Cyber ​​Security Hub

The Microsoft SharePoint storage and collaboration platform is a widely used system across many organizations and enterprises. However, a high-severity security vulnerability has recently been discovered and is being actively exploited by threat actors in the wild.

Transferring images, videos, or documents between phones and computers has now become incredibly simple thanks to AirDrop on Apple devices or Quick Share on Android and Windows operating systems. However, this very convenience is inadvertently opening a loophole for cyberattacks, threatening the safety of more than 5 billion devices worldwide.

The Apache Software Foundation (ASF) has recently identified and disclosed two notable security vulnerabilities within Apache Tomcat, a widely used web server component.

In the tech world, Apple is renowned for its stringent security ecosystem. However, a recent discovery by cybersecurity experts has revealed a critical vulnerability embedded directly within the hardware of legacy iPhone models.

Cisco has issued an urgent advisory regarding critical security vulnerabilities within the Cisco Identity Services Engine (ISE) identity management system and the ISE Passive Identity Connector (ISE-PIC) solution.

Mới đây, công ty tình báo mối đe dọa mạng Defused đã phát lời cảnh báo quan trọng về việc hệ thống FortiSandbox của Fortinet đang trở thành mục tiêu trong các cuộc tấn công khai thác lỗ hổng.

ServiceNow has long been a familiar platform for many large enterprises and organizations in managing Information Technology Service Management (ITSM) as well as operating internal workflows. However, a recently published threat intelligence report reveals that this platform is facing a critical security vulnerability, raising major concerns about information security in Software as a Service (SaaS) cloud environments.

Following the previous two vulnerabilities, BlueHammer and RedSun, researcher Chaotic Eclipse has just publicized two new flaws named YellowKey and GreenPlasma, directly threatening the Windows security ecosystem and BitLocker encryption.

Recently, researchers discovered a critical vulnerability dubbed "FlagLeft" within the Microsoft 365 application ecosystem for the Android operating system. This issue threatens the information security of billions of users globally, paving the way for malicious applications to silently hijack account access without requiring any user interaction or permission.

Known for its high security, the Linux ecosystem has just faced a massive challenge. A critical information security vulnerability named CIFSwitch was recently exposed after silently existing for nearly two decades.

A large-scale attack campaign has been uncovered, targeting websites using the Ghost CMS. Although a patch was released several months ago, delayed updates have caused hundreds of websites, including those of reputable organizations, to become tools for distributing malware.

Over the past several years, organizations have invested heavily in defensive layers such as multi-factor authentication (MFA), endpoint protection, and zero trust frameworks. Yet another blind spot is increasingly being exploited by attackers while remaining under-addressed by many security teams: OAuth tokens and third-party application access.

Recently, a critical security vulnerability in Docker Engine was discovered, allowing attackers to bypass access control layers and penetrate deep into host systems.