Latest issue of my curated #cybersecurity and #infosec list of resources for week #18/2025 is out!

It includes the following and much more:

France has linked Russian APT to 12 #cyberattacks on French Orgs.;

Cybersecurity experts demand the reinstatement of Chris Krebs' security clearances and the withdrawal of the investigation;

#Vulnerabilities in Apple's #AirPlay Protocol;

New York's Metropolitan Transportation Authority plans to use #AI and cameras to detect potential subway crimes before they happen;

@SentinelOne Targeted by Chinese #PurpleHaze Group;

#Microsoft sets all new accounts #passwordless by default;

The #Trump administration plans to cut $491 million from #CISA's budget;

Subscribe to the #infosecMASHUP newsletter to have it piping hot in your inbox every week-end

https://infosec-mashup.santolaria.net/p/infosec-mashup-18-2025

Year of the Twin Dragons: Developers Must Slay the Complexity and Security Issues of AI Coding Tools https://www.securityweek.com/year-of-the-twin-dragons-developers-must-slay-the-complexity-and-security-issues-of-ai-coding-tools/ #ArtificialIntelligence #Vulnerabilities #vulnerabilities #Development #Code

A couple of days ago, I unearthed my first #computer, an #MSX straight from the ‘80s. It was lost in some box in the basement for who knows how long. Just feeling its power switch gave me the goosebumps…

This discovery came after sharing my hacker’s origin story with Nic Fillingham and Wendy Zenone in a new episode of Microsoft’s #BlueHat #Podcast.

https://thecyberwire.com/podcasts/the-bluehat-podcast/52/notes

Join us while we chat about my first-ever #CVE, overlooked #vulnerabilities that continue to pose significant risks today, #ActiveDirectory and #password security, my unexpected journey into #bugbounty hunting and my involvement in the #ZeroDayQuest, how to learn new things, mentorship and positive leadership, and of course pineapple pizza

Researchers have revealed that defenses against "juice jacking" on #iOS and #Android can be easily bypassed.

Malicious chargers exploit #USB #vulnerabilities to steal #data.

The new "ChoiceJacking" technique allows attackers to #spoof user consent and access sensitive files.

Avoid using public charging USB ports to #protect your data.

https://arstechnica.com/security/2025/04/ios-and-android-juice-jacking-defenses-have-been-trivial-to-bypass-for-years/

#4chan has partially resumed operations after a significant #hack that exposed #vulnerabilities and led to a nearly two-week #shutdown.

The site attributes its struggles to financial constraints and pressure from advertisers, which have limited its ability to maintain #security.

4chan's team remains defiant, emphasizing the site's unique role in online culture.

https://techcrunch.com/2025/04/27/4chan-is-back-online-says-its-been-starved-of-money/

Seven new GNAs have been registered on GCVE.EU !

We're glad to see the community grow and are open to new GNA applications

JSON https://gcve.eu/dist/gcve.json
Why and How to become a GNA https://gcve.eu/about/#eligibility-and-process-to-obtain-a-gna-id

Latest issue of my curated #cybersecurity and #infosec list of resources for week #17/2025 is out!

It includes the following and much more:

Two top officials from #CISA resigned;

U.S. Defense Secretary Pete Hegseth caught in another information leak;

Yearly Threat Intelligence Reports Released;

U.S. lost record $16.6 billion to #cybercrime in 2024;

5.5 Million Patients Affected by #DataBreach at Yale New Haven Health;

VulnCheck spotted 159 actively exploited #vulnerabilities in first few months of 2025;

FBI is seeking public help to identify Chinese hackers known as #SaltTyphoon and offers $10 million reward;

Subscribe to the #infosecMASHUP newsletter to have it piping hot in your inbox every week-end

https://infosec-mashup.santolaria.net/p/infosec-mashup-17-2025

A Python client for the Global CVE Allocation System has been released.

by @cedric

#cve #gcve #vulnerabilities #vulnerability

https://github.com/gcve-eu/gcve

The first publication of the GCVE-BCP-01 - Signature Verification of the Directory File

More information about BCP https://gcve.eu/bcp/
GCVE-BCP-01 https://gcve.eu/bcp/gcve-bcp-01/

The digital signature of the directory file was added in response to requests from various open-source developers and GNAs.

#cve #gcve #vulnerabilities #opensource

FAQ https://gcve.eu/faq/#q13-is-the-json-file-distributed-by-gcve-signed-and-how-can-the-signature-be-verified
Directory file https://gcve.eu/dist/

New Research Alert: Attackers are exploiting a dangerous class of cyber flaws—resurgent vulnerabilities. Learn how they work, why they matter, and what defenders can do. Full analysis
#Cybersecurity #GreyNoise #Vulnerabilities

https://www.greynoise.io/blog/greynoise-uncovers-unique-risks-from-resurgent-cybersecurity-vulnerabilities

While digging into some #Fortinet vulnerabilities, I discovered a set of CVEs that were rejected for being unused.

I'm wondering how this is actually helping vulnerability management. Does this mean those will be never used? or something else?

#vulnerability #cve #vulnerabilities

https://vulnerability.circl.lu/vuln/cve-2025-46221

4chan Breach Exposes Moderator Emails, Passwords via Outdated Software

#4chan #hack #databreach #cybersecurity #Ghostscript #PHP #FreeBSD #emaileak #SoyjakParty #infosec #vulnerabilities #Hackers

https://winbuzzer.com/2025/04/20/4chan-breach-exposes-moderator-emails-passwords-via-outdated-software-xcxwbn/

'Stupid and Dangerous': #CISA Funding Chaos Threatens Essential #Cybersecurity Program

The #CVE Program is the primary way software #vulnerabilities are tracked. Its long-term future remains in limbo even after a last-minute renewal of the US government contract that funds it.

https://www.wired.com/story/cve-program-cisa-funding-chaos/

Nach dem drohenden Aus der #CVE-Liste startet die EU mit der eigenen Schwachstellendatenbank #EUVD.

Die Plattform der der EU-#Cybersicherheitsbehörde #ENISA soll laut NIS2-Richtlinie für mehr IT-Sicherheit in Europa sorgen.

Parallel arbeiten Initiativen an dezentralen und unabhängigen Lösungen. Eine mögliche Vertragsverlängerung durch die US-Behörde #CISA könnte den Dienst vorerst sichern.

https://www.heise.de/news/Nach-drohendem-CVE-Aus-Schwachstellendatenbank-der-EU-geht-an-den-Start-10354324.html

CVE Program Almost Unfunded

Mitre’s CVE’s program—which provides common naming and other informational resources about cybersecurity vulnerabilities—was about to <a href="https://www.csoonline.com/article/3963190/cve-program-faces-swift-end-after-dhs-... https://www.schneier.com/blog/archives/2025/04/cve-program-almost-unfunded.html

MITRE CVE Contract Extended Just Before Expiration https://thecyberexpress.com/mitre-cve-contract-extended-before-expiration/ #TheCyberExpressNews #TheCyberExpress #Vulnerabilities #FirewallDaily #cybersecurity #CyberNews #MITRE #CISA #CVE #NVD

https://www.theverge.com/news/649314/cve-mitre-funding-vulnerabilities-exposures-funding
#cybersecurity #vulnerabilities #CVE #CWE #MITRE #government #defunding

Pulling the plug on the database would cause "an immediate cascading effect that will impact vulnerability management on a global scale" #Cybersecurity #Funding #Software #Vulnerabilities #TechNews

Nonprofit That Tracks Software...

The U.S. Government funding to MITRE, which maintains CVE data, will stop today. New vulnerabilities will no longer be added to the glossary, posing a risk to national security.

Read the full report: https://www.technadu.com/mitre-funding-by-the-u-s-government-to-stop-today-security-teams-left-alarmed/586183/