CybersecurityBoard.com brings together vulnerability intelligence, security news, MITRE ATT&CK group profiles, cyber events, certifications, training, products, companies and service providers.
Apple paid a $150,000 bounty for a path traversal vulnerability in darwin-init, tracked as CVE-2026-20685, which could allow privileged network attackers to leak sensitive data from Private Cloud Compute.
A newly disclosed zero-day vulnerability in GeoServer is being actively exploited in the wild, according to threat intelligence firm watchTowr. The flaw,…
CVE-2024-6387 is a critical vulnerability in OpenSSH that was exploited by APT36 in their campaign targeting Afghan telecom and Indian critical infrastructure.…
rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending…
CVE-2020-9771 is a TCC bypass vulnerability in macOS Catalina that allows malware to access protected data without user consent. AmnesiaStealer exploits this…
Threat actors have begun exploiting a newly disclosed Microsoft SharePoint vulnerability, CVE-2026-55040 (CVSS 9.1), following the public release of a proof-of-concept (PoC)…
Apple has issued a fresh batch of threat notifications to customers in 110 countries, warning that they may be targeted by mercenary…
Cybersecurity researchers at CTM360 have exposed a large-scale, global recruitment-themed phishing campaign that leverages Browser-in-the-Browser (BitB) windows to steal Google and Facebook…
Cybersecurity researchers at SpecterOps have detailed a post-exploitation technique that enables the Chrome DevTools Protocol (CDP) inside a running Google Chrome or…
A new White House memo signed by U.S. President Donald Trump directs the National Coordination Center (NCC) to establish a program allowing…
This week's ThreatsDay Bulletin covers a wide range of cybersecurity developments, including new attack techniques, data breaches, and product updates. Key highlights…
A massive operation involving 737 free VPN and proxy extensions on the Chrome Web Store has been uncovered, primarily targeting Russian-speaking users…
HoneyMyte was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
Transnational Criminal Organizations (TCOs) are foreign groups that conduct cyber-enabled crimes such as ransomware, phishing, financial fraud, sextortion, and pig butchering scams…
The China-linked threat actor known as Jewelbug has been observed conducting cyber espionage against governments and militaries while simultaneously running a cryptocurrency…
Jewelbug is a China-based hackers-for-hire group that conducts cyber espionage against governments and militaries in the Middle East, Southeast Asia, and South…
Mustang Panda (aka HoneyMyte) has been observed deploying an updated version of the CoolClient backdoor that includes a signed Windows kernel-mode rootkit,…
CoolClient is a modular backdoor used by Mustang Panda. It supports keylogging, clipboard theft, credential harvesting, file management, and system reconnaissance. The…
msagent.sys is a signed Windows kernel-mode driver used by the latest CoolClient variant. It provides stealth by hiding processes, files, registry keys,…
Ransomware is a type of malware deployed by Transnational Criminal Organizations to extort victims. The White House memo highlights ransomware as one…
Microsoft's August 2026 Patch Tuesday included patches for 421 security flaws, including 236 in Windows, and addressed critical vulnerabilities such as CVE-2026-50656,…
USENIX WOOT is a security conference where the research on SIM card attacks was presented. The paper highlights the attack surface of…
The GCIH certification demonstrates proficiency in incident handling and response, often pursued after SANS SEC504 training.
EAL6+ is a high assurance level under the Common Criteria certification, indicating strong resistance to tampering. The Samsung S3D232A chip in Tangem…
The SEC660 course at SANS Network Security 2026 teaches how to leverage AI for automating tasks while maintaining deep manual understanding of…
SANS SEC504 is a training course covering hacker tools, techniques, and incident handling, leading to GCIH certification.
Apple's iPhone displays threat notifications on the Lock Screen and in Settings to alert users who may be targeted by mercenary spyware.…
Lockdown Mode is an Apple security feature that provides an extreme level of protection against sophisticated cyberattacks, including mercenary spyware. Apple recommends…
CDP-Enable-BOF is a Beacon Object File (BOF) developed by SpecterOps that activates the Chrome DevTools Protocol inside an already running Chrome or…
CDP-Toolkit is a tool by SpecterOps that interacts with browsers via the Chrome DevTools Protocol. It supports cookie collection, browser data extraction,…
Nanjing Ranyi Technology Co., Ltd. is a Chinese company whose digital certificate was used to sign the malicious msagent.sys driver. The certificate…
The RecruitTrap campaign also targets Facebook credentials through fake authentication popups, enabling account takeover and potential access to advertising platforms.
Elastic Security provides security analytics and threat hunting solutions. Its labs track threat clusters like REF7707.
Reco identified the City-Forum campaign targeting Salesforce and ServiceNow guest user access, using undocumented techniques to exfiltrate data.
AstrillVPN is a VPN service whose exit nodes were identified in the investigation as part of the infrastructure used by suspected DPRK…
Vultr is a cloud infrastructure provider that was used to host the fake crypto startup's infrastructure in the undercover operation. The researchers…
Gorilla Servers is a hosting provider that was used in the undercover operation to host infrastructure. The researchers noted that the operatives'…
Bugcrowd is a crowdsourced security platform that facilitated the disclosure of the RovoBlast vulnerability in Atlassian Rovo. The platform rated the issue…