1-Click Oracle Cloud Code Editor RCE Vulnerability Lets Attackers Upload Malicious Files

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A critical Remote Code Execution (RCE) vulnerability in Oracle Cloud Infrastructure (OCI) Code Editor that allowed attackers to silently hijack victim Cloud Shell environments through a single click.  The vulnerability, now remediated, affected Code Editor’s integrated services, including Resource Manager, …

GhostContainer Malware Hacking Exchange Servers in the Wild Using N-day Vulnerability

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A highly sophisticated malware campaign targeting Microsoft Exchange servers in government and high-tech organizations across Asia.  The malware, dubbed GhostContainer, exploits known N-day vulnerabilities to establish persistent backdoor access to critical infrastructure. Key Takeaways 1. GhostContainer uses CVE-2020-0688 vulnerability to …

DOGE Denizen Marko Elez Leaked API Key for xAI

Blog WriterCybersecurity News - Original News Source is krebsonsecurity.com

Marko Elez, a 25-year-old employee at Elon Musk’s Department of Government Efficiency (DOGE), has been granted access to sensitive databases at the U.S. Social Security Administration, the Treasury and Justice departments, and the Department of Homeland Security. So it should …

UK Arrests Four in ‘Scattered Spider’ Ransom Group

Blog WriterCybersecurity News - Original News Source is krebsonsecurity.com

Authorities in the United Kingdom this week arrested four people aged 17 to 20 in connection with recent data theft and extortion attacks against the retailers Marks & Spencer and Harrods, and the British food retailer Co-op Group. The breaches …

Microsoft Patch Tuesday, July 2025 Edition

Blog WriterCybersecurity News - Original News Source is krebsonsecurity.com

Microsoft today released updates to fix at least 137 security vulnerabilities in its Windows operating systems and supported software. None of the weaknesses addressed this month are known to be actively exploited, but 14 of the flaws earned Microsoft’s most-dire …

Big Tech’s Mixed Response to U.S. Treasury Sanctions

Blog WriterCybersecurity News - Original News Source is krebsonsecurity.com

In May 2025, the U.S. government sanctioned a Chinese national for operating a cloud provider linked to the majority of virtual currency investment scam websites reported to the FBI. But a new report finds the accused continues to operate a …

Senator Chides FBI for Weak Advice on Mobile Security

Blog WriterCybersecurity News - Original News Source is krebsonsecurity.com

Agents with the Federal Bureau of Investigation (FBI) briefed Capitol Hill staff recently on hardening the security of their mobile devices, after a contacts list stolen from the personal phone of the White House Chief of Staff Susie Wiles was …

Ninth US Telecom Breached by Chinese Hackers – Texts & Calls Records Stolen

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

The White House has confirmed that a ninth U.S. telecommunications company has fallen victim to the ‘Salt Typhoon’ campaign, a sophisticated cyberattack attributed to Chinese hackers. This breach, which has now impacted at least nine major telecom providers in the …

Volkswagen Data Breach: 800,000 Electric Car Owners’ Data Leaked

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Volkswagen has inadvertently exposed the personal information of 800,000 electric vehicle owners, including their location data and contact details. The breach, which occurred due to a misconfiguration in the systems of Cariad, VW’s software subsidiary, left sensitive data stored on …

Cyberhaven Chrome Extension Hacked to Inject Malicious Scripts

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Cyberhaven, a leading provider of data loss prevention (DLP) solutions, disclosed a significant security breach involving its Chrome extension. On December 24, 2024, a targeted cyberattack compromised an administrator account, allowing attackers to publish a malicious update (version 24.10.4) to …