Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
CrushFTP auth bypass vulnerability: Disclosure mess leads to attacks
Outpost24 analysts recently discovered a critical authentication bypass vulnerability in CrushFTP, identified as CVE-2025-31161. The vulnerability has a CVSSv3.1 score of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). We reached out to MITRE for a CVE on 13th March 2025 and were within an agreed 90-day non-disclosure period with CrushFTP. The plan was to give users plenty of time to patch before attackers were alerted to the vulnerability and able to exploit it.
Get Off My Lawn and Fix Your Vulnerabilities!
Today, I'm absolutely thrilled to announce our newest innovation in the security space: our new CLI tool, Greybeard. After years of giving polite, professional security advice, we've realized what developers really need is an ornery virtual security expert who tells it like it is.
What are Zero-Day Attacks?
A Zero-Day Attack occurs when hackers exploit a previously unknown vulnerability in software or hardware before the developer has a chance to fix it. These attacks are particularly dangerous because there is no defense in place when they occur. In this video, we explain how Zero-Day attacks work and how you can protect your systems from these hidden threats.
Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk
Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of current security tools, and the implications for businesses relying on API-driven applications. It will also discuss potential approaches for improving API security posture.
CVE-2017-12637: Exploitation of SAP NetWeaver Directory Traversal Vulnerability
On March 19, 2025, the CISA issued a warning about the active exploitation of CVE-2017-12637, a directory traversal vulnerability in SAP NetWeaver AS Java. This vulnerability, originally patched in 2017, has resurfaced due to incomplete mitigations, leading to increased risks for organizations using outdated or misconfigured SAP environments.
Why Vulnerability Management Is AI's Biggest Untapped Opportunity
The security industry has reached a turning point with AI. It’s no longer just hype, as AI has now become a critical part of day-to-day cybersecurity operations. According to The Rise of AI-Powered Vulnerability Management, the latest report from Seemplicity and Dark Reading, 86% of security teams now use some form of AI in their security stack. More than half of respondents say AI is already crucial to their work.
The CRITICAL Next.js Vulnerability you NEED to be aware of...
A major security flaw has been discovered in Next.js, potentially leaving thousands of applications vulnerable to attacks. In this video, we will be uncovering how this vulnerability was discovered, who is impacted by it and what you can do to secure your applications.
Securing AI: How Mend.io & OWASP Are Making AI Safer for Enterprises #securitymanagement #shorts
Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.