Blog

The latest news and developments

Latest Blogs and News

Secora Consulting’s blog is a mixture of news and developments in the security world and technical breakdowns of our services. Bookmark this page to stay informed.

Cybersecurity News

This Week in Cybersecurity: Looking Back at Week 5

This Weeks Headlines DeepSeek AI Database Exposed: Over 1 Million Log Lines, Secret Keys Leaked New SLAP and FLOP Attacks Expose Speculative Execution Vulnerabilities in Apple M-Series Chips Law Enforcement Dismantles Two Major Cybercrime Forums British Museum Restores Operations After Alleged IT Attack by Former Contractor OAuth Redirect Vulnerability in Airline Travel Integration Exposes Millions to Account Hijacking GitHub Desktop Vulnerability Exposes User Credentials via Malicious URLs Meta’s Llama Framework Vulnerability Allows Remote Code Execution DeepSeek AI Database Exposed: Over 1 Million Log Lines, Secret Keys Leaked Chinese AI startup DeepSeek inadvertently left a ClickHouse database exposed on the internet, allowing unauthorized access to sensitive information.

SME Cybersecurity

Understanding Common Vulnerabilities in 2025

As we progress through 2025, businesses are confronting unprecedented digital challenges, leading to a complex and ever-evolving risk landscape for organisations of all sizes. Cyber threats alone have surged by an alarming 300% year-over-year. Small and medium-sized enterprises (SMEs) are particularly vulnerable, often lacking the resources or expertise to defend against sophisticated cyber threats. Understanding these vulnerabilities is the first step toward effective protection. In this blog, we’ll explore the most prevalent cybersecurity threats of 2025, their impact on SMEs, and actionable strategies to mitigate risks.

Cybersecurity Alert

Critical Vulnerability in Fortinet FortiOS and FortiProxy

The National Cyber Security Centre (NCSC) has issued an advisory regarding a critical vulnerability, CVE-2024-55591, impacting Fortinet’s FortiOS and FortiProxy products. This vulnerability is particularly severe, with a CVSS score of 9.6, signifying a critical risk to affected systems. Impact of the Vulnerability The vulnerability stems from an authentication bypass using an alternate path or channel (CWE-288). Exploiting this flaw allows a remote attacker to achieve super-admin privileges through carefully crafted requests directed to the Node.

News

Phishing Attacks in Europe: Who is Most at Risk?

Phishing has rapidly evolved into one of the most significant cyber threats across Europe. According to recent data, the volume of phishing attacks targeting organisations in Europe increased by 112.4% between April 2023 and April 2024, underscoring the growing sophistication and prevalence of phishing attempts that exploit vulnerabilities in both personal and corporate digital practices. Why Phishing Demands Your Attention In this blog, we’ll cover: The latest phishing statistics in Europe Why this issue is critical for businesses and individuals Practical, actionable tips to defend against phishing attacks Headlines Phishing Defence Trends: Short-Term Gains, Long-Term Challenges, and Emerging AI Threats Emerging AI Threats What Drives the Phishing Surge?

News

Critical Vulnerabilities in Hewlett Packard Enterprise (HPE) Insight Remote Support

Hewlett Packard Enterprise (HPE) has disclosed multiple critical vulnerabilities in its Insight Remote Support software, with the most severe carrying a CVSS v3.0 score of 9.8. These vulnerabilities pose significant security risks, including remote directory traversal, information disclosure, and potential code execution. Overview of the Vulnerabilities The vulnerabilities impact versions of HPE Insight Remote Support prior to v7.14.0.629. A breakdown of the CVEs, their descriptions, and potential impacts is provided below:

Cybersecurity Alert

Palo Alto Networks Expedition Vulnerability Puts Admin Accounts at Risk

In July 2024, a critical vulnerability, CVE-2024-5910, was identified in Palo Alto Networks’ Expedition tool. This vulnerability, which scores a 9.3 on the CVSS 3.0 scale, exposes Expedition to a significant risk of admin account takeover by unauthorised parties with network access to the tool. As organisations increasingly rely on automation tools like Expedition for configuration migration, tuning, and enrichment, this security flaw is one that affected users cannot afford to overlook.