Meridiano
Computers can unintentionally leak data through physical emanations like radio waves, sound, and vibrations, a class of spying known as side-channel or TEMPEST attacks. US lawmakers Senator Ron Wyden and Representative Shontel Brown are launching an investigation into these vulnerabilities, urging the Government Accountability Office to assess the threat to the public. They criticize the government for not warning the public or requiring consumer electronics manufacturers to build in protective countermeasures. The main topics covered are side-channel attacks, the government's historical awareness and internal protections, and the new political push to investigate and potentially mandate defenses in consumer devices.
Articles infosec
Showing articles 151 - 165 of 174 total (matching filters).
-
infosec 3 -
infosec 7A previously undocumented iOS exploit kit named "Coruna," containing 23 exploits and five full chains, has been used in targeted espionage and financially motivated attacks against iOS versions 13.0 through 17.2.1. It was deployed by a surveillance vendor customer and later by Russian cyberspies targeting Ukrainian websites, before being used by a Chinese threat actor on fake gambling and crypto sites to steal cryptocurrency wallet data. The sophisticated kit uses non-public techniques, includes extensive documentation, and can bypass multiple iOS security layers. Its final payload, PlasmaGrid, targets crypto wallets and exfiltrates sensitive data, with its proliferation suggesting an active market for second-hand zero-day exploits.
-
infosec 5Cisco has released patches for two critical vulnerabilities in its Secure Firewall Management Center software: an authentication bypass flaw (CVE-2026-20079) and a remote code execution flaw (CVE-2026-20131), both exploitable remotely to gain root access. These vulnerabilities also affect related cloud-based management tools. Cisco states there is currently no evidence of active exploitation. The company additionally patched numerous other high-severity flaws across its security product portfolio.
-
infosec 3LastPass is warning users about a phishing campaign using fake emails that impersonate support staff. These emails contain urgent alerts about unauthorized account access and direct users to fraudulent login pages to steal credentials. The company confirms its own systems are not compromised and reminds users that legitimate support will never ask for their master password. The main topics covered are the phishing attack methodology, LastPass's response and assurances, and the service's history of being targeted by similar scams.
-
infosec 3Microsoft has released the KB5075039 update to fix a Windows 10 Recovery Environment (WinRE) issue that prevented it from starting, a problem introduced by an October 2025 update. The fix addresses a flaw similar to one previously resolved for Windows 11. Installing the update requires the WinRE partition to be at least 256MB in size, with instructions provided for resizing if necessary. The main topics covered are a software update to repair a broken system recovery tool and the technical requirements for its installation.
-
infosec 7A high-severity command injection vulnerability (CVE-2026-22719) in VMware Aria Operations is being actively exploited, allowing unauthenticated attackers to execute remote commands and potentially gain full control of cloud environments. The U.S. cybersecurity agency CISA has added this flaw to its known exploited vulnerabilities catalog, and Broadcom has acknowledged reports of in-the-wild exploitation. The main risk is that compromising this central cloud management platform grants attackers broad access to the entire virtual infrastructure it manages, including credentials and network topology. Users are urged to immediately patch to version 8.18.6 or apply a provided workaround. The article covers the vulnerability's details, its exploitation status, the significant risk posed by cloud management platform compromises, and the urgent mitigation steps.
-
infosec 6A critical vulnerability (CVE-2026-28289) in the FreeScout helpdesk platform allows unauthenticated, remote code execution via a malicious email attachment. Attackers bypass a previous patch by using a zero-width space character in a filename, which circumvents security checks and enables server compromise. The flaw affects all versions up to 1.8.206, is patched in version 1.8.207, and requires immediate updating. While no active exploits are currently reported, the risk is considered high due to the vulnerability's severity and ease of exploitation.
The main topics covered are the technical details of a severe software vulnerability, its method of exploitation, the affected software versions and patch status, and the potential consequences and recommendations for mitigation.
-
infosec 4Bitwarden now allows users to log into Windows 11 devices using passkeys stored in its vault, providing phishing-resistant authentication. The feature requires Entra ID-joined devices with FIDO2 security key sign-in enabled and a registered Entra ID passkey in the vault. It works by scanning a QR code with a mobile device to confirm access, removing passwords from the login process. This extends Microsoft's passkey provider API to the operating system's fundamental authentication layer.
-
infosec 5A joint international law enforcement operation has dismantled LeakBase, a major online cybercriminal forum with over 142,000 members. The forum specialized in selling stolen data like account credentials and financial information, as well as cybercrime tools. The takedown, part of "Operation Leak," involved arrests and enforcement actions across multiple countries, with the FBI seizing the site and all its data. The main topics covered are the forum's criminal activities, its scale, the international law enforcement operation, and the seizure of its assets.
-
infosec 6Tycoon 2FA, a major phishing-as-a-service platform, has been dismantled by a coalition of law enforcement and security companies. The subscription-based kit enabled large-scale credential harvesting by intercepting usernames, passwords, MFA codes, and session cookies, allowing attackers to bypass authentication even after password resets. It was used to target hundreds of thousands of organizations globally, generating tens of millions of phishing emails monthly by impersonating trusted services like Microsoft 365 and Gmail. The operation took down 330 domains that formed the backbone of the criminal service.
-
infosec 6A Russian national, Evgenii Ptitsyn, pleaded guilty to wire fraud conspiracy for administering the Phobos ransomware operation, which extorted over $39 million from more than 1,000 victims globally. Ptitsyn oversaw the ransomware-as-a-service model, selling access to affiliates who targeted entities like schools and hospitals, and he collected fees for decryption keys. The article also details "Operation Aether," an international law enforcement effort that disrupted the gang by making arrests and seizing infrastructure. The main topics covered are Ptitsyn's guilty plea and role, the Phobos ransomware operation's impact, and coordinated law enforcement actions against it.
-
.jpg)
infosec 3Elie Habib, CEO of music streaming service Anghami, created an open-source real-time conflict monitoring dashboard called World Monitor as a personal project. The platform aggregates and visualizes over 100 global data streams, including military movements and infrastructure status, on an interactive map. Initially a weekend coding challenge, it went viral and attracted a diverse global audience following regional escalations. The tool addresses a gap in affordable, real-time open-source intelligence by applying data processing principles from Habib's streaming media background.
-
infosec 6A new Russian cyber campaign attributed to APT28 is targeting Ukrainian entities with two new malware families, BadPaw and MeowMeow. The attack begins with a phishing email containing a link that leads to a ZIP archive, which deploys a loader (BadPaw) and then a sophisticated backdoor (MeowMeow). The malware uses multiple decoys and sandbox evasion techniques, only activating its malicious functions under specific, controlled conditions. The main topics covered are the disclosure of the cyber campaign, the technical details of the attack chain, and the attribution to a Russian state-sponsored threat actor.
-
infosec 6Cisco warns that two security flaws in its Catalyst SD-WAN Manager software are being actively exploited, urging customers to upgrade. The vulnerabilities, an arbitrary file overwrite and an information disclosure flaw, affect the network management software regardless of configuration. This follows a separate disclosure of a critical, long-exploited authentication bypass vulnerability in the same product line. U.S. authorities have issued directives for federal agencies to address these threats. Cisco has also recently patched two maximum-severity vulnerabilities in its Secure Firewall Management Center software.
-
infosec 5The article explains that Multi-Factor Authentication (MFA) often fails to protect Windows environments because many common authentication paths bypass cloud-based identity providers. It details seven specific Windows authentication methods that attackers exploit using stolen credentials, including interactive logons, RDP, NTLM, and Kerberos. These methods rely on Active Directory and do not trigger standard MFA prompts. The core issue is the lack of MFA coverage across all authentication vectors, leaving networks vulnerable to credential-based attacks.