• Ivanti VPN customers targeted via unrecognized RCE vulnerability (CVE-2025-22457)
• Major Online Platform for Child Exploitation Dismantled
• CrushFTP Vulnerability Exploited Following Disclosure Issues
• Attackers are leveraging Cisco Smart Licensing Utility static admin credentials (CVE-2024-20439)
• Amateur Hacker Leverages Russian Bulletproof Hosting Server to Spread Malware
• Phishers are increasingly impersonating electronic toll collection companies
• Sensitive Data Breached in Highline Schools Ransomware Incident
• Over Half of Attacks on Electricity and Water Firms Are Destructive
• Nearly 600 Phishing Domains Emerge Following Bybit Heist
• Beware fake AutoCAD, SketchUp sites dropping malware
• 7 ways to get C-suite buy-in on that new cybersecurity tool
• Stripe API Skimming Campaign Unveils New Techniques for Theft
• Royal Mail Investigates Data Breach Affecting Supplier
• Gray Bots Surge as Generative AI Scraper Activity Increases
• Bybit Heist Fuels Record Crypto-Theft Surge, Says CertiK
• North Korea's Fake IT Worker Scheme Sets Sights on Europe
• Steam Surges to Top of Most Spoofed Brands List in Q1

A suspected Chinese APT group has exploited CVE-2025-22457 – a buffer overflow bug that was previously thought not to be exploitable – to compromise appliances running Ivanti Connect Secure (ICS) 22.7R2.5 or earlier or Pulse Connect Secure 9.1x. The vulnerability was patched by Ivanti in ICS 22.7R2.6, released on February 11, 2025. But, apparently, the threat actor studied the patch and “uncovered through a complicated process, [that] it was possible to exploit 22.7R2.5 and earlier …