CrowdCyber - Nostr Hypermedia

Introducing the 2025 State of Threat Intelligence Report: Threat Intelligence Shifts from Defense to Strategy

Discover how 43% of security leaders now use threat intelligence for strategic planning. Explore key insights from the 2025 State of Threat Intelli...

CrowdCyber.com yesterday

The “lc” Leak: Critical 9.3 Severity LangChain Flaw Turns Prompt Injections into Secret Theft

Daily CyberSecurity

The "lc" Leak: Critical 9.3 Severity LangChain Flaw Turns Prompt Injections into Secret Theft

LangChain patches a critical 9.3 CVSS flaw (CVE-2025-68664) where unescaped "lc" keys allow attackers to steal API secrets via prompt injec...

CrowdCyber.com yesterday

A Good Year for North Korean Cybercriminals

Dark Reading

A Good Year for North Korean Cybercriminals

North Korea shifted its strategy to patiently target "bigger fish" for larger payouts, using sophisticated methods to execute attacks at opportune ...

CrowdCyber.com yesterday

Trust Wallet confirms extension hack led to $7 million crypto theft

BleepingComputer

Trust Wallet confirms extension hack led to $7 million crypto theft

Several users of the Trust Wallet Chrome extension report having their cryptocurrency wallets drained after installing a compromised extension upda...

CrowdCyber.com yesterday

MongoDB warns admins to patch severe vulnerability immediately

BleepingComputer

MongoDB warns admins to patch severe vulnerability immediately

MongoDB has warned IT admins to immediately patch a high-severity memory-read vulnerability that may be exploited by unauthenticated attackers remo...

CrowdCyber.com yesterday

Trust Wallet Chrome extension hack tied to millions in losses

BleepingComputer

Trust Wallet confirms extension hack led to $7 million crypto theft

Several users of the Trust Wallet Chrome extension report having their cryptocurrency wallets drained after installing a compromised extension upda...

CrowdCyber.com yesterday

Critical Flaw in Livewire Exposes Laravel Apps to Stealthy RCE, PoC Releases

Daily CyberSecurity

Critical Flaw in Livewire Exposes Laravel Apps to Stealthy RCE, PoC Releases

Synacktiv unmasks CVE-2025-54068, a critical Livewire hydration flaw, and Livepyre, a tool that achieves RCE even if the APP_KEY is known.

CrowdCyber.com yesterday

“Silver Fox” Unmasked: Chinese APT Group Impersonates Indian Tax Officials in Targeted Cyber Campaign

Daily CyberSecurity

"Silver Fox" Unmasked: Chinese APT Group Impersonates Indian Tax Officials in Targeted Cyber Campaign

CloudSEK’s TRIAD unmasks Silver Fox APT, a China-linked group using Valley RAT to target India while hiding behind misattributed tax phishing lures.

CrowdCyber.com 2 days ago

High-Severity Flaws in TeamViewer DEX Allow Attackers to Hijack Nomad Services

Daily CyberSecurity

High-Severity Flaws in TeamViewer DEX Allow Attackers to Hijack Nomad Services

TeamViewer patches high-severity flaws in its DEX line, including CVE-2025-44016, which allows attackers to bypass file integrity and execute code.

CrowdCyber.com 2 days ago

“LotusBail” Trap: 56,000 Developers Downloaded a Fake WhatsApp API That Works perfectly—While Stealing Everything

Daily CyberSecurity

"LotusBail" Trap: 56,000 Developers Downloaded a Fake WhatsApp API That Works perfectly—While Stealing Everything

Koi Security uncovers lotusbail, a malicious npm package with 56k downloads that functions perfectly while stealing WhatsApp credentials and chats.

CrowdCyber.com 2 days ago

The AMX Lockdown: Critical KVM Bug Allows Guest VMs to Crash Linux Hosts

Daily CyberSecurity

The AMX Lockdown: Critical KVM Bug Allows Guest VMs to Crash Linux Hosts

A critical Linux KVM flaw allows guests using Intel AMX to trigger host kernel panics. Fixes are underway for modern kernels (5.17+) to prevent hos...

CrowdCyber.com 2 days ago

Racing the Zombie: PoC Released for Linux Kernel POSIX Timer Vulnerability (CVE-2025-38352)

Daily CyberSecurity

Racing the Zombie: PoC Released for Linux Kernel POSIX Timer Vulnerability (CVE-2025-38352)

PoC exploit for CVE-2025-38352 reveals a critical race condition in Linux POSIX timers, leaving 32-bit Android devices vulnerable to kernel corrupt...

CrowdCyber.com 2 days ago

The Hard-Coded Backdoor: Critical 9.8 Severity NVIDIA Flaws Grant Total Control of AI Systems

Daily CyberSecurity

The Hard-Coded Backdoor: Critical 9.8 Severity NVIDIA Flaws Grant Total Control of AI Systems

NVIDIA patches critical 9.8 severity flaws in Isaac Launchable (CVE-2025-33222) that allow RCE via hard-coded credentials. Upgrade to v1.1 now!

CrowdCyber.com 2 days ago

Hackers Revive 2020 FortiGate Flaw to Bypass 2FA

Daily CyberSecurity

Hackers Revive 2020 FortiGate Flaw to Bypass 2FA

Fortinet warns of active exploits for CVE-2020-12812, where attackers bypass 2FA on FortiGate firewalls by simply changing username capitalization.

CrowdCyber.com 3 days ago

Hackers Weaponize npm to Hunt Critical Infrastructure Sales Teams

Daily CyberSecurity

Hackers Weaponize npm to Hunt Critical Infrastructure Sales Teams

Socket uncovers an npm-based phishing campaign using CDNs to host lures targeting sales teams in critical infrastructure via fake MicroSecure pages.

CrowdCyber.com 3 days ago

Evasive Panda APT Hijacks Dictionary.com and App Updates in Two-Year Spree

Daily CyberSecurity

Evasive Panda APT Hijacks Dictionary.com and App Updates in Two-Year Spree

Kaspersky exposes Evasive Panda’s AitM campaign, hijacking DNS to deliver MgBot through fake updates for SohuVA and Tencent QQ.

CrowdCyber.com 3 days ago

The Hidden Cascade: Why Law Firm Breaches Destroy More than Data

Discover how law firm breaches expose decades of M&A intelligence, client data, and privileged strategy—and how to reduce cascading vendor r...

CrowdCyber.com 3 days ago

The Notarized Nightmare: New MacSync Stealer Bypasses Gatekeeper to Hijack Mac Devices

Daily CyberSecurity

The Notarized Nightmare: New MacSync Stealer Bypasses Gatekeeper to Hijack Mac Devices

Jamf uncovers a new MacSync Stealer variant that was notarized by Apple, allowing it to bypass Gatekeeper and infect Macs without terminal commands.

CrowdCyber.com 3 days ago

Linearizing SHA-256 via fractional modular analysis (Kaoru Method) https://www.reddit.com/r/netsec/comments/1puflky/linearizing_sha256_via_fractional_modular/

CrowdCyber.com 3 days ago

The ghosts of WhatsApp: How GhostPairing hijacks accounts

Malwarebytes

The ghosts of WhatsApp: How GhostPairing hijacks accounts

Criminals are tricking WhatsApp users into linking an attacker’s browser to their account using fake login pages and routine-looking prompts.