News

The Central Board of Secondary Education (CBSE) has denied allegations of a breach affecting its Open Source Management (OSM) system. A hacker claiming responsibility sparked controversy by registering similar URLs, creating confusion about which website was legitimate. CBSE clarified that no sensitive data was compromised and that the incident involved only a URL registration dispute rather than an actual security breach. The board advised users to verify official websites before accessing educational portals. This incident highlights the risks of domain spoofing and the importance of verifying authentic government websites. Source: India Today.

India's CERT-In has issued a warning about the increasing threat of artificial intelligence-driven cyberattacks, as hackers leverage advanced automated tools to breach systems. The advisory highlights how attackers are utilizing AI technologies to enhance their attack capabilities, enabling more sophisticated and targeted campaigns against organizations and individuals. CERT-In recommends strengthening security measures and maintaining vigilant monitoring of network activities. Users are advised to keep systems updated with latest patches and implement robust security protocols to defend against these evolving threats. Source: sarkaritel.com

A coordinated cyber attack called Megalodon compromised over 5,500 public GitHub repositories by injecting malicious commits into GitHub Actions workflows. Researchers at SafeDep detected the campaign on May 18, which pushed 5,718 harmful commits within six hours using stolen credentials. The attack modified workflow files to include base64-encoded scripts designed to steal sensitive data like cloud credentials, SSH keys, and OIDC tokens during code execution. Major targets included repositories from Wiznet, Tiledesk, and persian-tools projects. Security researchers recommend monitoring unexpected workflow runs and reviewing cloud audit logs for suspicious token requests. The operation bore similarities to previous TeamPCP attacks, using backdated commits to conceal malicious activity timing. Source: SafeDep and OX Security Research.

AppOmni has launched Marlin AI, a tool designed to automatically detect and investigate misconfigurations in Software-as-a-Service (SaaS) applications used by enterprises. The AI system analyzes security vulnerabilities across cloud environments and traces related suspicious activities within organizational networks. It provides detailed remediation recommendations to address identified issues. However, the system stops short of implementing fixes automatically, requiring human approval before taking corrective actions. This approach balances efficiency with safety, allowing security teams to review recommendations before deployment. The development highlights growing reliance on AI for managing complex cloud security challenges in modern enterprises. Source: SecurityWeek.

Nimbus Manticore, an Iranian advanced persistent threat (APT) group, continues targeting aviation and software companies with newly upgraded hacking tools. The group has maintained its cyber operations during and after recent US military activities against Iran. This represents an ongoing threat to critical infrastructure and technology sectors globally. Indian organizations in aviation and software development should enhance their security measures, including employee awareness training, network monitoring, and incident response protocols. Organizations are advised to patch vulnerabilities promptly and implement multi-factor authentication to mitigate risks from such state-sponsored cyber threats. Source: SecurityWeek.

A significant data breach at 7-Eleven has compromised personal information of over 185,000 individuals. The leaked data includes sensitive details such as names, dates of birth, postal addresses, and Social Security numbers, as confirmed by state government records. This incident highlights the vulnerability of retail chains to cyber attacks and the risks customers face when their information is stored by large corporations. Affected individuals should monitor their accounts for suspicious activity and consider identity theft protection measures. Source: State Government Security Notice.

US federal authorities have successfully shut down a large-scale tech-support scam operation that involved participants from India and the United States working in coordination. The scam typically targeted unsuspecting users by posing as legitimate technical support representatives, convincing victims to grant remote access to their devices or provide sensitive information. The operation involved multiple individuals across both countries in various roles, from executing the scams to managing financial aspects. This takedown represents a significant enforcement action against cross-border cybercriminal networks that have cost consumers substantial amounts through fraudulent technical support claims. Source: IndiaWest.

Microsoft is rolling out a new feature in Defender for Endpoint that automatically isolates infected computers to prevent attackers from spreading across networks. This capability detects when a system is compromised and disconnects it from the network, blocking lateral movement attempts by cybercriminals. The feature is currently in testing phase and aims to reduce response time during security incidents. For Indian organizations relying on Microsoft security tools, this addition strengthens endpoint protection by minimizing damage from breaches before manual intervention occurs. Source: Original announcement.

Reform UK leader Nigel Farage claims Russian hackers infiltrated his phone and disclosed information about a £5 million financial gift. However, cybersecurity specialists have expressed skepticism, requesting concrete evidence to support the allegations. The incident highlights growing concerns about political figures being targeted by state-sponsored cyber operations. Experts emphasize that without substantiated technical proof, such claims remain unverified. This case underscores the importance of proper incident investigation and transparent communication when reporting potential breaches. Source: The Guardian.

ABB has identified a critical vulnerability (CVE-2025-9970) in its LVS MConfig software affecting versions 1.4.9.21 and earlier. The flaw allows local network attackers to extract memory dump files containing plaintext passwords stored in the application's memory. If these dumps are mishandled, attackers could obtain sensitive credentials. The vulnerability impacts critical infrastructure sectors including energy, manufacturing, and water systems worldwide. ABB rates the issue as HIGH severity (CVSS 7.4) and has released MConfig version 1.4.9.22 as a fix. Users are strongly advised to update immediately and implement the defensive measures outlined in product documentation. Source: CISA.

ABB has identified a critical vulnerability in its Ability Zenon Remote Transport software affecting versions 7.50 through 14. The flaw enables attackers to bypass authentication and trigger unauthorized system reboots without proper credentials. The vulnerability (CVE-2025-8754) stems from missing authentication controls in the default configuration. Exploitation requires prior network access to affected systems. The vulnerability impacts critical infrastructure sectors including energy, healthcare, water management, and communications worldwide. Currently, no active exploitation in the wild has been reported. ABB recommends restricting network access to systems running the affected software as a temporary measure. Source: ABB Security Advisory.

ABB B&R has identified a critical vulnerability in the System Diagnostics Manager (SDM) component of its Automation Runtime software affecting versions before 6.3 and Q4.93. The flaw, classified as improper resource locking (CVE-2025-3450), allows unauthenticated network attackers to delete data and cause system outages. The vulnerability has a CVSS score of 10, indicating critical severity. Affected industries include energy, manufacturing, healthcare, and water treatment systems worldwide. B&R has released patched versions 6.3 and Q4.93. The company recommends immediate updates for users running SDM on their systems. SDM is disabled by default in Automation Runtime 6 and should not operate outside secured production networks. Source: ABB Security Advisory.