Blog

The latest news and developments

Latest Blogs and News

Secora Consulting’s blog is a mixture of news and developments in the security world and technical breakdowns of our services. Bookmark this page to stay informed.

Cybersecurity News

This Week in Cybersecurity: Looking Back at Week 7

This Weeks Headlines Microsoft’s February Patch Tuesday Addresses 63 Vulnerabilities, Including Two Actively Exploited Elevation of Privilege Flaws Ivanti Releases Patches for Critical Vulnerabilities in Connect Secure and Policy Secure HSE Faces Nearly 500 Legal Actions Following €102 Million Cyberattack New Exploit Bypasses Patched NVIDIA Container Toolkit Vulnerability FINALDRAFT Malware Exploits Microsoft Graph API for Espionage on Windows and Linux Microsoft’s February Patch Tuesday Addresses 63 Vulnerabilities, Including Two Actively Exploited Elevation of Privilege Flaws On February 12, 2025, Microsoft released security updates addressing 63 vulnerabilities across its software products.

Cyber Advisory

The Path to Operational Resilience: Key Considerations for Credit Unions

In a time where business disruptions and cybersecurity incidents are inevitable, operational resilience has become a prominent focus area for the Central Bank of Ireland (CBI). The CBI released Cross Industry Guidance on Operational Resilience in December 2021 and set a deadline for financial services to fully implement their guidance by December 2023. As we move into 2025, financial institutions are expected to demonstrate that their operational resilience strategies are fully aligned with the guidance.

Cybersecurity News

This Week in Cybersecurity: Looking Back at Week 6

This Weeks Headlines Phishing Campaign Exploits Microsoft ADFS to Bypass MFA and Hijack Accounts Chrome 133 and Firefox 135 Release Patches for High-Severity Vulnerabilities AsyncRAT Malware Campaign Leverages Python Payloads and Cloudflare Tunnels for Stealthy Attacks Malicious Go Package Exploits Module Mirror Caching for Persistent Remote Access Malvertising Campaign Targets Microsoft Advertisers via Fake Google Ads Zyxel Declines to Patch Exploited Zero-Day Vulnerabilities in Legacy DSL Devices Critical Veeam Vulnerability Allows Remote Code Execution via Man-in-the-Middle Attacks California Man Sentenced to Seven Years for $50 Million Financial Fraud Scheme Phishing Campaign Exploits Microsoft ADFS to Bypass MFA and Hijack Accounts A sophisticated phishing campaign is targeting Microsoft Active Directory Federation Services (ADFS) to bypass multifactor authentication (MFA) and take over user accounts.

Cybersecurity News

This Week in Cybersecurity: Looking Back at Week 5

This Weeks Headlines DeepSeek AI Database Exposed: Over 1 Million Log Lines, Secret Keys Leaked New SLAP and FLOP Attacks Expose Speculative Execution Vulnerabilities in Apple M-Series Chips Law Enforcement Dismantles Two Major Cybercrime Forums British Museum Restores Operations After Alleged IT Attack by Former Contractor OAuth Redirect Vulnerability in Airline Travel Integration Exposes Millions to Account Hijacking GitHub Desktop Vulnerability Exposes User Credentials via Malicious URLs Meta’s Llama Framework Vulnerability Allows Remote Code Execution DeepSeek AI Database Exposed: Over 1 Million Log Lines, Secret Keys Leaked Chinese AI startup DeepSeek inadvertently left a ClickHouse database exposed on the internet, allowing unauthorized access to sensitive information.

SME Cybersecurity

Understanding Common Vulnerabilities in 2025

As we progress through 2025, businesses are confronting unprecedented digital challenges, leading to a complex and ever-evolving risk landscape for organisations of all sizes. Cyber threats alone have surged by an alarming 300% year-over-year. Small and medium-sized enterprises (SMEs) are particularly vulnerable, often lacking the resources or expertise to defend against sophisticated cyber threats. Understanding these vulnerabilities is the first step toward effective protection. In this blog, we’ll explore the most prevalent cybersecurity threats of 2025, their impact on SMEs, and actionable strategies to mitigate risks.

Cybersecurity Alert

Critical Vulnerability in Fortinet FortiOS and FortiProxy

The National Cyber Security Centre (NCSC) has issued an advisory regarding a critical vulnerability, CVE-2024-55591, impacting Fortinet’s FortiOS and FortiProxy products. This vulnerability is particularly severe, with a CVSS score of 9.6, signifying a critical risk to affected systems. Impact of the Vulnerability The vulnerability stems from an authentication bypass using an alternate path or channel (CWE-288). Exploiting this flaw allows a remote attacker to achieve super-admin privileges through carefully crafted requests directed to the Node.