Identity and Edge Attacks Escalate, Defender Tooling Sharpens

News

Fake Recruiter Emails Deliver New Infostealer Malware

Social engineering is getting more targeted. Attackers are using fake job offers to deliver info-stealing malware, which is a classic move with a fresh payload. This highlights the ongoing human-vector problem that technical controls alone can't solve.

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA's KEV catalog continues to be the most actionable list for prioritizing patches. If these are in your stack, drop everything. It's the simplest risk-reduction signal we have.

Ivanti Patches Critical EPMM Vulnerabilities Under Active Exploitation

Ivanti's EPMM is a prime target for attackers managing enterprise devices. These are critical flaws with active exploitation, making patching an immediate operational priority for anyone running the platform.

Tools

Project Discovery Releases Nuclei v3.3.0

The go-to vulnerability scanner for bug hunters and red teams just got a significant update. Faster scanning and improved template handling mean more efficient discovery of the weaknesses attackers are actually exploiting.

TruffleHog Releases New Version with Enhanced Detection

Finding leaked credentials in code is a fundamental security hygiene task. This update to the popular scanner adds more detectors and improves accuracy, giving defenders better leverage in the secret-finding arms race.

CISA Releases Malcolm v25.05.0 Network Traffic Analysis Suite

Malcolm is a powerful, free network analysis tool from CISA. This release adds new parsers and improves detection logic, making it easier to spot malicious activity in your network traffic without a big budget.