#Cybersecurity

Exposed login panels for VPNs and remote access systems significantly increase cybersecurity risks, leading to a higher chance of ransomware attacks and difficulty obtaining cyber insurance.

Meta warns of a serious FreeType vulnerability (CVE-2025-27363), potentially exploited in the wild, allowing remote code execution via out-of-bounds write flaw. The CVSS score of 8.1 highlights its high severity, urging immediate attention.

The 'Ballista' botnet campaign is exploiting a known 2023 vulnerability in TP-Link routers to deploy custom malware, marking a return of attacks previously associated with the Mirai botnet. This highlights the ongoing threat of unsecured IoT devices being leveraged by cybercriminals.

Volt Typhoon, a subgroup of a Chinese APT, compromised a Massachusetts power utility for over 300 days, marking the first known breach of the US electric grid by this group. The attackers aimed to exfiltrate critical OT infrastructure data, raising national security concerns.

GreyNoise reports a surge in coordinated exploitation of SSRF vulnerabilities with over 400 IPs actively targeting multiple CVEs. The activity was observed on March 9, 2025, indicating a significant increase in cyberattack sophistication across various platforms.

The SideWinder APT group has launched cyberattacks on maritime, nuclear, and IT sectors across South Asia, Southeast Asia, the Middle East, and Africa, targeting countries like Bangladesh and Egypt. These attacks, observed in 2024, pose significant threats to critical infrastructure.

The article discusses how democratizing cybersecurity can enhance organizational security, especially for SMBs, by involving more stakeholders in the process. This approach is proposed as a response to the increasing threats across the digital landscape.

ESHYFT, a health tech company, exposed sensitive data of over 86,000 nurses by leaving a 108GB AWS S3 bucket unprotected. This breach included medical records, personal ID documents, and facial images. The security lapse lasted for months before being rectified.

A new wave of DCRat, a remote access Trojan, is being distributed via YouTube as part of a Malware-as-a-Service model. Attackers use video ads to spread the malware, which includes dangerous plugins. Most victims are in Russia, with infrastructure featuring anime-themed domains.