SecurityWeek Briefing.

"Ox Security bags $60M Series B to tackle Appsec Alert Fatigue."

Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents. Accessed on 07 May 2025, 1559 UTC.

Content and Source: Email subscription via https://feedly.com.

https://feedly.com/i/subscription/feed%2Fhttp%3A%2F%2Ffeeds.feedburner.com%2FSecurityweek

Please check email link or scroll down to read your selections. Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

Today

Ox Security Bags $60M Series B to Tackle Appsec Alert Fatigue

by SecurityWeek News / 13min

Ox Security has raised a total $94 million since its launch in 2021 with ambitious plans to cash in on two fast-moving trends. The post appeared first on SecurityWeek .

New UK Framework Pressures Vendors on SBOMs, Patching and Default MFA

by Ryan Naraine / 1h

By baking minimum expectations into procurement conversations, the plan is to steer software vendors to “secure-by-design and default” basics. The post appeared first on SecurityWeek .

US Sanctions Myanmar Militia Involved in Cyber Scams

US sanctions Myanmar warlord militia

•

by Ionut Arghire / 3h

The US has sanctioned Myanmar warlord Saw Chit Thu and his militia for their roles in cyber scams causing billions in losses to American victims. The post appeared first on SecurityWeek .

Spyware Maker NSO Ordered to Pay $167 Million Over WhatsApp Hack

NSO Group faces major damages

•

by Eduard Kovacs / 4h

Meta has won its WhatsApp hacking lawsuit against Israeli spyware company NSO Group in an “important step forward for privacy and security”. The post appeared first on SecurityWeek .

AppSignal Raises $22 Million for Application Monitoring Solution

AppSignal raises 22M Series A

•

by Ionut Arghire / 5h

Application performance monitoring provider AppSignal has raised $22 million in a Series A funding round led by Elsewhere Partners. The post appeared first on SecurityWeek .

Second Ransomware Group Caught Exploiting Windows Flaw as Zero-Day

3 TTPs

•

by Eduard Kovacs / 5h

At least two ransomware groups exploited the Windows zero-day CVE-2025-29824 before it was patched by Microsoft. The post appeared first on SecurityWeek .

Yesterday

Second OttoKit Vulnerability Exploited to Hack WordPress Sites

4 TTPs

•

by Ionut Arghire / 6h

Threat actors are targeting a critical-severity vulnerability in the OttoKit WordPress plugin to gain administrative privileges. The post appeared first on SecurityWeek .

US Warns of Hackers Targeting ICS/SCADA at Oil and Gas Organizations

by Ionut Arghire / 7h

The US government warns of threat actors targeting ICS/SCADA systems at oil and natural gas organizations. The post appeared first on SecurityWeek .

41 Countries Taking Part in NATO’s Locked Shields 2025 Cyber Defense Exercise

by Eduard Kovacs / 8h

The NATO Cooperative Cyber Defence Centre of Excellence in Estonia is hosting the Locked Shields 2025 cyber defense exercise. The post appeared first on SecurityWeek .

Applying the OODA Loop to Solve the Shadow AI Problem

by Etay Maor / 23h

By taking immediate actions, organizations can ensure that shadow AI is prevented and used constructively where possible. The post appeared first on SecurityWeek .

Hacker Conversations: John Kindervag, a Making not Breaking Hacker

by Kevin Townsend / 1d

John Kindervag is best known for developing the Zero Trust Model. He is a hacker, but not within our common definition of a hacker today. The post appeared first on SecurityWeek .

Second Wave of Attacks Hitting SAP NetWeaver After Zero-Day Compromise

6 TTPs

•

by Ionut Arghire / 1d

•

CVE-2025-31324

Threat actors are revisiting SAP NetWeaver instances to leverage webshells deployed via a recent zero-day vulnerability. The post appeared first on SecurityWeek .

US Charges Yemeni Man for Black Kingdom Ransomware Attacks

Yemeni national indicted for ransomware

•

by Eduard Kovacs / 1d

Rami Khaled Ahmed, a 36-year-old from Yemen, has been charged for launching ransomware attacks between 2021 and 2023. The post appeared first on SecurityWeek .

Samsung MagicINFO Vulnerability Exploited Days After PoC Publication

2 TTPs

•

by Ionut Arghire / 1d

•

CVE-2024-7399

Threat actors started exploiting a vulnerability in Samsung MagicINFO only days after a PoC exploit was published. The post appeared first on SecurityWeek .

Critical Vulnerability in AI Builder Langflow Under Attack

4 TTPs

•

by Ionut Arghire / 1d

CISA warns organizations that threat actors are exploiting a critical-severity vulnerability in low-code AI builder Langflow. The post appeared first on SecurityWeek .

Microsoft Warns of Attackers Exploiting Misconfigured Apache Pinot Installations

by Eduard Kovacs / 1d

Misconfigured Apache Pinot instances can and have enabled threat actors to gain access to sensitive information. The post appeared first on SecurityWeek .

May 5, 2025

Android Update Patches FreeType Vulnerability Exploited as Zero-Day

by Ionut Arghire / 1d

Android’s May 2025 security update includes patches for an exploited vulnerability in the FreeType open source rendering engine. The post appeared first on SecurityWeek .

White House Proposal Slashes Half-Billion From CISA Budget

Ex-CISA chief criticizes Trump loyalty cuts

•

by Ryan Naraine / 2d

The proposed $491 million cut is being positioned as a “refocusing”of CISA on its core mission “while eliminating weaponization and waste.” The post appeared first on SecurityWeek .

Doppel Banks $35M for AI-Based Digital Risk Protection

Doppel raises 35M Series B

•

by SecurityWeek News / 2d

The new investment values Doppel at $205 million and provides runway to meet enterprise demand for AI-powered threat detection tools. The post appeared first on SecurityWeek .

Kelly Benefits Data Breach Impact Grows to 400,000 Individuals

Exfiltration (Enterprise TA0010)

•

by Eduard Kovacs / 2d

Kelly Benefits has determined that the impact of the recently disclosed data breach is much bigger than initially believed. The post appeared first on SecurityWeek .

Critical Commvault Vulnerability in Attacker Crosshairs

2 TTPs

•

by Ionut Arghire / 2d

CISA has flagged a critical-severity Commvault vulnerability as exploited one week after technical details were released. The post appeared first on SecurityWeek .

Man Admits Hacking Disney and Leaking Data Disguised as Hacktivist

2 TTPs

•

by Eduard Kovacs / 2d

•

Man pleads guilty to Disney hack

A 25-year-old has admitted hacking Disney systems and leaking data under the guise of a hacktivist collective named NullBulge. The post appeared first on SecurityWeek .

Ransomware Group Claims Attacks on UK Retailers

11 TTPs

•

by Ionut Arghire / 2d

The DragonForce ransomware group has claimed responsibility for the recent cyberattacks on UK retailers Co-op, Harrods, and M&S. The post appeared first on SecurityWeek .

May 4, 2025

PoC Published for Exploited SonicWall Vulnerabilities

2 TTPs

•

by Ionut Arghire / 2d

PoC code targeting two exploited SonicWall flaws was published just CISA added them to the KEV catalog. The post appeared first on SecurityWeek .

Cybersecurity M&A Roundup: 31 Deals Announced in April 2025

by Eduard Kovacs / 2d

Thirty-one cybersecurity merger and acquisition (M&A) deals were announced in April 2025. The post appeared first on SecurityWeek .

TikTok Fined $600 Million for China Data Transfers That Broke EU Privacy Rules

TikTok fined for EU data violations

•

by Associated Press / 2d

EU privacy watchdog fined TikTok $600 million after a four-year investigation found that data transfers to China put users at risk of spying, in breach of strict EU data privacy rules. The post appeared first on SecurityWeek .

May 2, 2025

Raytheon, Nightwing to Pay $8.4 Million in Settlement Over Cybersecurity Failures

Raytheon Nightwing pay 84M$ settlement

•

by Ionut Arghire / 5d

The US government says defense contractor Raytheon and Nightwing agreed to pay $8.4 million to settle False Claims Act allegations. The post appeared first on SecurityWeek .

In Other News: NullPoint Source Code Leak, $17,500 for iPhone Flaw, BreachForums Down

7 TTPs

•

by SecurityWeek News / 5d

Noteworthy stories that might have slipped under the radar: NullPoint Stealer source code leaked, researcher earns $17,500 from Apple for vulnerability, BreachForums down after zero-day exploitation by police. The post appeared first on SecurityWeek .

UK Retailers Co-op, Harrods and M&S Struggle With Cyberattacks

4 TTPs

•

by Ionut Arghire / 5d

•

Harrods targeted by cyber attack

Major UK retailers Co-op, Harrods, and M&S are scrambling to restore services that were affected by cyberattacks. The post appeared first on SecurityWeek .

Nova Scotia Power Says Hackers Stole Customer Information

Emera Nova Scotia Power cybersecurity response

•

by Eduard Kovacs / 5d

Nova Scotia Power’s investigation has shown that the recent cyberattack resulted in the theft of some customer information. The post appeared first on SecurityWeek .

RSA Conference 2025 Announcement Summary (Day 3)

RSA Conference 2025 showcases cybersecurity

•

by SecurityWeek News / 5d

Hundreds of companies showcased their products and services this week at the 2025 edition of the RSA Conference in San Francisco. The post appeared first on SecurityWeek .

May 1, 2025

Microsoft Accounts Go Passwordless by Default

Microsoft makes accounts passwordless by default

•

by Ionut Arghire / 5d

Microsoft is prioritizing passwordless sign-in and sign-up methods, and is making new accounts passwordless by default. The post appeared first on SecurityWeek .

Ukrainian Nefilim Ransomware Affiliate Extradited to US

Ukrainian extradited for Nefilim ransomware

•

by Ionut Arghire / 5d

Ukrainian national Artem Stryzhak was extradited to the US and charged with using Nefilim ransomware in attacks on large businesses. The post appeared first on SecurityWeek .

Hawaii Cybersecurity Journal