Our news

  • CISA and Partners Release Advisory Update on Akira Ransomware

    Today, Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the Federal Bureau of Investigation, Department of Defense Cyber Crime Center, Department of Health and Human Services, and international partners, released an updated joint Cybersecurity Advisory, #StopRansomware: Akira Ransomware, to provide network defenders with the latest indicators of compromise, tactics, techniques, and procedures, and detection methods associated with

    READ MORE

  • New Guidance Released on Microsoft Exchange Server Security Best Practices

    Today, CISA, in partnership with the National Security Agency and international cybersecurity partners, released Microsoft Exchange Server Security Best Practices, a guide to help network defenders harden on-premises Exchange servers against exploitation by malicious actors. Threat activity targeting Exchange continues to persist, and organizations with unprotected or misconfigured Exchange servers remain at high risk of

    READ MORE

  • The Truth Behind the “Brushing” Cyber Scam

    Of the various forms of e-commerce fraud, one of the lesser-known yet prevalent kinds is the brushing scam. This scam appears harmless; receivers will simply get a package they never ordered. However, behind every “free gift” is a manipulative operation abusing personal data and online trust. Description:The goal behind brushing scams are to generate fake

    READ MORE

  • Microsoft Releases Out-of-Band Security Update to Mitigate Windows Server Update Service Vulnerability, CVE-2025-59287

    Microsoft released an update to address a critical remote code execution vulnerability impacting Windows Server Update Service (WSUS) in Windows Server (2012, 2016, 2019, 2022, and 2025), CVE-2025-59287, that a prior update did not fully mitigate.  CISA strongly urges organizations to implement Microsoft’s updated Windows Server Update Service (WSUS) Remote Code Execution Vulnerability guidance, 1

    READ MORE

  • CISA Releases 10 Industrial Control Systems Advisories

    CISA released 10 Industrial Control Systems (ICS) advisories. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-294-01 Rockwell Automation 1783-NATR ICSA-25-294-02 Rockwell Automation Compact GuardLogix 5370 ICSA-25-294-03 Siemens SIMATIC S7-1200 CPU V1/V2 Devices ICSA-25-294-04 Siemens RUGGEDCOM ROS Devices ICSA-25-294-05 CloudEdge Online Cameras and App ICSA-25-294-06 Raisecomm RAX701-GC Series ICSMA-25-294-01

    READ MORE

  • CISA Directs Federal Agencies to Mitigate Vulnerabilities in F5 Devices

    Today, CISA issued Emergency Directive ED 26-01: Mitigate Vulnerabilities in F5 Devices to direct Federal Civilian Executive Branch agencies to inventory F5 BIG-IP products, evaluate if the networked management interfaces are accessible from the public internet, and apply newly released updates from F5.  A nation-state affiliated cyber threat actor has compromised F5 systems and exfiltrated

    READ MORE

  • Vulnerability Summary for the Week of September 22, 2025

    High Vulnerabilities PrimaryVendor — Product Description Published CVSS Score Source Info Patch Info FlowiseAI–Flowise Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP

    READ MORE

  • Vulnerability Summary for the Week of September 15, 2025

    High Vulnerabilities PrimaryVendor — Product Description Published CVSS Score Source Info Patch Info Logo Software–Diva Authorization Bypass Through User-Controlled SQL Primary Key, CWE – 89 – Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Logo Software Diva allows SQL Injection, CAPEC – 7 – Blind SQL Injection.This issue affects

    READ MORE

  • Vulnerability Summary for the Week of September 8, 2025

    High Vulnerabilities PrimaryVendor — Product Description Published CVSS Score Source Info Adobe–Acrobat Reader Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must

    READ MORE

  • Vulnerability Summary for the Week of September 1, 2025

    High Vulnerabilities PrimaryVendor — Product Description Published CVSS Score Source Info 1000projects–Beauty Parlour Management System A vulnerability was identified in 1000projects Beauty Parlour Management System 1.0. This affects an unknown function of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to initiate the attack remotely. The exploit

    READ MORE