Blog

The latest news and developments

Explore a blend of security news, industry developments, and in-depth technical analysis of our services on Secora Consulting's blog. Bookmark this page to stay informed.

Latest Blogs and News

Secora Consulting’s blog is a mixture of news and developments in the security world and technical breakdowns of our services. Bookmark this page to stay informed.

Cybersecurity News

This Week in Cybersecurity: Looking Back at Week 7

This Weeks Headlines Microsoft’s February Patch Tuesday Addresses 63 Vulnerabilities, Including Two Actively Exploited Elevation of Privilege Flaws Ivanti Releases Patches for Critical Vulnerabilities in Connect Secure and Policy Secure HSE Faces Nearly 500 Legal Actions Following €102 Million Cyberattack New Exploit Bypasses Patched NVIDIA Container Toolkit Vulnerability FINALDRAFT Malware Exploits Microsoft Graph API for Espionage on Windows and Linux Microsoft’s February Patch Tuesday Addresses 63 Vulnerabilities, Including Two Actively Exploited Elevation of Privilege Flaws On February 12, 2025, Microsoft released security updates addressing 63 vulnerabilities across its software products.

Cyber Advisory

The Path to Operational Resilience: Key Considerations for Credit Unions

In a time where business disruptions and cybersecurity incidents are inevitable, operational resilience has become a prominent focus area for the Central Bank of Ireland (CBI). The CBI released Cross Industry Guidance on Operational Resilience in December 2021 and set a deadline for financial services to fully implement their guidance by December 2023. As we move into 2025, financial institutions are expected to demonstrate that their operational resilience strategies are fully aligned with the guidance.

Cybersecurity News

This Week in Cybersecurity: Looking Back at Week 6

This Weeks Headlines Phishing Campaign Exploits Microsoft ADFS to Bypass MFA and Hijack Accounts Chrome 133 and Firefox 135 Release Patches for High-Severity Vulnerabilities AsyncRAT Malware Campaign Leverages Python Payloads and Cloudflare Tunnels for Stealthy Attacks Malicious Go Package Exploits Module Mirror Caching for Persistent Remote Access Malvertising Campaign Targets Microsoft Advertisers via Fake Google Ads Zyxel Declines to Patch Exploited Zero-Day Vulnerabilities in Legacy DSL Devices Critical Veeam Vulnerability Allows Remote Code Execution via Man-in-the-Middle Attacks California Man Sentenced to Seven Years for $50 Million Financial Fraud Scheme Phishing Campaign Exploits Microsoft ADFS to Bypass MFA and Hijack Accounts A sophisticated phishing campaign is targeting Microsoft Active Directory Federation Services (ADFS) to bypass multifactor authentication (MFA) and take over user accounts.

Cybersecurity News

This Week in Cybersecurity: Looking Back at Week 5

This Weeks Headlines DeepSeek AI Database Exposed: Over 1 Million Log Lines, Secret Keys Leaked New SLAP and FLOP Attacks Expose Speculative Execution Vulnerabilities in Apple M-Series Chips Law Enforcement Dismantles Two Major Cybercrime Forums British Museum Restores Operations After Alleged IT Attack by Former Contractor OAuth Redirect Vulnerability in Airline Travel Integration Exposes Millions to Account Hijacking GitHub Desktop Vulnerability Exposes User Credentials via Malicious URLs Meta’s Llama Framework Vulnerability Allows Remote Code Execution DeepSeek AI Database Exposed: Over 1 Million Log Lines, Secret Keys Leaked Chinese AI startup DeepSeek inadvertently left a ClickHouse database exposed on the internet, allowing unauthorized access to sensitive information.

Cybersecurity News

This Week in Cybersecurity: Looking Back at Week 4

CISA Adds Five-Year-Old jQuery XSS Flaw to Exploited Vulnerabilities List Hundreds of Fake Reddit Sites Push Lumma Stealer Malware Ivanti Vulns Chained Together in Cyberattack Onslaught SonicWall Warns of SMA1000 RCE Flaw Exploited in Zero-Day Attacks Stealthy ‘Magic Packet’ Malware Targets Juniper VPN Gateways Fake Homebrew Google Ads Target Mac Users with Malware CISA Adds Five-Year-Old jQuery XSS Flaw to Exploited Vulnerabilities List The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a now-patched cross-site scripting (XSS) vulnerability (CVE-2020-11023) affecting the widely-used jQuery JavaScript library to its Known Exploited Vulnerabilities (KEV) catalog.

Cybersecurity News

This Week in Cybersecurity: Looking Back at Week 3

This Weeks Headlines Microsoft Patches Three Actively Exploited Zero-Day Vulnerabilities in January Update Google OAuth Vulnerability Exposes User Accounts via Abandoned Domains Fortinet Warns of Zero-Day Exploit Targeting Exposed Firewall Interfaces Expired Domains Enable Control Over Thousands of Compromised Systems Phishing Scam Impersonates CrowdStrike to Deploy XMRig Cryptominer Stealthy Credit Card Skimmer Targets WordPress E-commerce Sites via Database Injection AI-Driven Ransomware Group FunkSec Targets Over 85 Victims Using Double Extortion Tactics Microsoft MFA Outage Blocks Access to Microsoft 365 Apps Hackers Exploit Critical Aviatrix Controller Vulnerability to Deploy Backdoors and Crypto Miners Codefinger Ransomware Group Exploits Compromised AWS Credentials in Extortion Attacks Microsoft Patches Three Actively Exploited Zero-Day Vulnerabilities in January Update Microsoft’s January 2025 security update addresses 161 vulnerabilities, including three zero-day flaws in Windows Hyper-V NT Kernel Integration VSP (CVE-2025-21333, CVE-2025-21334, and CVE-2025-21335) that have been actively exploited.