CybersecurityBoard.com brings together vulnerability intelligence, security news, MITRE ATT&CK group profiles, cyber events, certifications, training, products, companies and service providers.
GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft Ravie LakshmananJul 17, 2026Malware / Threat Intelligence Cybersecurity researchers have attributed the April 2026 DigiCert security incident to a threat activity cluster dubbed CylindricalCanine.…
CVE-2022-22947 is a remote code execution vulnerability in Spring Cloud Gateway that occurs when the Actuator endpoint is enabled and exposed unsecured.
CVE-2017-12611 is a remote code execution vulnerability in Apache Struts via the Freemarker tag.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution vulnerability in Microsoft SharePoint Server, tracked as…
ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories Ravie LakshmananJul 16, 2026Hacking News / Cybersecurity News A…
A high-severity vulnerability in n8n Enterprise token exchange allows attackers to log in as any user by exploiting missing issuer validation in…
Military forces across the U.S., UK, and NATO are accelerating the fielding of autonomous capabilities, shifting focus from platforms to the trusted…
The European Commission has issued binding specification decisions under the Digital Markets Act, ordering Google to grant rival AI assistants the same…
Armenia has detained a Russian tourist, Aleksandr Ermakov, at Yerevan's Zvartnots airport on June 28, 2026, based on a U.S. extradition warrant…
A new class of attack called Agent Data Injection (ADI) has been disclosed by researchers from Seoul National University, the University of…
Artificial intelligence (AI) is transforming offensive security by accelerating code analysis, payload generation, and testing workflows. However, the core standard of proving…
OpenAI has disclosed details of GPT-Red, an internal automated red-teaming model that scales prompt injection vulnerability discovery to fix issues before tools…
State-sponsored hacking groups from North Korea known for targeting cryptocurrency and sensitive data, often using social engineering and malware.
REvil, also known as Sodinokibi, is a notorious ransomware-as-a-service group that operated from April 2019 to July 2021, targeting over 1,000 victims…
Sodinokibi is the malware variant associated with the REvil ransomware group, used in attacks from April 2019 to July 2021. It is…
TetrisPhantom is a highly skilled and resourceful threat actor first documented by Kaspersky in October 2023. It targets government entities in the…
NadMesh is a Go-based botnet discovered in July 2026 that targets exposed AI services to steal cloud credentials and Kubernetes tokens. It…
A new Go-based botnet named NadMesh has been discovered actively hunting exposed AI services to steal cloud credentials and Kubernetes tokens. First…
North Korean threat actors linked to the Contagious Interview campaign have been observed using steganography in SVG image files to conceal malicious…
SugarLocker is a ransomware variant developed by the Shtazi-IT dev shop, linked to the sanctioned Aleksandr Ermakov. It was sold with a…
Operation Aquila was an 18-month investigation by Australia's signals directorate and federal police that identified Aleksandr Gennadievich Ermakov as the perpetrator behind…
The TfL Hack occurred from August 31 to September 3, 2024, perpetrated by Scattered Spider members. It disrupted services, compromised data, and…
The GCIH certification demonstrates proficiency in incident handling and response, often pursued after SANS SEC504 training.
EAL6+ is a high assurance level under the Common Criteria certification, indicating strong resistance to tampering. The Samsung S3D232A chip in Tangem…
The SEC660 course at SANS Network Security 2026 teaches how to leverage AI for automating tasks while maintaining deep manual understanding of…
SANS SEC504 is a training course covering hacker tools, techniques, and incident handling, leading to GCIH certification.
ComfyUI is a web-based interface for AI image generation models. It is one of the AI services targeted by the NadMesh botnet…
Ollama is a tool for running large language models locally. It is targeted by NadMesh for credential harvesting.
Open WebUI is a web interface for interacting with AI models. It is targeted by NadMesh for credential theft.
Gradio is a Python library for creating web demos of machine learning models. It is targeted by NadMesh.
Shodan is a search engine that scans the internet for exposed devices and services. The NadMesh botnet uses a Shodan harvester to…
Everfox provides a trusted information platform combining hardware-enforced separation with cross-domain information sharing, enabling defense organizations to securely adopt autonomous capabilities at…
The European Commission has adopted binding specification decisions under the Digital Markets Act, requiring Google to open Android features to rival AI…
ENISA, the European Union Agency for Cybersecurity, published a paper emphasizing that security fundamentals matter more than ever in the age of…
A VPN service provider sanctioned by the U.S. Treasury for enabling ransomware actors and cybercriminals to obscure their origins. Operational since 2014,…
Darktrace was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
CrowdSec was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
LevelBlue was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…