Miriam C. Wiesner

Sharepoint vulnerability: Patching is not enough CTI expert Florian Roth wrote a great article for us, detailing IOCs and what you need to do after patching CVE-2025-53770. This includes links to the actual PoC requests. Read more here: https://lnkd.in/eZiwwruM (nb: this has been auto-translated) German version in the comments.

90

3 Kommentare

Two newly disclosed N-able vulnerabilities, CVE-2025-8875 and CVE-2025-8876, have been added to CISA’s KEV Catalog. They affect N-able’s N-central remote monitoring and management (RMM) platform. These flaws allow local code execution and command injection but require authentication to exploit, meaning they are unlikely to be used at the beginning of an exploit chain. Alexander Culafi at Dark Reading covers the details, noting the vulnerabilities impact versions prior to 2025.3.1. The article also features insight from Rapid7's Seth Lazarus: “They require authentication to achieve exploitation, which is much less severe than what we’ve recently seen, and likely why exploitation in the wild doesn’t appear to be widespread.” Read the full breakdown here: https://lnkd.in/eiukB6HM

77

Imagine locking your front door and leaving the key under the mat. In cybersecurity, that is what storing credentials in plain text fields within identity systems like Active Directory looks like. Microsoft Defender is now using AI-powered detections to spot exposed credentials in free text fields. This is especially important for non-human identities, which often have elevated privileges and are frequently overlooked in traditional security models. With AI, we are not just identifying vulnerabilities. We are reducing the time to exploit from hours to seconds and proactively protecting more than 2,500 tenants from over 40,000 exposed credentials. This marks a major shift for hybrid identity environments and a wake-up call for organizations still relying on outdated practices. https://lnkd.in/eh98dHVW #MicrosoftDefender #DefenderForIdentity #AI #IdentityProtection #NHI #ActiveDirectory #MicrosoftSecurity #CyberSecurity

65

2 Kommentare

At Microsoft, security isn’t an add-on—it’s built in. That’s the heart of our Secure Future Initiative and why “Secure by Design” is foundational.   Cybercriminals now target people, not just systems. So we’ve put UX designers on the cybersecurity frontlines, working with threat analysts to make protection intuitive.   Our Secure by Design UX Toolkit—used by 22,000+ employees and now available to customers—helps teams embed security from the start. It’s already driving impact: AI-powered app controls in Windows, clearer phishing alerts in Teams, and passwordless sign-in that’s both simpler and safer.   Security should be easy to understand and act on. Even small design choices can help users spot risks and stay protected. This is more than a design shift—it’s a trust shift. And it’s raising the bar for everyone. I’d encourage you to read this Microsoft Source article to learn more. https://lnkd.in/gfCk9Za3

58

2 Kommentare