Latest Cybersecurity News and Articles
30 July 2025
Tonic Security has emerged from stealth mode to tackle the complexity of exposure and vulnerability management.
The post Tonic Security Launches With $7 Million in Seed Funding appeared first on SecurityWeek.
30 July 2025
Tracked as CVE-2025-6558, the flaw was found in Chrome’s ANGLE and GPU components and was flagged as exploited by Google TAG.
The post Apple Patches Safari Vulnerability Flagged as Exploited Against Chrome appeared first on SecurityWeek.
30 July 2025
Threat actors have been observed exploiting a now-patched critical SAP NetWeaver flaw to deliver the Auto-Color backdoor in an attack targeting a U.S.-based chemicals company in April 2025.
"Over the course of three days, a threat actor gained access to the customer's network, attempted to download several suspicious files and communicated with malicious infrastructure linked to Auto-Color
30 July 2025
Axonius has acquired Cynerio for $100 million in cash and stock to accelerate its expansion into the healthcare market.
The post Axonius Acquires Medical Device Security Firm Cynerio in $100 Million Deal appeared first on SecurityWeek.
30 July 2025
Google Cloud's Mandiant Consulting has revealed that it has witnessed a drop in activity from the notorious Scattered Spider group, but emphasized the need for organizations to take advantage of the lull to shore up their defenses.
"Since the recent arrests tied to the alleged Scattered Spider (UNC3944) members in the U.K., Mandiant Consulting hasn't observed any new intrusions directly
29 July 2025
Tea has said about 72,000 images were leaked online in the initial incident, and another 59,000 images publicly viewable in the app from posts, comments and direct messages were also accessed.
The post Tea App Takes Messaging System Offline After Second Security Issue Reported appeared first on SecurityWeek.
29 July 2025
Vulnerabilities discovered by Binarly in Lenovo devices allow privilege escalation, code execution, and security bypass.
The post Lenovo Firmware Vulnerabilities Allow Persistent Implant Deployment appeared first on SecurityWeek.
29 July 2025
Cybersecurity researchers have disclosed a now-patched critical security flaw in a popular vibe coding platform called Base44 that could allow unauthorized access to private applications built by its users.
"The vulnerability we discovered was remarkably simple to exploit -- by providing only a non-secret app_id value to undocumented registration and email verification endpoints, an attacker
29 July 2025
The maintainers of the Python Package Index (PyPI) repository have issued a warning about an ongoing phishing attack that's targeting users in an attempt to redirect them to fake PyPI sites.
The attack involves sending email messages bearing the subject line "[PyPI] Email verification" that are sent from the email address noreply@pypj[.]org (note that the domain is not "pypi[.]org").
"This is
29 July 2025
The open source security firm will use the investment to enhance go-to-market efforts and accelerate platform expansion.
The post Seal Security Raises $13 Million to Secure Software Supply Chain appeared first on SecurityWeek.
29 July 2025
A newly emerged ransomware-as-a-service (RaaS) gang called Chaos is likely made up of former members of the BlackSuit crew, as the latter's dark web infrastructure has been the subject of a law enforcement seizure.
Chaos, which sprang forth in February 2025, is the latest entrant in the ransomware landscape to conduct big-game hunting and double extortion attacks.
"Chaos RaaS actors initiated
29 July 2025
Promptfoo has raised $18.4 million in Series A funding to help organizations secure LLMs and generative AI applications.
The post Promptfoo Raises $18.4 Million for AI Security Platform appeared first on SecurityWeek.
29 July 2025
The need for secure encryption in IoT and IIoT devices is obvious, and potentially critical for OT and, by extension, much of the critical infrastructure.
The post Order out of Chaos – Using Chaos Theory Encryption to Protect OT and IoT appeared first on SecurityWeek.
29 July 2025
Data reveals global ransomware trends for the first half of 2025.
29 July 2025
Until recently, the cyber attacker methodology behind the biggest breaches of the last decade or so has been pretty consistent:
Compromise an endpoint via software exploit, or social engineering a user to run malware on their device;
Find ways to move laterally inside the network and compromise privileged identities;
Repeat as needed until you can execute your desired attack — usually
29 July 2025
The TCC bypass could expose information cached by Apple Intelligence, including geolocation and biometric data.
The post Sploitlight: macOS Vulnerability Leaks Sensitive Information appeared first on SecurityWeek.
29 July 2025
Dropzone AI has announced a Series B funding round led by Theory Ventures to boost its AI SOC solution.
The post Dropzone AI Raises $37 Million for Autonomous SOC Analyst appeared first on SecurityWeek.
29 July 2025
Cybersecurity researchers have discovered a new, large-scale mobile malware campaign that's targeting Android and iOS platforms with fake dating, social networking, cloud storage, and car service apps to steal sensitive personal data.
The cross-platform threat has been codenamed SarangTrap by Zimperium zLabs. Users in South Korea appear to be the primary focus.
"This extensive campaign involved
29 July 2025
From prompt injection to emergent behavior, today’s curious AI models are quietly breaching trust boundaries.
The post From Ex Machina to Exfiltration: When AI Gets Too Curious appeared first on SecurityWeek.
29 July 2025
React conquered XSS? Think again. That's the reality facing JavaScript developers in 2025, where attackers have quietly evolved their injection techniques to exploit everything from prototype pollution to AI-generated code, bypassing the very frameworks designed to keep applications secure.
Full 47-page guide with framework-specific defenses (PDF, free).
JavaScript conquered the web, but with