❌

Vue normale

Il y a de nouveaux articles disponibles, cliquez pour rafraîchir la page.
Aujourd’hui — 15 mai 2025Securité

Qu’est-ce que la stratégie 3-2-1-1-0 en cybersécurité ? [Sponso]

✇Cyberguerre
Par : humanoid xp
15 mai 2025 à 15:56

Cet article a été réalisé en collaboration avec Synology

En matière de protection des données, créer une sauvegarde et la mettre à jour régulièrement constitue un excellent moyen d’éviter la plupart des accidents. Du moins, pour les particuliers ou les petites structures. Car lorsque le volume de données, ou le nombre d’utilisateurs est élevé, un simple backup n’est plus suffisant.

Cet article a été réalisé en collaboration avec Synology

Il s’agit d’un contenu créé par des rédacteurs indépendants au sein de l’entité Humanoid xp. L’équipe éditoriale de Numerama n’a pas participé à sa création. Nous nous engageons auprès de nos lecteurs pour que ces contenus soient intéressants, qualitatifs et correspondent à leurs intérêts.

En savoir plus

Pen Testing for Compliance Only? It's Time to Change Your Approach

✇The Hacker News
Par : [email protected] (The Hacker News)
15 mai 2025 à 13:25
Imagine this: Your organization completed its annual penetration test in January, earning high marks for security compliance. In February, your development team deployed a routine software update. By April, attackers had already exploited a vulnerability introduced in that February update, gaining access to customer data weeks before being finally detected. This situation isn't theoretical: it

5 BCDR Essentials for Effective Ransomware Defense

✇The Hacker News
Par : [email protected] (The Hacker News)
15 mai 2025 à 12:30
Ransomware has evolved into a deceptive, highly coordinated and dangerously sophisticated threat capable of crippling organizations of any size. Cybercriminals now exploit even legitimate IT tools to infiltrate networks and launch ransomware attacks. In a chilling example, Microsoft recently disclosed how threat actors misused its Quick Assist remote assistance tool to deploy the destructive

Russia-Linked APT28 Exploited MDaemon Zero-Day to Hack Government Webmail Servers

✇The Hacker News
Par : [email protected] (The Hacker News)
15 mai 2025 à 12:05
A Russia-linked threat actor has been attributed to a cyber espionage operation targeting webmail servers such as Roundcube, Horde, MDaemon, and Zimbra via cross-site scripting (XSS) vulnerabilities, including a then-zero-day in MDaemon, according to new findings from ESET. The activity, which commenced in 2023, has been codenamed Operation RoundPress by the Slovak cybersecurity company. It has

Malicious npm Package Leverages Unicode Steganography, Google Calendar as C2 Dropper

✇The Hacker News
Par : [email protected] (The Hacker News)
15 mai 2025 à 12:00
Cybersecurity researchers have discovered a malicious package named "os-info-checker-es6" that disguises itself as an operating system information utility to stealthily drop a next-stage payload onto compromised systems. "This campaign employs clever Unicode-based steganography to hide its initial malicious code and utilizes a Google Calendar event short link as a dynamic dropper for its final

New Chrome Vulnerability Enables Cross-Origin Data Leak via Loader Referrer Policy

✇The Hacker News
Par : [email protected] (The Hacker News)
15 mai 2025 à 08:15
Google on Wednesday released updates to address four security issues in its Chrome web browser, including one for which it said there exists an exploit in the wild. The high-severity vulnerability, tracked as CVE-2025-4664 (CVSS score: 4.3), has been characterized as a case of insufficient policy enforcement in a component called Loader. "Insufficient policy enforcement in Loader in Google

Hier — 14 mai 2025Securité

Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit

✇The Hacker News
Par : [email protected] (The Hacker News)
14 mai 2025 à 19:57
Samsung has released software updates to address a critical security flaw in MagicINFO 9 Server that has been actively exploited in the wild. The vulnerability, tracked as CVE-2025-4632 (CVSS score: 9.8), has been described as a path traversal flaw. "Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to

BianLian and RansomExx Exploit SAP NetWeaver Flaw to Deploy PipeMagic Trojan

✇The Hacker News
Par : [email protected] (The Hacker News)
14 mai 2025 à 19:50
At least two different cybercrime groups BianLian and RansomExx are said to have exploited a recently disclosed security flaw in SAP NetWeaver tracked as CVE-2025-31324, indicating that multiple threat actors are taking advantage of the bug. Cybersecurity firm ReliaQuest, in a new update published today, said it uncovered evidence suggesting involvement from the BianLian data extortion crew and

Xinbi Telegram Market Tied to $8.4B in Crypto Crime, Romance Scams, North Korea Laundering

✇The Hacker News
Par : [email protected] (The Hacker News)
14 mai 2025 à 17:27
A Chinese-language, Telegram-based marketplace called Xinbi Guarantee has facilitated no less than $8.4 billion in transactions since 2022, making it the second major black market to be exposed after HuiOne Guarantee. According to a report published by blockchain analytics firm Elliptic, merchants on the marketplace have been found to peddle technology, personal data, and money laundering

❌
❌