickly patch their systems to prevent exploitation. New vulnerabilities, CVE-2023-34192 and CVE-2024-49035, affect popular platforms and pose serious risks to public and private sectors. CVE-2023-34192 is a high-severity Cross-Site Scripting (XSS) vulnerability in Zimbra Collaboration …

  Read More »
• 25 February

  200 Fake GitHub Repos Attacking Developers to Deliver Malware

  

  A new cyber campaign called GitVenom poses a serious risk to developers. Security researchers found over 200 fake GitHub repositories that disguise themselves as legitimate projects to distribute information stealers and remote access trojans (RATs). For almost two years, these repositories have exploited developers’ trust in open-source platforms to access …

  Read More »
• 25 February

  Renew Dubai visa within minutes with AI-powered Salama

  

  Residents of Dubai can now easily renew their visas with the new AI-powered digital platform launched by the General Directorate of Residency and Foreigners Affairs (GDRFA) of Dubai. AI powered “Salama” allows residents to renew their visas in minutes and download the updated documents directly, avoiding paperwork and long wait …

  Read More »
• 25 February

  CVE-2024-20953
  CISA Flags Oracle Agile PLM Actively Exploited Security Flaw

  

  CVE-2024-20953 is a vulnerability in Oracle Agile PLM, a product lifecycle management tool. With a CVSS score of 8.8, it allows low-privileged attackers with HTTP network access to exploit systems running version 9.3.6. This could result in complete system takeover, risking sensitive supply chain data and business operations. The vulnerability …

  Read More »
• 24 February

  Stablecoin Bank Hacked – Hackers Stolen $49.5M

  

  Days after the biggest crypto hack ever, another platform has experienced a major exploit. Infini Earn, a decentralized stablecoin bank, lost $49.5 million in USDC, making it one of the year’s biggest security breaches in DeFi. Reportedly a compromised private key led to an attack that stole 11.4 million and …

  Read More »
• 24 February

  CVE-2025-20029
  PoC Exploit Released for F5 BIG-IP Command Injection Vuln

  

  Security researchers have released a proof-of-concept exploit for CVE-2025-20029, a serious command injection vulnerability in F5’s BIG-IP application delivery controllers. The flaw has a CVSS v3.1 score of 8.8 and allows authenticated attackers to execute arbitrary system commands due to improper handling of special elements in the iControl REST API …

  Read More »
• 24 February

  By 1 April 2025
  Australia Bans Kaspersky on its govt systems and devices

  

  On February 21, the Australian Department of Home Affairs issued a directive prohibiting the installation of Kaspersky Lab products and services on all Australian government systems and devices. The directive under the protective security policy framework (PSPF) mandates federal entities to eliminate “all instances” of Kaspersky’s products. Home Affairs secretary …

  Read More »