Do Son WordPress, the world's most popular CMS, is facing a significant security threat in the form of a widespread supply chain attack
Do Son
Do Son is the Founder and Editor of Daily CyberSecurity. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.
One of the most critical vulnerabilities (CVE-2024-6246) is a heap-based buffer overflow in the Realtek Wi-Fi driver of Wyze Cam v3
The attacks utilize a previously undocumented backdoor, dubbed "Niki", showcasing the evolving tactics of these persistent threat actors
CVE-2024-29868 stems from the platform's use of a weak random number generator in its user self-registration and password recovery processes
cybersecurity researcher Andreas Pfefferle at Redguard has unearthed five critical security vulnerabilities in Bludit
Insikt Group have revealed a widespread cyber espionage campaign orchestrated by a Chinese state-sponsored group known as RedJuliett
A security researcher has published details and proof-of-concept (PoC) code for a CVE-2024-27815 vulnerability in the XNU kernel
GrimResource technique capitalizes on an old XSS vulnerability in the apds.dll library, enabling attackers to execute arbitrary JavaScript code
The active exploitation of CVE-2024-29973 by a Mirai-like botnet underscores the urgency of applying the necessary security patches
Advanced Persistent Threat (APT) group APT-C-35, also known as DoNot Team, has been identified as one of the actors employing Rafel RAT
Tracked as CVE-2024-5756 (CVSS 9.8), the flaw allows unauthenticated attackers to inject malicious code into the plugin's database queries
A new ransomware-as-a-service (RaaS) called RansomHub has emerged, targeting Windows, Linux, and ESXi operating systems
In a recent report, the eSentire Threat Response Unit (TRU) has uncovered a sophisticated adware strain dubbed AdsExhaust
The flaw, designated CVE-2024-2003 (CVSS 7.3) and discovered by the Zero Day Initiative, could have allowed attackers to escalate privileges
Cisco Talos identified the SneakyChef group after observing a series of cyberattacks using the SugarGh0st RAT to target users
ANY.RUN, a popular malware analysis service, has reported a recent security incident involving a phishing attack
The vulnerability, tracked as CVE-2024-6027 (CVSS 9.8), could allow attackers to extract sensitive information from a store's database
The flaw, designated CVE-2024-28397 and assigned a high CVSS score of 8.8, enables malicious actors to break out of the JavaScript sandbox
The vulnerability, identified as CVE-2024-36680, allows unauthorized users to inject malicious SQL code into the website's database
A newly discovered vulnerability dubbed "CosmicSting" (CVE-2024-34102) has sent shockwaves through the e-commerce world
Given the critical nature of these vulnerabilities, it is imperative for all Ghostscript users to update to version 10.03.1 immediately
From early to mid-June 2024, the Zergeca botnet primarily targeted regions such as Canada, the United States, and Germany