CybersecurityBoard.com brings together vulnerability intelligence, security news, MITRE ATT&CK group profiles, cyber events, certifications, training, products, companies and service providers.
CVE-2024-6387 is a critical vulnerability in OpenSSH that was exploited by APT36 in their campaign targeting Afghan telecom and Indian critical infrastructure. The exploit was found on an exposed staging server, indicating the threat…
CVE-2020-9771 is a TCC bypass vulnerability in macOS Catalina that allows malware to access protected data without user consent. AmnesiaStealer exploits this…
Threat actors have begun exploiting a newly disclosed Microsoft SharePoint vulnerability, CVE-2026-55040 (CVSS 9.1), following the public release of a proof-of-concept (PoC)…
A CVSS 9.6 incorrect authorization vulnerability in Adobe ColdFusion that could cause application denial-of-service. Fixed in versions 2025.0.12 and 2023.0.23.
A CVSS 9.1 incorrect authorization vulnerability in Adobe Commerce that could lead to privilege escalation.
A CVSS 10.0 incorrect authorization vulnerability in Adobe Campaign Classic that could allow arbitrary code execution. Fixed in ACC v7 7.4.4 build…
A massive operation involving 737 free VPN and proxy extensions on the Chrome Web Store has been uncovered, primarily targeting Russian-speaking users…
The Picus Blue Report 2026, based on over 338 million attack simulations in production environments, reveals a split in enterprise defense effectiveness.…
A newly disclosed flaw in the way OpenAI, Anthropic, and Google handle hidden AI reasoning between API calls allowed researchers to recover…
Two malicious LiteLLM releases on PyPI, versions 1.82.7 and 1.82.8, were live for about 40 minutes on March 24, 2026, carrying credential-stealing…
OpenAI has launched GPT-5.6-Cyber, a specialized cybersecurity model designed for vulnerability research, penetration testing, and incident response. Built on the GPT-5.6 Sol…
Security researchers created a fictitious cryptocurrency startup and hired three individuals they believe were North Korean IT operatives, as part of an…
APT36, also known as Transparent Tribe, is a Pakistan-aligned threat actor that has historically targeted government, military, and diplomatic organizations in India…
Transparent Tribe was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs,…
North Korean IT workers are increasingly infiltrating government agencies and businesses by applying for remote jobs, passing interviews, and obtaining legitimate credentials.…
The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched Microsoft Windows…
HACKERAI C2 is an AI-assisted malware project that overlaps with PATCHCORD and SHEETCORD but uses GitHub Gists for C2. It implements dedicated…
Afghan telecom providers and South Asian critical infrastructure organizations are the targets of a new campaign delivering a previously undocumented backdoor called…
PATCHCORD is a previously undocumented C/C++ backdoor delivered via fake VPN installers and telecom management tools. It establishes persistence by hijacking browser…
SHEETCORD is a Go-based backdoor that uses Google Sheets API for command-and-control. It is delivered via a fake NIC website and combines…
Microsoft's August 2026 Patch Tuesday included patches for 421 security flaws, including 236 in Windows, and addressed critical vulnerabilities such as CVE-2026-50656,…
USENIX WOOT is a security conference where the research on SIM card attacks was presented. The paper highlights the attack surface of…
The GCIH certification demonstrates proficiency in incident handling and response, often pursued after SANS SEC504 training.
EAL6+ is a high assurance level under the Common Criteria certification, indicating strong resistance to tampering. The Samsung S3D232A chip in Tangem…
The SEC660 course at SANS Network Security 2026 teaches how to leverage AI for automating tasks while maintaining deep manual understanding of…
SANS SEC504 is a training course covering hacker tools, techniques, and incident handling, leading to GCIH certification.
Google Sheets is abused by SHEETCORD for command-and-control communications, allowing the threat actor to issue commands and exfiltrate data via a legitimate…
GitHub Gists is used by the HACKERAI C2 malware for command-and-control, providing a stealthy channel for tasking and data exfiltration.
Chrome DevTools Protocol (CDP) is a protocol that allows tools to inspect and control Chromium-based browsers. AmnesiaStealer abuses CDP to gain interactive…
ANY.RUN Sandbox is an interactive malware analysis environment that allows security teams to safely observe suspicious files, links, and tools in a…
Afghan Telecom (AFTEL) is a state-owned telecommunications company in Afghanistan. Its internal Transport Management System (TMS) and VPN installers are impersonated in…
NorthScan, represented by Heiner García, contributed to the investigation by analyzing infrastructure and behavioral patterns of suspected DPRK operatives, helping to identify…
Enveil is a data security company that was impersonated by Lazarus Group. Attackers created fake websites mimicking Enveil to distribute a trojanized…
Lockheed Martin is a global defense and aerospace company. In the Operation Dream Job campaign, Lazarus Group impersonated recruiters from Lockheed Martin…
AstrillVPN is a VPN service whose exit nodes were identified in the investigation as part of the infrastructure used by suspected DPRK…
Vultr is a cloud infrastructure provider that was used to host the fake crypto startup's infrastructure in the undercover operation. The researchers…
Gorilla Servers is a hosting provider that was used in the undercover operation to host infrastructure. The researchers noted that the operatives'…
Bugcrowd is a crowdsourced security platform that facilitated the disclosure of the RovoBlast vulnerability in Atlassian Rovo. The platform rated the issue…