Bruce McCully, Chief Security Officer of Galactic Advisors, emphasized the importance of integrating high-value security services into managed service provider (MSP) offerings. 

McCully addressed an audience of MSPs and managed security service providers (MSSPs) at the XChange conference, highlighting the threat posed by commoditized IT and security solutions offered at low prices.  

Phil Walker, CEO of Network Solutions Provider, echoed McCully's sentiments, emphasizing the necessity for MSPs to enhance their security practices. Walker's company has successfully incorporated cybersecurity offerings, including vCSOs, to provide strategic expertise and consulting to clients.  

To address the growing demand for vCSO services, McCully outlined recommendations for building a vCSO practice. These recommendations included developing tools such as vCSO client profilers, risk assessment questionnaires, and incident response procedures.  

## Transforming Managed Security Services with vCSO Integration

Bruce McCully, Chief Security Officer of Galactic Advisors, delivered a warning to MSPs and MSSPs at the XChange conference, urging them to evolve their offerings beyond basic IT and security services.  

McCully emphasized the need for MSPs to integrate virtual Chief Security Officer (vCSO) solutions and recurring third-party assessments to stay ahead of commoditized offerings. By adding these high-value services, MSPs can demonstrate their value proposition and secure their position as trusted advisors to clients. 

Phil Walker, CEO of Network Solutions Provider, affirmed the importance of bolstering security practices within MSPs. Walker highlighted the success of his company's cybersecurity offerings, including vCSOs, in providing strategic expertise to clients.  

By reframing security as a profit center and a reputation enhancer, Walker has effectively differentiated his company from competitors and emphasized the necessity for MSPs to offer comprehensive security solutions. 

McCully provided recommendations for building a successful vCSO practice, including the development of tools such as vCSO client profilers and risk assessment questionnaires.  

By offering holistic security services, MSPs can mitigate the threat posed by commoditized security solutions and position themselves as indispensable partners to their clients. 
![b 5.1.webp](https://strapiassets.blr1.digitaloceanspaces.com/b_5_1_8d7f87e06f.webp)
## Embracing vCSO Solutions for Enhanced Managed Security Services

At the XChange conference, Bruce McCully, Chief Security Officer of Galactic Advisors, called on MSPs and MSSPs to adapt their offerings to meet evolving security challenges. McCully emphasized the importance of integrating virtual Chief Security Officer (vCSO) solutions and recurring third-party assessments to differentiate their services and fend off competition from commoditized IT providers. 

- Phil Walker, CEO of Network Solutions Provider, shared insights into his company's success in cybersecurity, highlighting the provision of vCSOs to clients. 
- Walker stressed the transformative impact of viewing security as a profit center and reputation enhancer, enabling MSPs to elevate their value proposition and attract more clients. 

To compete effectively in the evolving security landscape, Walker emphasized the need for MSPs to offer comprehensive security services that go beyond basic IT solutions. 

McCully provided practical recommendations for building a robust vCSO practice, including the development of tailored client profilers and risk assessment frameworks. 

By embracing vCSO solutions and a holistic approach to security, MSPs can navigate the competitive landscape and position themselves for sustained growth and success. 

At the XChange conference, Bruce McCully, Chief Security Officer of Galactic Advisors, highlighted the critical need for managed service providers (MSPs) and managed security service providers (MSSPs) to integrate high-value security services into their offerings. 

Guardian Solutions: High-Value MSP Security Services

Palo Alto Networks has risen to the top echelons of the cybersecurity realm, securing a prestigious position as the lone leader in Gartner's groundbreaking Magic Quadrant for single-vendor Secure Access Service Edge (SASE) solutions.  This accolade places Palo Alto Networks in a league of its own, outshining formidable competitors like Fortinet, Cisco, and VMware.
![b 6.3.webp](https://strapiassets.blr1.digitaloceanspaces.com/b_6_3_36af29963a.webp)
## Palo Alto Networks Dominates Gartner's Inaugural Magic Quadrant for Single-Vendor SASE

Gartner's inaugural Magic Quadrant for single-vendor SASE was a highly anticipated event, signaling a significant shift in the cybersecurity landscape. Palo Alto Networks emerged as the clear frontrunner, demonstrating unparalleled excellence in delivering integrated networking and security solutions under the umbrella of SASE. 

The demand for SASE solutions has witnessed a meteoric rise as organizations grapple with the challenges of securing distributed workforces and enabling seamless access to corporate resources. 

Palo Alto Networks' leadership in the single-vendor SASE space is a testament to its commitment to addressing these pressing needs with innovative and comprehensive offerings. 
![b 6.2.webp](https://strapiassets.blr1.digitaloceanspaces.com/b_6_2_55c5fb921f.webp)
## Gartner's Evaluation and Market Insights

Gartner's assessment criteria for single-vendor SASE solutions cover a broad range of capabilities, including Software-Defined Wide Area Networking (SD-WAN), Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), Zero Trust Network Access (ZTNA), and network firewall functionalities. 

Palo Alto Networks surpassed these benchmarks, earning recognition for the robust functionality, extensive customer base, and strategic product roadmap of its Prisma SASE platform. 

During the company's quarterly call, Nikesh Arora, CEO of Palo Alto Networks, celebrated this milestone, highlighting over $1 billion in bookings for its SASE business in fiscal 2023. 

- Gartner's evaluation also highlighted other players in the single-vendor SASE landscape, categorizing them as visionaries, challengers, or niche players. 

- Cisco and Forcepoint were recognized as visionaries. 
 
- Challengers included Cato Networks, Versa Networks, and Fortinet. 
 
- Niche players were identified as VMware and Juniper Networks, showcasing the market's diversity. 

It's worth noting that while some vendors opt for a single-vendor approach to SASE, others deliver SASE through integrations with third-party technologies. 

- Notably absent from Gartner's Magic Quadrant were Netskope, HPE, Cloudflare, and Check Point due to various factors such as incomplete offerings or insufficient enterprise adoption by the cutoff date. 

- The release of the single-vendor SASE Magic Quadrant complements Gartner's existing rankings for SD-WAN and Security Service Edge (SSE), with Palo Alto Networks consistently emerging as a leader across multiple categories. 

Gartner's Magic Quadrant serves as a trusted benchmark for industry players, guiding organizations in their selection of technology solutions and reaffirming Palo Alto Networks' position as a cybersecurity powerhouse. 

Palo Alto Networks has ascended to the pinnacle of the cybersecurity industry, earning a distinguished position as the sole leader in Gartner's groundbreaking Magic Quadrant for single-vendor Secure Access Service Edge (SASE) solutions. 

Palo Alto Networks: Lone Leader in SASE - Gartner Magic Quadrant


## Edge Under Siege: Massive Attack Compromises Tens of Thousands of Cisco Devices

In a striking wave of cyberattacks, tens of thousands of Cisco devices have been compromised, marking one of the largest edge attacks to date. Experts have revealed that malicious actors are increasingly targeting edge networks, with the recent exploits on Cisco IOS XE devices serving as a stark reminder.
![b 18.1.webp](https://strapiassets.blr1.digitaloceanspaces.com/b_18_1_f079930a60.webp)

## A Critical Vulnerability Exploited

This week, researchers reported that nearly 42,000 Cisco devices running the IOS XE operating system have fallen victim to a zero-day vulnerability disclosed on Monday. 

John Gallagher, VP of Viakoo Labs at IoT security firm Viakoo, emphasized the significance of this breach, noting it as one of the most impactful edge attacks ever recorded.

Cisco has not yet released a patch for the critical vulnerability but has provided effective mitigations to thwart these attacks. 

The IOS XE platform is widely used across various Cisco devices, including branch routers, industrial routers, aggregation routers, Catalyst 9100 access points, and IoT-ready Catalyst 9800 wireless controllers.

## The Vulnerability of the Edge

Edge attacks have surged as cybercriminals seek the path of least resistance, Gallagher told CRN. With data center security becoming increasingly robust, attackers are now focusing on the more vulnerable edge networks. A _"set it and forget it"_ mentality often plagues edge environments, making them prime targets.

Protecting edge environments is possible, but it requires prioritization and proper management, Gallagher stressed. Effective network security practices and vigilant management can significantly reduce vulnerabilities at the edge.
Questionable Security Practices

Bill Suarez, CISO at Whalley Computer Associates, highlighted a key issue: the current wave of compromised IOS XE devices was primarily due to their exposure to the web. 

_"Deploying an outer edge switch with a web server turned on is not sound network security practice,"_ Suarez told CRN. Such decisions reflect either a lack of understanding or misplaced trust in vendor software.

Suarez advocates for using an edge firewall in addition to a core firewall, creating an "outer barrier" to protect against similar attacks. He stressed that relying solely on vendor code security is unrealistic in today’s threat landscape.

## Escalating Threats
![b 18.2.webp](https://strapiassets.blr1.digitaloceanspaces.com/b_18_2_09c4b6766d.webp)

Cybersecurity firm Censys reported that the number of compromised IOS XE devices surged by 8,000 in just one day, totaling 41,983 compromised devices. 

The critical vulnerability, tracked as CVE-2023-20198, has a maximum severity rating of 10.0 out of 10.0. Exploiting this flaw allows attackers to gain full control over compromised devices, enabling unauthorized activities.

Cisco's advisory indicated that the vulnerability impacts the web user interface in IOS XE when exposed to the web or an untrusted network. The flaw allows privilege escalation by a remote, unauthenticated user. 

Cisco has shared an access restriction measure that is effective in stopping exploits of the vulnerability.

## A Call to Action

Cisco has committed to addressing this critical security issue as a top priority. In a statement to CRN, Cisco emphasized its ongoing efforts to provide a software fix and urged customers to take immediate action as outlined in their security advisory.

This incident underscores the escalating cyber threats targeting edge networks and highlights the urgent need for comprehensive security measures and vigilant management of edge devices.


In a major cybersecurity incident, tens of thousands of Cisco devices have been compromised in one of the largest edge network attacks ever recorded. The attack, which exploited a critical zero-day vulnerability in Cisco's IOS XE operating system, has highlighted the growing threat to edge networks as cybercriminals shift their focus from well-secured data centers to more vulnerable edge environments. 

Cisco IOS XE Attacks Spotlight Rising Cyber Threats

## Palo Alto Networks Emerges as Top Leader in 2024 Gartner® Magic Quadrant™ for Security Service Edge (SSE)

Today marks a significant milestone for Palo Alto Networks as we proudly announce our recognition as a Leader in the 2024 Gartner® Magic Quadrant™ for Security Service Edge (SSE). 

This prestigious acknowledgment underscores our unwavering dedication to delivering excellence and innovation in cybersecurity solutions, particularly through our acclaimed Prisma® Access SSE solution.

## Continuing a Tradition of Excellence

Our designation as a Leader in the Gartner Magic Quadrant for SSE follows closely on the heels of our similar recognition in the Gartner Magic Quadrant for SD-WAN. We stand out as the sole vendor acknowledged as a Leader in both categories. 

This consistent recognition speaks volumes about our steadfast commitment to providing advanced, integrated security solutions that safeguard organizations' networks, applications, and data.

![2.webp](https://strapiassets.blr1.digitaloceanspaces.com/2_5df3e16b4c.webp)

## Empowering SASE Transformation with Prisma Access

Since its inception in 2019, Prisma Access has been a trailblazer in the SASE transformation landscape. Our platform addresses critical security requirements, including:
- Evolution from legacy VPN solutions to ZTNA 2.0.
- Replacement of traditional on-premises secure web gateways (SWG) with Cloud SWG.
- Strengthening of SaaS applications with Next-Generation CASB.

As global adoption of SASE gains momentum, organizations encounter challenges in implementing these expansive solutions. At Palo Alto Networks, we champion platformization to streamline management and advocate for a single-vendor strategy.  

This approach simplifies management processes and leverages the power of AI and machine learning across security, networking, and user experience management, all derived from a unified data source. 

This comprehensive strategy ensures data integrity, accuracy, and consistency—fundamental prerequisites for effective AI/ML applications. By minimizing complexity, our unified approach enables organizations to meet these critical data standards more efficiently than fragmented solutions. 

## Looking Towards the Future

According to Gartner projections: 

By 2025, 80% of enterprises will adopt a strategy to unify web, cloud services, and private application access using a SASE/SSE architecture, compared to 20% in 2021. 

Palo Alto Networks is thrilled to spearhead this transformative journey, persistently innovating and propelling security forward in an increasingly digital landscape. 

For further insights into this recognition and its implications for your security strategy, we invite you to download a complimentary copy of the 2024 Gartner Magic Quadrant for SSE. 

Today, Palo Alto Networks celebrates a major achievement with its recognition as a Leader in the 2024 Gartner® Magic Quadrant™ for Security Service Edge (SSE). This prestigious accolade highlights our relentless commitment to advancing cybersecurity solutions and reflects the exceptional capabilities of our renowned Prisma® Access SSE solution. 

Palo Alto Networks Leads 2024 Gartner for Security Service Edge

In a blog post, President Brad Smith stated that the implementation of multiple alterations to the tech giant’s software engineering procedures aims to establish a 'benchmark for security' at Microsoft.

Microsoft has announced significant updates to its software engineering process aimed at enhancing the security of its widely used platforms. In a recent pair of blog posts, top executives detailed these changes, which are designed to ensure Microsoft software defaults to a secure state. 

The initiative also focuses on bolstering identity security and strengthening cloud vulnerability management. These efforts are part of Microsoft's new Secure Future Initiative.

## AI Integration for Cyber threats

Microsoft's new initiative underscores an increased reliance on AI to combat evolving cyber threats, aiming to deploy artificial intelligence across Azure, Windows, and Office 365 to enhance threat detection and response capabilities. 

This strategic shift toward making software inherently secure by default will influence the design, development, testing, and operational phases of Microsoft's technology, ensuring security is integrated from the outset.

These enhancements are poised to significantly impact Microsoft's flagship platforms, Azure, Windows, and Office 365, by fortifying security measures and proactively addressing vulnerabilities.

In the wake of a high-profile cloud breach affecting U.S. government email accounts, Microsoft faced scrutiny over its security practices, prompting critiques from industry leaders and federal cybersecurity officials advocating for stronger and timelier security measures.

Brad Smith, Microsoft's President, emphasized that this initiative aims to establish "a new standard for security" within the company, signaling a comprehensive organizational evolution to prioritize cybersecurity across all operations. 

These proactive changes underscore Microsoft's commitment to confronting security challenges directly and strengthening its products against current and future cyber threats.
![b 31.1.webp](https://strapiassets.blr1.digitaloceanspaces.com/b_31_1_997f3817b9.webp)

## Enabling ‘Secure by Default’ Software Development

Microsoft is advancing its software development lifecycle (SDL) with a shift to what it terms "dynamic SDL," leveraging increased automation and AI integration. This approach aims to embed cybersecurity measures continuously throughout coding, testing, deployment, and operational phases.  

According to Microsoft President Brad Smith and Executive Vice President Charlie Bell, this AI-powered dynamic SDL will ensure that software is inherently secure by design, default, and deployment.  

The company plans to integrate tools like CodeQL with GitHub Copilot to enhance code analysis and bug fixing at scale, while expanding the use of memory-safe languages to prevent traditional software vulnerabilities. These initiatives underscore Microsoft's commitment to fortifying its products against evolving cyber threats while maintaining the integrity of its software supply chain. 

## Expansion Of Default MFA Settings 

Microsoft is expanding its default Multi-Factor Authentication (MFA) settings to enhance security across a broader range of customer services, aiming to implement these changes over the next year.  

Brad Smith emphasized the company's commitment to providing more secure default policies for MFA, aligning with customer feedback and insights gained over the past year.  

According to Charlie Bell, Microsoft's focus on scaling MFA where it's most needed reflects their strategy to fortify customer protection through both engineering advancements and effective communication. Looking ahead, Bell highlighted Microsoft's plans to accelerate the adoption of security defaults across various aspects of their services. 

## Faster Cloud Vulnerability Mitigation 

As part of its newly announced security initiative, Microsoft aims to accelerate the response to cloud vulnerabilities significantly. According to Brad Smith's blog post, the company intends to slash the time required to mitigate cloud vulnerabilities by 50 percent. 

This commitment underscores Microsoft's proactive approach to enhancing cloud platform security. 

Additionally, Microsoft plans to enhance transparency in reporting by implementing new measures to ensure clearer and more consistent communication regarding security incidents.  

Charlie Bell highlighted in his post that these improvements are made possible through Microsoft's investments in automation, orchestration, and intelligence-driven tools and processes. 

These advancements are geared towards reinforcing Microsoft's capability to swiftly address security challenges and maintain robust cybersecurity across its cloud platforms. 

![b 31.2.webp](https://strapiassets.blr1.digitaloceanspaces.com/b_31_2_9e62d9aa9c.webp)

Microsoft has unveiled plans to bolster its identity protection capabilities across its product lineup in response to the rising threat of identity-based attacks. 

Charlie Bell emphasized the introduction of a "new identity system" aimed at unifying and standardizing the management and verification of identities and access rights across Microsoft's various products and platforms.

This initiative marks a significant step towards enhancing security by providing a cohesive framework for user, device, and service authentication. 

Moreover, Microsoft intends to democratize these advanced identity capabilities by offering them for free to non-Microsoft application developers. 

Brad Smith highlighted in his blog post that this strategic move aims to extend the robust security features beyond Microsoft's ecosystem, fostering broader adoption and strengthening overall cybersecurity across digital environments. 

 

Microsoft is taking decisive steps to enhance the security of its software platforms through a series of substantial updates to its engineering processes. In a recent announcement, the company outlined these changes as part of its broader Secure Future Initiative, emphasizing a commitment to making security the default across its products. 

Microsoft's Security Overhaul: 5 Key Changes

## IBM Consulting and Palo Alto Networks Expand Strategic Partnership

IBM Consulting and Palo Alto Networks have unveiled a major expansion of their strategic alliance, aimed at enhancing cybersecurity defenses in an increasingly complex threat landscape. This enhanced partnership designates Palo Alto Networks as one of IBM Consulting’s elite strategic partners, while IBM Consulting solidifies its role as a leading security services provider for Palo Alto Networks. 

## Enhancing Security Operations and Cloud Transformations

![2.webp](https://strapiassets.blr1.digitaloceanspaces.com/2_e431882d6a.webp)

In response to the growing need for advanced cybersecurity measures, the expanded collaboration will focus on two key areas: modernizing security operations and securing cloud transformations.

The first initiative integrates IBM Consulting’s Cybersecurity Services with Palo Alto Networks' Cortex platform to offer advanced managed security operations. 

This combination leverages AI-driven capabilities to improve threat detection, incident response, and security posture management. The second initiative involves incorporating Palo Alto Networks' Prisma Cloud into IBM Consulting’s service suite to support secure cloud transitions, encompassing comprehensive security assessments, application development, and ongoing monitoring. 

**Footnote**: This strategic expansion is set to bolster cybersecurity frameworks across industries, equipping organizations with the tools and expertise needed to navigate their digital transformation securely and effectively. 

IBM Consulting and Palo Alto Networks have announced a significant expansion of their strategic partnership.

IBM and Palo Alto Networks Strengthen Cybersecurity Partnership


Endpoint devices are primary targets for cyberattacks, with attackers making numerous attempts to breach a single device using tools from the dark web and AI. This scalability increases the risk to your entire fleet. A vulnerability in your enterprise's security setup is an open invitation for attackers.

The security of your fleet hinges on each individual PC. A breach is problematic enough, but an undetected breach allows attackers to escalate privileges and extract sensitive data across your network. 

According to CrowdStrike's Global Threat Report, eCrime breakout times have decreased significantly, emphasizing the need for swift detection and response.

![2.webp](https://strapiassets.blr1.digitaloceanspaces.com/2_573a176708.webp)

Here are key factors that make PCs attractive targets for attackers:

- Visibility Gaps: Despite investments in securing the OS layer with tools like SIEM, NGAV, and EDR, attackers exploit less visible areas such as BIOS and firmware. These attacks are difficult to detect and increase the likelihood of successful breaches.
- Operational Challenges: Organizations often deploy multiple isolated security tools, leading to fragmented responses to threats. Coordinating these tools for effective detection and rapid response is daunting, especially with limited IT and security resources.

Addressing these challenges is crucial to safeguarding your enterprise against evolving cyber threats targeting endpoint devices.

A well-secured PC can be a formidable weapon against cyber adversaries
Dell, as a global technology and infrastructure leader, places a strong emphasis on security.

Their commercial PCs are designed from the ground up to prioritize visibility and action ability. This approach empowers IT and security operations, supporting a Zero Trust strategy by providing comprehensive data for informed decision-making and swift response to emerging threats.

![3.webp](https://strapiassets.blr1.digitaloceanspaces.com/3_1576ff7ab3.webp)

At the device level, Dell integrates robust defenses and telemetry to enhance security:

- Built-in Defenses: Dell PCs incorporate features like BIOS and firmware verification, enabling administrators to validate device integrity and detect unauthorized changes.
- Behavior-Based Threat Detection: Indicators of Attack (IOA) monitor device behavior for anomalies such as BIOS downgrades or chassis intrusions, enabling proactive threat mitigation.
- Forensic Capabilities: BIOS Image Capture allows for detailed forensic analysis of compromised BIOS instances, ensuring thorough incident response.

These security measures generate valuable telemetry, such as alerts for outdated BIOS versions or physical tampering. Dell's Trusted Device Application (DTD App) aggregates and presents this telemetry at the OS layer, facilitating rapid investigation and response by IT teams.

Dell's commitment to security is validated by third-party assessments, confirming their leadership in built-in PC security. According to Principled Technologies, Dell is recognized for delivering the world's most secure commercial PCs, setting them apart in an industry where security claims are commonplace.

Dell emphasizes proactive security and manageability in their PC designs, ensuring that visibility translates into effective action for both security and IT operations.

- Benefits for SecOps: Dell's Trusted Device Application (DTD App) leverages built-in security telemetry, collaborating with partners like CrowdStrike and Intel for hardware-assisted security. This continuous stream of device-level data enhances threat detection and response capabilities, bolstering overall security posture and optimizing security investments.

- Benefits for ITOps: Integration of Dell telemetry allows administrators to enforce policies through Microsoft Intune, enabling actions such as quarantining infected devices, applying patches, and adjusting access rights to enhance security and compliance. Intel vPro's out-of-band management capabilities further enable remote device management and data wipe as needed, ensuring fleet security.

- Built-in Security for Cyber Survival: Dell stresses the importance of integrating security from the outset of product design to protect organizations from evolving threats. 

Unlike retroactively adding security measures post-manufacturing, Dell’s approach ensures PCs are resilient and better equipped to defend against cyberattacks out-of-the-box. 

By feeding device-level telemetry into security software, Dell enhances threat detection and response capabilities, making actions more informed and effective.

Dell remains committed to securing PCs comprehensively, aiming to make them resilient against cyber threats in an increasingly complex digital landscape. 

For more insights on Dell's approach to PC security, you can watch their ISMG interview or reach out to Dell's security specialists for further information.


Endpoint devices are primary targets for cyberattacks, with attackers making numerous attempts 

Why Your PC is a Prime Target for Cyberattacks - DELL

The convergence of IT and operational technology (OT), along with the digital transformation of OT environments, has opened up new avenues for innovation and efficiency in Industrial Automation and Control Systems. 

However, these advancements have expanded the potential attack surface, increasing the need for enhanced security measures.  

To address these growing cybersecurity threats, Palo Alto Networks (NASDAQ: PANW) has introduced new features in its OT Security solution, including the industry's first fully integrated, risk-based guided virtual patching system powered by Precision AI™.  

Other key updates include the Prisma® Access Browser with Privileged Remote Access and ruggedized ML-powered Next-Generation Firewalls (NGFWs) designed for industrial settings. 

Key OT Threat Statistics: According to the 2024 State of OT Security report from Palo Alto Networks and ABI Research, 70% of industrial organizations faced a cyberattack on their OT systems last year, with nearly 25% of these attacks leading to operational shutdowns. 
 
 
![2.webp](https://strapiassets.blr1.digitaloceanspaces.com/2_f84ae07df6.webp)
## Enhanced Protection for OT Environments

Anand Oswal, SVP and GM of Network Security at Palo Alto Networks, emphasized that the increasing frequency and complexity of OT attacks—often driven by AI—underscore the critical need for robust OT-specific security solutions.  

The new OT Security suite provides end-to-end protection, real-time visibility, and simplified security management, securing both OT and converged IT/OT infrastructures.  

- Comprehensive Protection: The solution secures all OT environments, including networks, assets, remote operations, and 5G systems. 
- Consistent IT/OT Security: The integrated approach helps protect converged IT/OT operations, ensuring critical infrastructure remains safe from emerging threats. 

## AI-Powered Tools for Improved Cybersecurity

Sid Snitkin, Vice President of Cybersecurity Services at ARC Industrial Cybersecurity, stated that the increasing complexity and interconnectivity of OT environments have made them more vulnerable to cyber threats. AI-powered tools like Guided Virtual Patching are revolutionary for industrial cybersecurity.  

- AI-Driven Patching: The Precision AI-powered virtual patching system automates asset inventory, risk assessment, and vulnerability prioritization, allowing security teams to address hard-to-patch systems swiftly without operational disruptions. 
- Operational Continuity: By enabling real-time patching, the solution extends the lifespan of legacy OT assets while preventing costly interruptions. 

## New Features to Enhance OT Security 

![3.webp](https://strapiassets.blr1.digitaloceanspaces.com/3_1c0e75bf0c.webp)
Palo Alto Networks' latest OT Security updates include several new features designed to improve remote operations and protect critical infrastructure in challenging environments: 

Secure Remote Operations: The new Prisma Access Browser with Privileged Remote Access simplifies the management of remote operations.  

- Ruggedized Firewalls: The PA-400R Series firewalls are designed for industrial environments where traditional firewalls often fail. 

- Built to withstand extreme conditions such as wind, rain, and extreme temperatures, they offer continuous security and connectivity, even in space-constrained environments like factory floors or utility substations.  

- 5G Connectivity: These firewalls also include models with 5G connectivity, ensuring remote industrial sites remain secure and connected. Features such as fail-to-wire capabilities ensure uninterrupted security while reducing costs. 

## Future of OT Security

At the Industrial Control Systems (ICS) Cybersecurity Conference, attendees can explore Palo Alto Networks’ new OT security capabilities through an interactive CyberWall tour. 

Qiang Huang, head of product management for IoT Security at Palo Alto Networks, will deliver a keynote on “Navigating the OT Security Nexus: AI, Digital Transformation, and Emerging Threats,” addressing how AI-driven solutions are transforming OT cybersecurity. 

With these cutting-edge tools and solutions, Palo Alto Networks is positioned to help organizations tackle the growing challenges of OT cybersecurity while driving innovation in critical industrial sectors. 

As the integration of IT and operational technology (OT) accelerates alongside the digital transformation of OT environments, opportunities for innovation and efficiency in Industrial Automation and Control Systems are on the rise. 

Palo Alto Networks Launches OT Security to Combat Industrial Cyber Threats

As the landscape of hybrid cloud, AI, and quantum technologies presents new data security challenges, IBM (NYSE: IBM) has launched the IBM Guardium Data Security Center.

This innovative platform enables organizations to safeguard their data across various environments throughout its entire lifecycle, employing unified controls. 

## Unified Data Protection and Governance

The IBM Guardium Data Security Center offers a comprehensive view of an organization’s data assets, empowering security teams to streamline workflows related to data monitoring, governance, detection, response, and cryptography management through a single dashboard.  

By incorporating generative AI capabilities, the platform aids in generating risk summaries and enhances the productivity of security professionals. 

One of the standout features of the center is IBM Guardium AI Security, a solution designed to shield organizations’ AI deployments from security vulnerabilities and data governance violations. 

This is particularly relevant as the adoption of generative AI surges and concerns regarding "shadow AI" — unsanctioned models operating outside organizational oversight — grow. 

## Quantum-Safe Protection

In addition, the IBM Guardium Data Security Center includes IBM Guardium Quantum Safe, a software tool that safeguards encrypted data against potential future cyberattacks that may be executed using quantum computers.  

"Generative AI and quantum computing offer vast opportunities, but they also introduce new risks," noted Akiba Saeedi, Vice President of IBM Security Product Management. 

"During this transformative era, organizations must enhance their crypto-agility and diligently monitor their AI models and training data. The IBM Guardium Data Security Center — with its AI Security, Quantum Safe, and integrated capabilities — provides extensive risk visibility." 

![2.webp](https://strapiassets.blr1.digitaloceanspaces.com/2_6b71a90834.webp)

## Comprehensive Visibility and Management

IBM Guardium Quantum Safe facilitates visibility and management of enterprise cryptographic security, addressing vulnerabilities and guiding remediation efforts.  

By consolidating information on crypto algorithms, vulnerabilities, and network usage into a single dashboard, security analysts can effectively monitor policy compliance and track remediation progress. 

The tool also offers customizable metadata and flexible reporting features to prioritize critical vulnerabilities. 

Furthermore, IBM Guardium AI Security helps organizations manage security risks and data governance for sensitive AI data and models.  

It identifies AI deployments, ensures compliance, mitigates vulnerabilities, and protects sensitive data through a holistic view of data assets. Integration with IBM watsonx and other generative AI SaaS providers allows for the identification and governance of "shadow AI" models. 

## An Integrated Approach to Data Security 

As risks associated with hybrid cloud, AI, and quantum technologies escalate, protecting key data — such as medical records, financial transactions, and intellectual property — necessitates innovative security solutions.  

![3.webp](https://strapiassets.blr1.digitaloceanspaces.com/3_fbc968136a.webp)

Organizations require a trustworthy partner and a cohesive approach to data security, rather than relying on a fragmented array of point solutions. IBM is at the forefront of pioneering this integrated strategy. 

IBM Guardium Quantum Safe complements broader quantum-safe initiatives from IBM Consulting and Research.  

This software is bolstered by advanced technologies developed by IBM Research, which recently had several post-quantum cryptography algorithms standardized by the U.S. National Institute of Standards and Technology (NIST). 

IBM Consulting also offers Quantum Safe Transformation Services that utilize these technologies to help organizations assess risks, inventory them, and develop scalable strategies for addressing these vulnerabilities.  

With a deep pool of cybersecurity professionals experienced in cryptography and quantum-safe technologies, IBM Consulting has supported numerous clients across sectors like telecommunications, finance, and government in fortifying their defenses against both current and emerging risks. 

## Enhanced Identity Management Solutions

The new IBM Verify Digital Credentials allows users to manage and store their credentials securely, digitizing physical documents like driver's licenses and employee badges. This solution standardizes, secures, and facilitates the sharing of credentials while maintaining privacy and control. 

As IBM continues to innovate in the realms of data security and identity management, organizations can trust that they are equipped with the tools needed to navigate the complexities of today's digital landscape. 

As the landscape of hybrid cloud, AI, and quantum technologies presents new data security challenges, IBM (NYSE: IBM) has launched the IBM Guardium Data Security Center.

IBM upgraded Guardium for secure AI and quantum-safe technology.

## Dell Enhances PowerMax High-End Arrays

Dell has upgraded its PowerMax high-end arrays, delivering enhanced performance, improved management efficiencies, robust data protection, cyber resilience, and seamless data mobility between on-premises and public cloud environments.

The new subscription business model aims to provide flexible options for users. 

Inserting image... ![2.webp](https://strapiassets.blr1.digitaloceanspaces.com/2_3b29e4b155.webp)

PowerMax is a high-availability enterprise block storage solution that competes with IBM’s DS8000, Hitachi Vantara’s VSP One, and Infinidat’s InfiniBox. 

According to Brian Henderson, Director of Primary Storage and ISG (Infrastructure Solutions Group) Portfolio Messaging at Dell, the key objectives of this update include improving AI-driven efficiency, enhancing cyber resiliency, and enabling multicloud mobility. 

- Performance Boost: PowerMax v10.2 OS utilizes AI for dynamic cache optimization, reducing data access latency and increasing speed without management overhead. 
- Increased IOPS: The PowerMax 8500 model claims up to a 30% boost in IOPS performance for Random Write Miss (8K) I/Os per second compared to the previous v10.1 OS. 
- Faster Connectivity: New 100 Gb Ethernet I/O modules offer up to 3x faster connectivity, while 64 Gb Fibre Channel I/O modules provide up to 2x faster performance than their predecessors. 

## Enhanced Data Protection and Management Features

PowerMax v10.2 also improves IOPS performance and reduces latency for unbalanced mainframe workloads, enhancing cyber intrusion detection (zCID) with auto-learning access patterns. Additionally, it utilizes IBM’s System Recovery Boost to facilitate quicker recovery during planned or unplanned outages. 

On the protection front, Storage Direct Protection integrates with PowerProtect, allowing for up to 1 PB of backups daily and 500 TB of restores. It supports various cloud providers, including AWS, Azure, Google, and Alibaba, helping customers avoid vendor lock-in. 

Dell’s Cyber Recovery Services for PowerMax provides a secure vault against cyberattacks, ensuring faster data recovery through granular data protection. Furthermore, YubiKey multifactor authentication enhances security by simplifying user access processes. 

![3.webp](https://strapiassets.blr1.digitaloceanspaces.com/3_a1de9381d4.webp)

PowerMax management now features autonomous health checks that offer corrective actions and self-healing capabilities, addressing potential issues like storage capacity levels and loose cabling before they impact performance. 

- Automated Incident Resolution: The Fabric Performance Impact Notification (FPIN) system identifies Fibre Channel network congestion, enabling up to 8x faster incident resolution. 
- AIOps Assistant: This feature supports GenAI natural language queries for quicker infrastructure optimization. 
- Improved RAID Efficiency: The new RAID 6 24+2 scheme allows 92% of drive capacity to be utilized effectively. 

Additionally, Dell offers simple options for moving live PowerMax workloads to and from APEX Block Storage, which can be deployed on-premises or within AWS and Azure public clouds through RiverMeadow Cloud Mobility. 

 

Dell’s PowerMax storage systems have been enhanced with advanced management features, including autonomous health checks designed to optimize performance and ensure reliability. 

Dell Upgrades High-End PowerMax Array 

## Sophos to Enhance Cybersecurity Offerings

Thoma Bravo-backed cybersecurity firm Sophos announced its acquisition of Secureworks, a subsidiary of Dell Technologies, for $859 million in cash.  

The acquisition is aimed at strengthening Sophos' product lineup for enterprise customers, adding more advanced capabilities to its cybersecurity portfolio. Sophos is keen to enhance its presence in the cybersecurity market by offering more comprehensive protection and services to its clients. 

![2.webp](https://strapiassets.blr1.digitaloceanspaces.com/2_d0b6106aa3.webp)

Thoma Bravo-backed Sophos will acquire Secureworks, a Dell Technologies subsidiary, for $859 million in cash. 

- The acquisition strengthens Sophos' enterprise cybersecurity product lineup, enhancing its market presence. 
- Sophos aims to offer more advanced protection and services to its clients through this deal. 
- Secureworks' shareholders, including Dell, will receive $8.50 per share. 
- Following the news, Secureworks' stock dipped 1.5% to $8.35 in early trading. 
 
Despite the acquisition, Secureworks has struggled against larger competitors in the cybersecurity sector. 

## Expanding Cybersecurity Portfolio

Founded in 1998, Secureworks became known for its Taegis platform, a cloud-based solution designed to detect and combat advanced threats.  

However, despite its innovative approach, Secureworks struggled to differentiate itself from larger competitors in the cybersecurity industry. 

The company reported a quarterly loss of 17 cents per share for the period ending July 31, which highlighted the difficulties it faced in keeping pace with other providers. 
![3.webp](https://strapiassets.blr1.digitaloceanspaces.com/3_52edf5e865.webp)

Dell acquired Secureworks in 2011 for $612 million and later took the company public in 2016. 

Despite previous attempts to sell Secureworks, including a reported effort in 2019, Dell finally turned to investment bankers from Morgan Stanley and Piper Sandler to assess takeover interest.  

Thoma Bravo, which has been actively building a portfolio of cybersecurity assets, is expected to finalize the deal by early 2025, further solidifying its presence in the market after its earlier acquisition of UK-based Darktrace for $5.3 billion. 

 

Thoma Bravo-backed cybersecurity firm Sophos has made a significant move in the tech industry by acquiring Secureworks, a subsidiary of Dell Technologies, for $859 million in cash.

Sophos acquired SecureWorks for $859 million to boost Cybersecurity 

## Barracuda Networks Wins Prestigious Awards

Barracuda Networks, recognized as a prominent player in the cybersecurity landscape, has recently garnered two prestigious product innovation awards from CRN and CyberSecurity Breakthrough.  

In a notable achievement, Barracuda Managed XDR has been awarded the title of Best Cybersecurity Offering in the esteemed CRN MSP Innovation Awards.  

![2.webp](https://strapiassets.blr1.digitaloceanspaces.com/2_bfdba19143.webp)

Concurrently, Barracuda Email Protection has been honored as the Email Security Platform of the Year at the Cybersecurity Breakthrough Awards, further solidifying Barracuda’s reputation for excellence in the industry. 

## Commitment to Cybersecurity Innovation 

Expressing pride in these achievements, Hatem Naguib, CEO of Barracuda Networks, stated, “We are incredibly honored to earn recognition from CRN and Cybersecurity Breakthrough as the gold standard in cybersecurity with our industry-leading email and managed XDR solutions.”  

Naguib emphasized Barracuda's ongoing commitment to empowering resource-constrained organizations, helping them navigate the complexities of an ever-evolving threat landscape. 

He further noted that Barracuda remains dedicated to continuous innovation, ensuring that its platform adapts to meet the diverse and changing needs of partners and customers alike. 

Barracuda Managed XDR has been recognized by CRN for its exceptional capabilities in threat detection and response, providing organizations with robust protection through 24/7 security operations center (SOC) monitoring.  

![3.webp](https://strapiassets.blr1.digitaloceanspaces.com/3_cfe6798cf3.webp)

This proactive approach strengthens cyber resilience by accelerating the identification and mitigation of threats across various attack surfaces. 

Organizations benefit significantly from having access to a skilled team of security operations specialists, ensuring around-the-clock coverage that alleviates the pressure on internal resources. 

On the other hand, Barracuda Email Protection adds another critical layer of security to the comprehensive cybersecurity platform offered by Barracuda. It has been recognized by CyberSecurity Breakthrough for its advanced threat protection capabilities.  

Powered by cutting-edge machine learning and artificial intelligence, Barracuda Email Protection safeguards against email threats with high detection accuracy, effectively minimizing false positives.  

The platform also facilitates incident response, enabling automated post-delivery remediation by quickly identifying and eliminating instances of malicious emails, thus mitigating potential damage. 

The recent accolades from CRN and CyberSecurity Breakthrough are the latest highlights in a series of product recognitions for Barracuda.  

This year alone, Barracuda has received numerous honors, including distinctions in the CRN Annual Report Card, being named a CRN Security 100 leader, earning CIO Choice recognition, and being awarded the Global InfoSec Award across five categories. 

These achievements underscore Barracuda's ongoing commitment to providing cutting-edge cybersecurity solutions and its leadership in the industry. 

Barracuda Networks, recognized as a prominent player in the cybersecurity landscape, has recently garnered two prestigious product innovation awards from CRN and CyberSecurity Breakthrough.  

Barracuda wins two awards from CRN and Cybersecurity Breakthrough

## Released Updates
Hewlett Packard Enterprise (HPE) has released updates for its Instant AOS-8 and AOS-10 software to fix two critical security vulnerabilities affecting Aruba Networking Access Points. 

The vulnerabilities could allow remote attackers to execute unauthenticated command injection by sending specially crafted packets to Aruba's Access Point management protocol (PAPI) via UDP port 8211. 

The flaws, identified as CVE-2024-42509 and CVE-2024-47460, are rated with severity scores of 9.8 and 9.0, respectively, and impact the command line interface (CLI) service accessed through the PAPI protocol. 

Additionally, the update addresses four other security issues: 

- CVE-2024-47461 (severity score 7.2): Enables authenticated remote command execution, allowing attackers to run arbitrary commands on the underlying OS. 
- CVE-2024-47462 and CVE-2024-47463 (severity score 7.2): Allow authenticated attackers to create arbitrary files, which could potentially lead to remote command execution. 
- CVE-2024-47464 (severity score 6.8): Allows an authenticated attacker to access unauthorized files via path traversal. 

These vulnerabilities affect AOS-10.4.x.x (version 10.4.1.4 and older), Instant AOS-8.12.x.x (version 8.12.0.2 and earlier), and Instant AOS-8.10.x.x (version 8.10.0.13 and previous versions). 

HPE’s advisory also mentions that older software versions that have reached their End of Maintenance date are affected, but will not receive security updates. 

## Recommended Updates and Workarounds

To mitigate these vulnerabilities, HPE advises users to upgrade to the following versions or later: 

- AOS-10.7.x.x: Update to version 10.7.0.0 or newer. 

- AOS-10.4.x.x: Update to version 10.4.1.5 or later. 

- Instant AOS-8.12.x.x: Update to version 8.12.0.3 or above. 

- Instant AOS-8.10.x.x: Update to version 8.10.0.14 or newer. 

For situations where immediate updates aren’t possible, HPE has suggested the following workarounds: 

For critical vulnerabilities: Restrict or block UDP port 8211 from any untrusted networks. 

For other vulnerabilities: Limit access to the CLI and web-based management interfaces by isolating them on a dedicated layer 2 segment or VLAN, and manage access with layer 3 or higher firewall policies to reduce exposure. 

No instances of active exploitation have been reported, but HPE strongly recommends applying these updates or mitigations to secure systems. 

Hewlett Packard Enterprise (HPE) has released updates for its Instant AOS-8 and AOS-10 software to fix two critical security vulnerabilities affecting Aruba Networking Access Points. 


HPE Warns of Severe RCE Flaws in Aruba Access Points 

Palo Alto Networks is advising its customers to secure access to the PAN-OS management interface following reports of a potential remote code execution (RCE) vulnerability.  

While details about the origin of the claim are unclear, the cybersecurity firm has acknowledged that an individual has allegedly identified a new RCE vulnerability within the PAN-OS management interface. 

## No Evidence of Exploitation So Far

The company is closely monitoring for any exploitation attempts but has not observed any evidence of a zero-day exploit in action. 
![2.webp](https://strapiassets.blr1.digitaloceanspaces.com/2_5f800229dc.webp)
Palo Alto Networks also stated that it currently lacks specific information about the claimed vulnerability or any indicators of compromise (IoCs) related to it. 

Despite not having full details of the vulnerability, Palo Alto Networks is confident that securing the PAN-OS management interface would mitigate the risk, regardless of the nature of the vulnerability. 

The company emphasized that Prisma Access and cloud NGFW products would not be affected by the issue. 

## Best Practices for Securing the Interface

Palo Alto Networks strongly recommends that customers ensure their management interface access is configured according to its best practice deployment guidelines.  

Access should be restricted to trusted internal IPs only, and not be accessible from the internet. The company highlighted that most firewalls already adhere to these industry best practices. 

The company has provided instructions on how to identify internet-exposed management interfaces and secure them to prevent potential threats. 

## Related Vulnerability Alert: CVE-2024-5910
![3.webp](https://strapiassets.blr1.digitaloceanspaces.com/3_6edbcef150.webp)
This advisory comes shortly after the Cybersecurity and Infrastructure Security Agency (CISA) added a Palo Alto Networks Expedition vulnerability, tracked as CVE-2024-5910, to its Known Exploited Vulnerabilities Catalog.  

This flaw, patched in July, allows attackers to take over an admin account and access sensitive data. While technical details have been available since early October, there is no public information on any attacks exploiting the vulnerability. 

Palo Alto Networks is advising its customers to secure access to the PAN-OS management interface following reports of a potential remote code execution (RCE) vulnerability.  

Palo Alto Networks Responds to Allegations of Remote Code Execution Vulnerability 

## Cisco's Critical Alert
Cisco has issued a critical alert regarding a serious vulnerability in its Ultra-Reliable Wireless Backhaul systems, which could make the devices vulnerable to remote exploitation. 

![2.webp](https://strapiassets.blr1.digitaloceanspaces.com/2_a0bc314531.webp)

The flaw, known as CVE-2024-20418, was made public yesterday and impacts the Unified Industrial Wireless Software that powers these devices. 
This security hole is particularly concerning due to its potential to allow unauthorized users to gain elevated privileges on affected systems.

- Vulnerability Overview: The CVE-2024-20418 vulnerability is linked to the web-based management interface of the devices, which is used to configure and monitor the systems. 

The issue allows remote attackers, even without any pre-existing privileges, to exploit the flaw by sending specially crafted HTTP requests to the system. This could ultimately allow them to gain admin-level access to the device.

- Risk of Exploitation: A successful exploitation of this vulnerability would give the attacker the ability to execute arbitrary commands with root privileges on the underlying operating system of the affected device. 

## Quick Mitigation 

![3.webp](https://strapiassets.blr1.digitaloceanspaces.com/3_b76fc35ecd.webp)

This could lead to full control over the system, enabling the attacker to install malicious software, manipulate device functions, or potentially use the system as a foothold for further attacks.

- Potential Impact: The ability to escalate privileges remotely without any user interaction makes this flaw particularly dangerous. Organizations using the affected Ultra-Reliable Wireless Backhaul systems could face severe risks, including compromised network infrastructure, data breaches, and potential system outages.

Cisco has emphasized the importance of addressing this issue quickly to mitigate the risks associated with the vulnerability. 

As of now, they have not released detailed steps for patching, but users are strongly advised to monitor updates from Cisco and apply necessary patches as soon as they become available. 

This flaw highlights the ongoing need for rigorous security measures in networked devices, particularly those critical to industrial operations.


Cisco has issued a critical alert regarding a serious vulnerability in its Ultra-Reliable Wireless Backhaul systems, which could make the devices vulnerable to remote exploitation. 

Cisco Hits CVSS 10 with Critical Wireless System Vulnerability

In a strategic initiative to address the growing complexities of the cybersecurity landscape, CrowdStrike and Fortinet have announced a partnership that integrates CrowdStrike's Falcon platform with Fortinet's FortiGate next-generation firewalls.  

This collaboration is set to deliver comprehensive, end-to-end security that spans networks, applications, and devices, enhancing protection against an evolving threat environment. 

## Unified Security for Modern Challenges

Daniel Bernard, Chief Business Officer at CrowdStrike, and John Maddison, Chief Marketing Officer at Fortinet, shared insights into their collaboration aimed at creating a multi-layered, integrated security solution that leverages the best technologies available.  

Bernard expressed enthusiasm for the partnership, highlighting the thrill of two technology leaders joining forces to tackle customer challenges innovatively.  

He emphasized that this collaboration not only addresses critical gaps between network and endpoint security but also aligns with their shared "partner-first" philosophy, which seeks to effectively scale solutions for both large enterprises and small-to-medium businesses. 

This partnership addresses a significant challenge in contemporary cybersecurity: the limitations of traditional, isolated security tools.  

As Maddison noted, customers are increasingly seeking a best-of-breed approach that enables advanced endpoint protection to seamlessly integrate with robust network security.  

This integration results in a more comprehensive understanding of various threat vectors and enhances the capacity to prevent lateral movement at both the endpoint and network layers. 

## Enhancing Detection with AI

What sets the partnership between CrowdStrike and Fortinet apart is its AI-driven approach, designed to enhance both the speed and accuracy of threat detection. 

The Falcon platform, recognized for its advanced AI and adversary intelligence capabilities, is complemented by Fortinet's FortiGuard AI-powered security services. 

This collaboration enriches telemetry across network and endpoint layers, allowing organizations to swiftly identify and respond to fast-evolving threats in real time. 

Bernard emphasized that the seamless integration of these technologies can significantly reduce the time needed to detect and resolve incidents, which is crucial in today’s high-stakes cyber environment. 

“Our objective is to automate processes as much as possible, minimizing the number of clicks required for customers to act swiftly and efficiently,” he stated. 

## Streamlining Security Operations

A key advantage of the CrowdStrike and Fortinet integration is its potential to simplify security operations.  

Bernard underscored that customers should not have to act as system integrators; instead, they should be able to implement solutions with minimal effort.  

By offering a unified console for monitoring both endpoint and network activity, the partnership seeks to reduce complexity for security teams, fostering a more cohesive and efficient working environment within Security Operations Centers (SOCs). 

Maddison highlighted the significance of this integration in empowering SOC analysts with the necessary visibility for rapid, informed decision-making.  

“Automating threat responses across endpoints and networks is essential,” he noted, adding that by integrating AI-powered insights from both companies into a single operational workflow,  

“we enable teams to respond instantly, whether that involves isolating a device or segmenting network traffic.” 

## Supporting Flexibility and Growth

CrowdStrike and Fortinet recognize the importance of a flexible and open ecosystem that allows customers to create tailored security strategies.  

Maddison pointed out that this flexibility is especially vital for large, regulated enterprises, which often prefer best-of-breed solutions for specific security needs.  

“Customers desire both an endpoint platform and a network platform; they don’t want to manage a myriad of vendors while still needing strong security layers,” he explained. 

Bernard echoed this sentiment, emphasizing that while organizations strive to simplify their security stacks, it is crucial that such consolidation does not compromise effective threat coverage.  

He asserted that this partnership “provides an end-to-end solution that feels cohesive for customers while leveraging the strengths of each technology.” 

## Future Prospects

Looking to the future, both companies are committed to further integrating their AI capabilities and pursuing additional joint innovations.  

The initial focus of the partnership will be on shared threat intelligence and automated response workflows. However, both leaders are enthusiastic about the potential of generative AI to enhance their collaboration. 

“Imagine a SOC analyst accessing insights from both Fortinet and CrowdStrike through conversational AI, receiving comprehensive intelligence that encompasses both network and endpoint data,” Bernard envisioned.  

This unified, AI-driven ecosystem has the potential to significantly improve organizations’ threat prevention and response capabilities. 

## New Standards in Cybersecurity

The collaboration between CrowdStrike and Fortinet establishes a cohesive, AI-enhanced defense strategy that integrates endpoint and network protection.  

By combining their unique strengths, these industry leaders empower organizations to streamline security operations, gain deeper insights, and respond to threats with increased speed and accuracy. 

As Bernard summarized, “This partnership transcends mere integration; it’s about creating a seamless experience that equips organizations to effectively halt breaches.” 

CrowdStrike and Fortinet have announced a partnership that integrates CrowdStrike's Falcon platform with Fortinet's FortiGate next-generation firewalls.  

Fortinet and CrowdStrike unite to block network and endpoint threats! 

Microsoft has patched four critical security flaws that could allow an attacker to manipulate its artificial intelligence, cloud services, enterprise resource planning (ERP) tools, and the Partner Center platform. 
![2.webp](https://strapiassets.blr1.digitaloceanspaces.com/2_06f4a52a98.webp)
Among them, one of the vulnerabilities was found being exploited in the wild, thus making it necessary to fix these vulnerabilities immediately.

## Critical Vulnerability Exploited in the Wild

The most severe issue is CVE-2024-49035, a privilege escalation vulnerability in the partner.microsoft[.]com platform, which has been given a CVSS score of 8.7. Microsoft confirmed that this vulnerability is being exploited in the wild and described it as follows:

_"An improper access control vulnerability in partner.microsoft[.]com allows an unauthenticated attacker to elevate privileges over a network."_

This vulnerability has resulted in unauthorized access and escalation of privileges to sensitive systems that have been compromised. 

It was discovered and reported by the researchers Gautam Peri, Apoorv Wadhwa and an anonymous contributor. 

In fact, Microsoft has declined to give out details of the exploitation of the flaw, apparently to discourage further misuse.

The fixes were rolled out automatically:

Microsoft has fixed these vulnerabilities via automatic updates, especially for the online version of Microsoft Power Apps. 

This way, the user is protected immediately, and there is no need for a manual update.

## Other Vulnerabilities Patched

Besides CVE-2024-49035, Microsoft has addressed three other vulnerabilities, two of which are Critical and one Important:

**1.	CVE-2024-49038 (CVSS score: 9.3)**
Type: Cross-Site Scripting (XSS) vulnerability.
- Affected Service: Copilot Studio.
- Impact: This vulnerability could be used by an unauthorized attacker to gain privilege escalation over a network, possibly reaching sensitive data or systems.

**2.	 CVE-2024-49052 (CVSS score: 8.2)**
Type: Missing Authentication for Critical Function.
- Affected Service: Microsoft Azure PolicyWatch.
- Impact: This vulnerability enables an unauthorized attacker to escalate privileges over a network, causing high risks to the affected Azure environments.

**3.  CVE-2024-49053 (CVSS score: 7.6)**
Type: Spoofing vulnerability.
- Affected Service: Microsoft Dynamics 365 Sales.
- Impact: An authenticated attacker could craft a bad URL and phish a user into clicking it, possibly redirecting them to some malicious site.

## Dynamics 365 Required Action

While most of the vulnerabilities are automatically mitigated, users of Dynamics 365 Sales apps on Android and iOS must take a manual step. Microsoft advises installing version 3.24104.15 to prevent attacks from CVE-2024-49053. This update is imperative to prevent attackers from using the spoofing flaw.

## Vigilance and Updates Are Key

Microsoft has acted quickly and maintained strong security measures, especially on the cloud and enterprise front. 

It encourages users to maintain their systems and applications in an updated manner to reduce vulnerabilities. 

As the landscape of cybersecurity is changing, proactive patching and vigilant monitoring are the best ways to protect sensitive data and systems.


Microsoft has patched four critical security flaws that could allow an attacker to manipulate its artificial intelligence, cloud services, enterprise resource planning (ERP) tools, and the Partner Center platform. 

Microsoft Patches AI, Cloud, and ERP Flaws; One Actively Exploited

This week, SonicWall rolled out patches addressing multiple vulnerabilities in its SMA100 SSL-VPN Secure Access Gateway, including several high-severity flaws that could allow attackers to remotely execute code (RCE).

## Buffer Overflow 

Two of the most critical vulnerabilities are buffer overflow bugs, which could have dire consequences if exploited. 

Tracked as CVE-2024-45318 and CVE-2024-53703 (with a CVSS score of 8.1), these flaws affect the web management interface and a library loaded by the Apache web server. 

![2.webp](https://strapiassets.blr1.digitaloceanspaces.com/2_aeef67449b.webp)

Both vulnerabilities could enable attackers to trigger stack-based buffer overflows, potentially leading to remote code execution.

## Heap-based Overflow & Authentication Bypass

Another significant issue is CVE-2024-40763, a heap-based buffer overflow caused by the use of the strcpy function. 

While this flaw also allows for potential RCE, it requires authentication for exploitation, according to SonicWall's advisory.

Additionally, a high-severity authentication bypass bug, tracked as CVE-2024-45319, could allow an authenticated remote attacker to bypass certificate requirements during authentication, giving unauthorized access.

## Cryptographic Weakness Exposed

SonicWall also patched a cryptographic vulnerability in the SMA100 SSLVPN backup code generator, which used a weak pseudo-random number generator (PRNG) that could be predicted by attackers. 

This flaw is tracked as CVE-2024-53702.

## Patching Recommendations

These vulnerabilities affect SMA 100 series appliances running firmware version 10.2.1.13-72sv and earlier. SonicWall has addressed these issues in firmware version 10.2.1.14-75sv. 

Fortunately, the SMA1000 SSL VPN series products are not affected by these vulnerabilities.

SonicWall has emphasized that there is no evidence of these vulnerabilities being exploited in the wild. 

However, given the potential risks, users are strongly advised to update their appliances as soon as possible. Past incidents have shown that attackers often target known vulnerabilities, so patching is critical to safeguarding systems.

SonicWall's proactive approach in addressing these vulnerabilities highlights the ongoing need for vigilance and timely updates in maintaining the security of networking products.


This week, SonicWall rolled out patches addressing multiple vulnerabilities in its SMA100 SSL-VPN Secure Access Gateway

SonicWall Fixes 6 Vulnerabilities in Secure Access Gateway

Cisco has issued security patches for a critical bootloader vulnerability in its NX-OS software, which affects over 100 devices, including several models in the Nexus, UCS, and MDS series. 

![2.webp](https://strapiassets.blr1.digitaloceanspaces.com/2_bc6d53b8bd.webp)

This flaw could allow attackers to bypass image signature verification, potentially leading to the installation of unverified software. 

Tracked as CVE-2024-20397, the vulnerability has been assigned a CVSS score of 5.2, indicating a moderate risk level, though the consequences could still be severe if exploited.

## How the Vulnerability Works

The vulnerability lies within the bootloader settings of Cisco's NX-OS Software, which is used in its network devices. 

Insecure configurations in the bootloader could allow attackers—either unauthenticated individuals with physical access or authenticated users with administrative privileges—to bypass the NX-OS image signature verification.

This could enable malicious software to be loaded onto the device without verification, posing a serious security threat.

## Affected Cisco Products

The vulnerability impacts several Cisco products running vulnerable BIOS versions, regardless of their configuration. The affected devices include:

•	UCS 6500 Series Fabric Interconnects
•	MDS 9000 Series Multilayer Switches
•	Nexus 3000 Series Switches
•	Nexus 7000 Series Switches
•	Nexus 9000 Series Fabric Switches (in ACI mode)
•	Nexus 9000 Series Switches (in standalone NX-OS mode)
•	UCS 6400 Series Fabric Interconnects

The vulnerability is tracked under multiple references like CSCwj35846, CSCwh76163, and CSCwm47438.

## Potential Risks

If exploited, the flaw could allow attackers to load unverified software onto affected devices, potentially compromising network security and functionality. 

This could pave the way for more serious attacks, such as data theft or network disruptions. 

However, Cisco’s Product Security Incident Response Team (PSIRT) has confirmed that there are no known cases of this vulnerability being exploited in the wild.

## Cisco’s Response and Recommendations

Cisco has released patches for the affected devices and recommends that users update their systems to mitigate the risks posed by this vulnerability. 

Unfortunately, there are no workarounds available to address the issue, so applying the patches is critical for securing affected devices.

It’s also important to note that Nexus 92160YC-X devices, which have reached the End of Vulnerability/Security Support, will not receive a fix for this issue.

While this vulnerability poses a moderate risk, the potential for an attacker to bypass critical security measures makes it important for Cisco customers to act promptly. 

Cisco has provided patches to fix the issue, but users must stay vigilant and ensure their devices are up to date to avoid security breaches.


Cisco has issued security patches for a critical bootloader vulnerability in its NX-OS software, which affects over 100 devices, including several models in the Nexus, UCS, and MDS series. 

Hundreds of Cisco Switches Affected by Bootloader Vulnerability

Microsoft’s December 2024 Patch Tuesday has rolled out, delivering crucial security updates that address a total of 71 vulnerabilities, including one actively exploited zero-day flaw.

![2.webp](https://strapiassets.blr1.digitaloceanspaces.com/2_9fd924cd45.webp)

Among the fixes are 16 critical vulnerabilities, all of which involve remote code execution (RCE), highlighting the importance of timely updates. 

## Breaking Down the Numbers 

The vulnerabilities addressed in this month’s Patch Tuesday are distributed as follows: 

- 27 Elevation of Privilege (EoP) vulnerabilities 

- 30 Remote Code Execution (RCE) vulnerabilities 

- 7 Information Disclosure vulnerabilities 

- 5 Denial of Service (DoS) vulnerabilities 

- 1 Spoofing vulnerability 

It’s worth noting that this count does not include two Edge browser vulnerabilities that were resolved in updates released on December 5 and 6. 

## Focus on the Zero-Day Vulnerability 

Among the patches is a fix for an actively exploited zero-day vulnerability, CVE-2024-49138, classified as a Windows Common Log File System Driver Elevation of Privilege Vulnerability. 

This flaw allows attackers to gain SYSTEM privileges on Windows devices, potentially enabling complete system compromise. 

While details on the specific exploitation methods remain undisclosed, the vulnerability was identified by CrowdStrike’s Advanced Research Team. 

As CrowdStrike typically provides detailed analyses, more insights into the exploitation may emerge soon. BleepingComputer reached out to CrowdStrike for additional information but has yet to receive a response. 

## Critical Fixes in December Updates 

This Patch Tuesday also addressed 16 critical vulnerabilities, all categorized as RCE issues. 

These vulnerabilities underscore the importance of ensuring that systems are up-to-date to mitigate risks associated with remote attacks. 

![3.webp](https://strapiassets.blr1.digitaloceanspaces.com/3_4271ba1c9f.webp)

For users interested in broader system improvements, additional non-security updates were released. Detailed articles covering updates for Windows 11 (KB5048667 and KB5048685) and Windows 10 (KB5048652) are available for review. 

## Recent Security Updates from Other Companies 

The cybersecurity ecosystem has been active this December, with updates and advisories from several other vendors. Highlights include: 

- Adobe: Released patches for various products, including Photoshop, Illustrator, InDesign, After Effects, and more. 

- CISA: Published advisories addressing industrial control system vulnerabilities in MOBATIME, Schneider Electric, National Instruments, Horner Automation, Rockwell Automation, and Ruijie. 

- Cleo: An actively exploited zero-day targeting its security file transfer system was linked to data theft attacks. 

- Cisco: Issued security updates for multiple products, including Cisco NX-OS and Cisco ASA. 

- IO-Data: Zero-day router vulnerabilities were exploited to take over devices. 

- 0patch: Released an unofficial patch for a Windows zero-day allowing NTLM credential theft. 

- OpenWrt: Addressed a Sysupgrade flaw that permitted attackers to distribute malicious firmware. 

- SAP: Released December Patch Day updates addressing vulnerabilities across multiple products. 

- Veeam: Fixed a critical RCE vulnerability in its Service Provider Console. 

## Takeaways and Recommendations 

December’s Patch Tuesday highlights the evolving complexity and persistence of cybersecurity threats. Organizations and individuals are strongly encouraged to: 

- Apply Updates Immediately: Install Microsoft’s latest patches to address the 71 vulnerabilities, including the actively exploited zero-day. 

- Monitor for Reports: Stay updated on further analysis of CVE-2024-49138 from CrowdStrike or other security firms. 

- Review Vendor Updates: Ensure other third-party software and systems are patched to mitigate risks from vulnerabilities disclosed by Adobe, Cisco, SAP, and others. 

With attackers continually evolving their methods, staying proactive in applying updates and monitoring emerging threats is crucial for maintaining system integrity and security. As always, vigilance remains a key defense against cyber threats. 

Microsoft’s December 2024 Patch Tuesday has rolled out, delivering crucial security updates that address a total of 71 vulnerabilities

Microsoft's December 2024 Patch Addresses Exploited Zero-Day and 71 Vulnerabilities 

Microsoft recently disclosed a critical vulnerability in Windows Defender (CVE-2024-49071), which could have allowed attackers to access sensitive file data across a network. 

![webp.webp](https://strapiassets.blr1.digitaloceanspaces.com/webp_5c357bee66.webp)

Despite the severity of the issue, users have been advised that no action is required on their part. 

So, what’s the story behind this silent yet effective fix? 

## Understanding the Vulnerability 

The vulnerability, rated critical, stemmed from Windows Defender’s handling of search indexes. 

According to the Debricked vulnerability database, the issue occurred because Windows Defender created a search index of sensitive files without properly restricting access to authorized users. 

This flaw could have allowed attackers with some level of access to exploit the vulnerability and disclose private data over a network. 

Key Details 

- Vulnerability ID: CVE-2024-49071 

- Impact: Potential disclosure of sensitive file data across networks. 

- Attack Complexity: Low, but required some access to Windows Defender. 

- Exploitations: None reported to date. 

## Why No Action Is Needed 

While a critical vulnerability might typically prompt immediate patch updates or user intervention, Microsoft took a different approach. 

The issue was resolved entirely on the server side, with no updates or actions required from end users. 

This is part of Microsoft’s new transparency initiative, announced in June 2024, which ensures that users are informed of critical vulnerabilities, even when no action is required. As Microsoft explained: 

_“We will issue CVEs for critical cloud service vulnerabilities, regardless of whether customers need to install a patch or take other actions to protect themselves.”_ 

For CVE-2024-49071, Microsoft confirmed: 

_“The vulnerability documented by this CVE requires no customer action to resolve. This vulnerability has already been fully mitigated by Microsoft.”_

## A Quiet Fix with Full Transparency 

Microsoft’s proactive and transparent handling of this Windows Defender issue highlights a shift in how cloud-related vulnerabilities are managed. 

By addressing the problem server-side and notifying users through their security update guide, Microsoft ensured both a seamless resolution and an informed user base. 

This approach is a win for security best practices, combining swift mitigation with open communication. 

For Windows users, it means peace of mind without the hassle of manual intervention—a perfect example of security done right. 

Microsoft recently disclosed a critical vulnerability in Windows Defender (CVE-2024-49071), which could have allowed attackers to access sensitive file data across a network. 


Microsoft Highlights a Critical Security Flaw in Windows Defender 

Fortinet recently disclosed a critical vulnerability in Fortinet Wireless Manager (FortiWLM) that enables remote attackers to execute unauthorized commands or code through specially crafted web requests. 

This vulnerability, tracked as CVE-2023-34990, has a severity rating of 9.8 and poses a significant risk to users in critical sectors such as government, healthcare, education, and large enterprises. 

## The Vulnerability: CVE-2023-34990 

CVE-2023-34990 is a relative path traversal flaw caused by improper input validation in the /ems/cgi-bin/ezrf_lighttpd.cgi endpoint. 

By exploiting this flaw, unauthenticated attackers can manipulate the imagename parameter when the op_type is set to upgradelogs. 

![2.webp](https://strapiassets.blr1.digitaloceanspaces.com/2_21069b45e9.webp)

This allows attackers to read sensitive log files on the system. 

These logs often contain administrator session IDs, which attackers can use to hijack admin sessions and gain privileged access. 

According to Horizon3 researcher Zach Hanley, this exploitation is made easier by FortiWLM’s verbose logging, which includes the session IDs of authenticated users. 

Hanley explained: 

_"Abusing the lack of input validation, an attacker can construct a request where the imagename parameter contains a path traversal, allowing the attacker to read any log file on the system. With these verbose logs, an attacker can retrieve session IDs to hijack authenticated sessions and abuse other endpoints."_

## Affected Versions and Timeline 

The vulnerability impacts FortiWLM versions 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4. Discovered by Zach Hanley in May 2023, the flaw remained unpatched for 10 months despite being reported to Fortinet. 

Hanley publicly disclosed the vulnerability, along with a proof-of-concept (POC), on March 14, 2024, in a technical writeup. 

Although Fortinet addressed the issue in FortiWLM versions 8.6.6 and 8.5.5, released at the end of September 2023, the absence of a CVE ID and a formal security bulletin meant that users were largely unaware of the risk. 

Fortinet finally issued a security bulletin on December 18, 2024, nine months after Hanley's public disclosure. 

## The Impact of the Flaw 

Given its deployment in critical environments, FortiWLM is a high-value target for attackers. Successful exploitation of this flaw could result in: 

![3.webp](https://strapiassets.blr1.digitaloceanspaces.com/3_e9673b2a49.webp)

- Hijacked admin sessions, granting attackers privileged access. 

- Network-wide disruptions. 

 - Exposure of sensitive data. 

The vulnerability effectively served as a zero-day for roughly four months, leaving users vulnerable until a fix was implemented and communicated. 

## Recommended Actions 

Fortinet strongly urges administrators of FortiWLM to update to secure versions (8.6.6 or 8.5.5) immediately. 

Applying updates promptly is critical to mitigating risks and ensuring the security of wireless networks. 

Admins are also encouraged to monitor Fortinet’s security bulletins regularly and implement best practices for securing network devices. 

With FortiWLM’s importance in managing wireless infrastructure, timely updates are essential to prevent potential exploits. 

Fortinet recently disclosed a critical vulnerability in Fortinet Wireless Manager (FortiWLM) that enables remote attackers to execute unauthorized commands or code through specially crafted web requests. 

Fortinet Addresses Critical FortiWLM Vulnerability

The digital age has brought unparalleled convenience, but it has also opened the floodgates for cyber threats. As hackers grow more sophisticated, so must the defenses against them. 

**Palo Alto Networks**, a leader in cybersecurity, is leveraging the power of artificial intelligence (AI) to predict and **thwart cyberattacks** before they happen. This blog delves into how Palo Alto is hacking the hackers with innovative AI technology and what it means for the future of cybersecurity. 

## The Evolving Cybersecurity Landscape 

Cyberattacks have shifted from simple malware to highly coordinated campaigns targeting governments, businesses, and individuals. Traditional security measures, like firewalls and antivirus software, are no longer sufficient to tackle these advanced threats. 

Here's why: 

- **Speed and Complexity of Attacks**: Modern cyberattacks can occur in milliseconds, leaving minimal time for response. 

- **Volume of Data**: Organizations produce massive amounts of data, making it difficult to detect anomalies manually. 

- **Human Limitations**: Security teams cannot keep up with the sheer scale and sophistication of modern threats. 

This is where artificial intelligence steps in as a game-changing force. 

## Palo Alto's AI-Powered Solutions 

Palo Alto Networks is at the forefront of using AI to combat cyber threats. Their AI-driven platform, Cortex XSIAM (Extended Security Intelligence and Automation Management), is designed to predict, detect, and respond to cyberattacks in real-time. 

![3.webp](https://strapiassets.blr1.digitaloceanspaces.com/3_bdde6633fe.webp)

Here’s how it works: 

**Threat Prediction:** 

- AI analyzes vast amounts of data from endpoints, networks, and cloud environments. 

- It identifies patterns that indicate potential attacks, even before they occur. 

**Automated Detection and Response**: 

- Cortex XSIAM automates threat detection, reducing the time it takes to respond from hours to seconds. 

- It uses machine learning to prioritize alerts, ensuring that security teams focus on the most critical threats. 

**Behavioral Analysis**: 

- AI monitors user and entity behavior to detect anomalies that may signal insider threats or compromised accounts. 

- This proactive approach helps uncover subtle threats that traditional tools might miss. 

**Continuous Learning:** 

- The AI system improves over time by learning from new threats and adapting its models. 

## Why AI Is the Future of Cybersecurity 

Palo Alto’s adoption of AI reflects a broader trend in the cybersecurity industry. 

![2.webp](https://strapiassets.blr1.digitaloceanspaces.com/2_4f71c30a31.webp)

AI not only makes threat detection faster and more accurate but also empowers organizations to stay ahead of attackers. Key benefits include: 

- **Scalability:** AI can handle vast amounts of data without requiring additional human resources. 

- **Precision**: Machine learning algorithms minimize false positives, ensuring security teams don’t waste time on unnecessary alerts. 

- **Proactivity**: Instead of reacting to attacks, AI enables a predictive approach to cybersecurity. 

## Looking Ahead 

As **cyber threats** continue to evolve, companies like Palo Alto Networks are proving that innovation is the key to staying ahead. 

By harnessing AI to predict and **neutralize attacks**, they are setting a new standard for cybersecurity. 

For businesses, the message is clear: investing in AI-driven security solutions is no longer optional—it’s essential. As Palo Alto leads the charge, the question isn’t whether AI will transform cybersecurity, but how quickly organizations can adapt to this new paradigm. 

With AI as a critical ally, hacking the hackers is no longer a distant goal—it’s happening now. 

Palo Alto Networks, a leader in cybersecurity, is leveraging the power of artificial intelligence (AI) to predict and thwart cyberattacks before they happen. 

Hacking the Hackers: How Palo Alto Is Using AI to Predict Cyberattacks 

A newly discovered cyberattack, known as the double-clickjacking hack, is raising alarms among cybersecurity experts. This sophisticated exploit targets web users across all major browsers, making it a universal threat.

The attack works by manipulating users into double-clicking on seemingly harmless prompts, such as CAPTCHAs or pop-ups, while secretly redirecting their actions to a hidden window.

Unlike older clickjacking methods, which were mitigated by browser security updates, this new approach bypasses protections by leveraging precise mouse-click timing. As a result, users are unknowingly tricked into completing malicious actions.

## What Is Double-Clickjacking?

Paulos Yibelo, a renowned application security and offensive exploit researcher, has unveiled a groundbreaking cyberattack methodology in his latest blog post. 

![jddn.webp](https://strapiassets.blr1.digitaloceanspaces.com/jddn_53aa9ddca9.webp)

Dubbed double-clickjacking, this attack bypasses traditional browser security measures and targets users of Chrome, Edge, Safari, and virtually any web browser.

**How It Works:** Hackers manipulate users into double-clicking on seemingly harmless prompts (e.g., CAPTCHA) while stealthily switching the action to a hidden window. This trick can validate unauthorized logins or account authorizations without the user realizing it.

**Evolution of Clickjacking**: Unlike traditional clickjacking—which became ineffective due to browser updates—double-clickjacking exploits the precise timing of mouse double-clicks to bypass these built-in protections.

## Why This Attack Is Dangerous

The new attack surface exposes nearly all web users to potential risks:

- **Universal Target**: It works across most websites and browsers, making it a global threat.

- **Stealthy Execution**: The action happens so quickly that users don’t notice their clicks have been redirected to malicious commands.

- **Credential Compromise**: The attack is capable of stealing login details, validating unauthorized actions, or compromising accounts.

## How to Protect Yourself

While developers and security experts work to address this vulnerability, users should take the following precautions:

- **Avoid Double-Clicks**: Be cautious when prompted to double-click, especially on unfamiliar websites or pop-ups.

- **Verify Website Authenticity:** Stick to trusted websites and avoid clicking on suspicious elements.

- **Keep Browsers Updated:** Ensure your browser is running the latest version, as security patches may mitigate this risk.

- **Use Security Tools**: Employ anti-malware and browser security extensions that can identify and block suspicious activities.

## The Bottom Line

The double-clickjacking hack highlights a new level of sophistication in cyberattacks. By exploiting user behavior and browser vulnerabilities, this threat underscores the importance of vigilance while browsing the web. 
Stay informed, cautious, and proactive to minimize your exposure to this latest cyber danger.

A new cyber threat called double-clickjacking is putting millions of web users at risk, regardless of their browser.

One-Click Threat: Chrome, Edge, and Safari Users Beware!

In today's rapidly advancing digital landscape, cybersecurity has become one of the most critical concerns for businesses across all industries. 

![irfjoiefjofjf.webp](https://strapiassets.blr1.digitaloceanspaces.com/irfjoiefjofjf_4660ccf40c.webp)

This highlights the five most common cyber disasters that companies need to guard against in 2024, particularly in the tech industry, where the stakes are higher due to the vast amount of sensitive data handled.

## 1. Data Breaches: The Silent Threat

Data breaches remain one of the most frequent and damaging cyber disasters in 2024. Hackers often target tech companies for their valuable customer information, proprietary data, and intellectual property. These breaches can occur through various means, including weak passwords, unpatched software vulnerabilities, or phishing attacks.

**Impact:**
- Exposed customer information (names, emails, financial data)
- Theft of intellectual property
- Loss of customer trust and brand reputation
- Legal liabilities due to non-compliance with data protection regulations like - GDPR

**Guard Against It**:
- Implement multi-factor authentication (MFA) to add an extra layer of security.

- Regularly patch systems and software to prevent known vulnerabilities from being exploited.

- Encrypt sensitive data both at rest and in transit to make it harder for hackers to access useful information.

## 2. Ransomware Attacks: Growing Menace
Ransomware attacks have seen a sharp increase in 2024, with cybercriminals locking critical company data and demanding a ransom for its release. Tech companies, due to their reliance on data and complex IT infrastructure, are prime targets.

**Impact:**
- Complete system shutdowns, halting business operations.
- Financial losses from ransoms and downtime.
- Long-term data recovery issues and brand damage if the attack is publicized.

**Guard Against It:**

- Maintain offline backups of critical data to avoid paying ransom.

- Educate employees about phishing attacks and social engineering tactics that often lead to ransomware infections.

- Employ robust endpoint detection and response (EDR) tools that can quickly identify and neutralize ransomware threats.

## 3. Insider Threats: The Unseen Risk
While most focus on external threats, insider attacks—whether malicious or unintentional—are becoming increasingly common in 2024. Employees, contractors, or even former employees who have access to sensitive systems and data pose a serious security risk.

**Impact:**
- Data leaks or theft of proprietary information.
- Unintended exposure of sensitive data due to negligence.
- Damage to company culture and trust among employees.

**Guard Against It:**
- Regularly audit access controls and ensure that employees only have access to the data they need.

- Monitor user behavior for any unusual activities, especially if someone’s access privileges change.

- Implement a strict offboarding process to revoke access promptly when an employee leaves the company.

## 4. Supply Chain Vulnerabilities

With the increasing reliance on third-party vendors and suppliers, supply chain attacks are on the rise. Cybercriminals exploit weaknesses in a company's suppliers or partners to infiltrate their networks, often going unnoticed for long periods.

**Impact:**

- Security vulnerabilities in software or hardware provided by third parties.
- Breach of sensitive data through compromised vendor systems.
- Widespread disruption if an attack targets multiple interconnected systems.

**Guard Against It:**
- Conduct thorough security assessments of all third-party vendors and partners.

- Use tools like Software Bill of Materials (SBOM) to identify and track software components and their vulnerabilities.

- Establish a "zero-trust" security model where no one, including trusted third parties, has full access to critical systems without verification.

## 5. DDoS (Distributed Denial-of-Service) Attacks
DDoS attacks overwhelm a company's servers with a flood of traffic, causing disruptions or even complete system outages. This type of attack is often used as a smokescreen for other, more targeted attacks, or as a means of extortion.

**Impact:**

- Service downtime and loss of availability for customers.
- Potential revenue loss from service interruptions.
- Damage to brand reputation if service disruptions are prolonged.

**Guard Against It:**

- Deploy DDoS protection services, such as cloud-based mitigation tools, to absorb malicious traffic.

- Use load balancing and redundant systems to distribute traffic evenly and reduce the impact of an attack.

- Monitor network traffic for unusual spikes and quickly respond to mitigate potential threats.

Data breaches, ransomware, insider threats, supply chain vulnerabilities, and DDoS attacks are some of the most common and damaging cyber disasters in 2024. 

To mitigate these risks, companies must prioritize cybersecurity at every level, from executive leadership down to day-to-day operations. By staying informed, adopting the latest security practices, and fostering a culture of cyber awareness, organizations can build resilience against the growing tide of cyber threats.

The rapid pace of digital transformation in the tech industry has made cybersecurity more critical than ever. 

The Big Five: Cyber Disasters You Must Guard Against

Threat actors are exploiting the FastHTTP Go library to execute high-speed brute-force password attacks on Microsoft 365 accounts worldwide. The campaign, discovered by incident response firm SpearTip, began on January 6, 2025, targeting the Azure Active Directory Graph API.

## Alarming Success Rates in Account Takeovers

According to researchers, these brute-force attacks have achieved a 10% success rate in compromising accounts, highlighting the sophistication and effectiveness of the campaign.

**Exploiting FastHTTP for Unauthorized Access**

FastHTTP, a high-performance HTTP server and client library for the Go programming language, is designed for handling HTTP requests with exceptional throughput, low latency, and efficiency. In this campaign, it is weaponized to:

- Automate unauthorized login attempts via brute-force attacks.
- Send repeated multi-factor authentication (MFA) challenges, overwhelming targets in MFA Fatigue attacks.

## Geographic Origin of Malicious Traffic

SpearTip’s analysis indicates that 65% of the malicious traffic originates from Brazil, using a wide range of ASN providers and IP addresses. Other notable sources include Turkey, Argentina, Uzbekistan, Pakistan, and Iraq.
Attack Outcomes

The outcomes of these attacks, as reported by researchers, are:

- 41.5%: Failed attempts.
- 21%: Account lockouts triggered by protection mechanisms.
- 17.7%: Rejected due to access policy violations (e.g., geographic or device compliance).
- 10%: Successfully blocked by MFA protections.
- 9.7%: Successful account takeovers—a concerningly high success rate.

**Impact of Account Takeovers**

Compromised Microsoft 365 accounts can result in severe repercussions, such as:

- Exposure of confidential data.
- Intellectual property theft.
- Service downtime.
- Broader security breaches.

## Detection and Defense Measures

To mitigate the impact of these attacks, SpearTip recommends the following steps:

1.	Audit Logs for FastHTTP User Agent: Use a PowerShell script or manually inspect audit logs for evidence of the FastHTTP user agent.
- Navigate to the Azure portal.
- Go to Microsoft Entra ID → Users → Sign-in Logs.
- Apply the filter: Client app: “Other Clients.”

2.	Respond to Malicious Activity:
- Expire active user sessions.
- Reset all account credentials.
- Review and remove unauthorized MFA devices.
By implementing these measures, administrators can safeguard Microsoft 365 accounts against this ongoing threat campaign.


Threat actors are exploiting the FastHTTP Go library to execute high-speed brute-force password attacks on Microsoft 365 accounts worldwide.

FastHTTP Tool Powers Blazing-Fast Microsoft 365 Password Hacks

Cybersecurity firm Arctic Wolf has detailed a cyber campaign exploiting Fortinet FortiGate firewall devices with exposed management interfaces on the public internet. 

The campaign leverages a suspected zero-day vulnerability to compromise these devices, posing significant risks to affected organizations.

## Details of the Exploitation

Fortinet confirmed the exploitation following Arctic Wolf’s observation of mass campaigns targeting publicly exposed FortiGate firewalls since November 2024. 

FortiGate Next-Generation Firewalls (NGFW) include a command-line interface accessible via their web-based management interface, intended for convenient administrative management. Threat actors have exploited this feature to:

- Gain unauthorized administrative access.
- Modify firewall configurations.
- Extract credentials.
- Move laterally within compromised environments.

The attacks predominantly target devices running firmware versions 7.0.14 to 7.0.16, released between February and October 2024.

To evade detection, attackers have used spoofed IP addresses, including loopback addresses (e.g., 127.0.0.1) and public DNS resolvers (e.g., 8.8.8.8).

**Multi-Phase Attack Campaign**

Arctic Wolf Labs observed the campaign’s progression in four distinct phases between November 16 and December 27, 2024:

1.	Phase 1 (November 16–23): Vulnerability scans targeting the jsconsole command-line interface, often using unusual or spoofed IPs.
2.	Phase 2 (November 22–27): Initial configuration changes to confirm successful administrative access.
3.	Phase 3 (December 4–7): Configuration of SSL VPN access through:
- Creation of new super admin accounts.
- Hijacking existing accounts.
- Exploiting default “guest” accounts.
4.	Phase 4 (December 16–27): Use of the DCSync technique to extract credentials by exploiting domain replication, granting deeper access to sensitive information.

## Immediate Remediation and Best Practices

![2.webp](https://strapiassets.blr1.digitaloceanspaces.com/2_82528d4d7b.webp)
 
Organizations using FortiGate firewalls are strongly advised to take the following measures:
1.	**Disable Public Management Interface Access:** Ensure firewall management interfaces are inaccessible from the public internet.
2.	**Update Firmware:** Regularly patch devices to the latest stable version to mitigate known vulnerabilities.
3.	**Monitor for Anomalous Activity:** Look for unusual login behaviors, such as short-lived admin logins or use of loopback IPs.
4.	**Enable Multifactor Authentication (MFA):** Strengthen login security for administrative access.
5.	**Conduct Threat Hunting**: Investigate for unauthorized configuration changes or SSL VPN account setups.

## Arctic Wolf’s Response

Arctic Wolf has integrated detections for this campaign into its Managed Detection and Response (MDR) platform, enhancing its ability to protect customers. On December 12, 2024, Arctic Wolf reported the observed activities to Fortinet. Fortinet’s internal PSIRT team confirmed awareness of the campaign on December 17, 2024, and is actively investigating the issue.


Cybersecurity firm Arctic Wolf has detailed a cyber campaign exploiting Fortinet FortiGate firewall devices with exposed management interfaces on the public internet. 

Fortinet Firewalls Hit by Zero-Day Exploit: What You Need to Know

NVIDIA has released a crucial software security update to address several vulnerabilities in its GPU display drivers, ensuring a safer experience for its users. 

Among the eight resolved issues, two were classified as high-risk, highlighting the importance of updating to the latest driver versions.

## High-Risk Vulnerabilities 
The first major vulnerability, identified as CVE-2024-0150, involved a buffer overflow issue in the GPU display driver. 

![idjc.webp](https://strapiassets.blr1.digitaloceanspaces.com/idjc_e97bc6c90f.webp)

This flaw posed a **significant risk**, allowing attackers to overwrite memory buffers. In a worst-case scenario, this could lead to large-scale system compromises, including the potential for personal data leaks or manipulation.

The second critical issue targeted the **virtual GPU (vGPU)** manager, where a security flaw caused memory corruption. This vulnerability could be exploited by malicious actors, enabling code execution or unauthorized alterations to sensitive data on the host system.

## Additional Vulnerabilities Resolved
In addition to these high-priority issues, NVIDIA also addressed six other vulnerabilities classified as medium severity. Although they posed less immediate risk, their resolution further strengthens system security for NVIDIA's broad user base.

**Who Is Affected?**
NVIDIA confirmed that these vulnerabilities could affect a wide range of its products, including:

- GeForce GPUs (consumer graphics cards)
- NVIDIA RTX (professional graphics solutions)
- Quadro (workstation GPUs)
- NVS product lines
- Tesla GPUs (data center and AI platforms)

Given the extensive reach of these product lines, it’s essential for users across various platforms to apply the update.

## How to Update Your Drivers
To benefit from the enhanced security, users should update their drivers to the following versions:

**Windows:**
Version 553.62 or 539.19

**Linux:**
Version 550.144.03 or 535.230.02 (depending on the driver branch)

These updates aim to mitigate the vulnerabilities effectively and ensure users are protected from potential exploits.

## Why Updating Matters

With the prevalence of cyber threats targeting hardware and software vulnerabilities, keeping drivers up-to-date is crucial. NVIDIA’s proactive approach to addressing these issues demonstrates its commitment to user safety and maintaining trust within its ecosystem.

If you own an NVIDIA GPU, now is the time to check for updates and secure your system. 

Don't wait—protect your data and enjoy a seamless experience with the latest drivers.

NVIDIA has released a crucial software security update to address several vulnerabilities in its GPU display drivers, ensuring a safer experience for its users. 

NVIDIA Fixes GPU Driver Flaws: Stay Safe from Data Leaks!

Palo Alto Networks (NASDAQ: PANW), a global leader in cybersecurity, has unveiled a groundbreaking Quantum Random Number Generator (QRNG) Open API framework. 

This innovative tool empowers organizations to prepare for quantum security threats by facilitating the integration of quantum randomness into cryptographic systems. 

Developed in collaboration with six leading QRNG technology partners, the framework addresses the need for **multi-vendor interoperability**, ensuring organizations can build resilient QRNG-based systems using diverse technologies.

## Why Quantum Security Matters

The rapid convergence of artificial intelligence (AI), machine learning (ML), deep learning, classical supercomputing, and quantum computing makes it crucial to secure today's systems against quantum-enabled cyber threats. 
![idjwe.webp](https://strapiassets.blr1.digitaloceanspaces.com/idjwe_fe6d3031d1.webp)

**QRNG** utilizes quantum mechanics to generate truly random numbers, which are essential for creating secure **cryptographic keys**. Experts recommend pairing QRNG with recently released NIST post-quantum cryptography **(PQC)** standards to safeguard organizations from future security risks.

## Interoperability and Collaboration

The QRNG Open API, available through Palo Alto Networks' GitHub portal, **simplifies** QRNG integration, eliminating **proprietary barriers** and enabling multi-vendor networks to seamlessly adopt quantum randomness. 

By ensuring **interoperability**, it allows organizations to choose the best QRNG technologies and systems—**whether cloud-based or on-premise**—based on their unique needs.

**Rich Campagna**, Senior Vice President of Product Management at Palo Alto Networks, emphasized the importance of a collaborative approach in making the world "**quantum-safe**" and ensuring that future security standards benefit all organizations.

## Advancing Quantum-Enabled Security

The QRNG Open API marks an important step toward future-proofing cybersecurity systems against quantum computing threats. 
![API-Security-Best-Practices-for-Web-Apps-Rest-APIs-and-API-Gateways-Simform.webp](https://strapiassets.blr1.digitaloceanspaces.com/API_Security_Best_Practices_for_Web_Apps_Rest_AP_Is_and_API_Gateways_Simform_a41310ce1e.webp)

Later in the year, **Palo Alto Networks**' Next Generation Firewalls **(NGFWs)** will also support the QRNG Open API, allowing the network security platform to integrate high-quality entropy for cryptographic functions.

## Contributions from Industry Partners

The initiative has garnered support from major players in quantum technology, including **Anametric, ID Quantique, Qrypt, Quantinuum, Quantropi, and Quside**. These partners are working together to:

- Simplify QRNG integration by eliminating proprietary silos.
- Maximize interoperability across multi-vendor networks, offering freedom of choice in technology selection.
- Accelerate QRNG adoption with an open, collaborative approach.
- Provide organizations with access to high-quality entropy from external QRNG platforms.

By launching the QRNG Open API and collaborating with industry experts, Palo Alto Networks is ensuring that organizations can confidently defend against emerging threats in a quantum-enabled world.

For more information about the QRNG Open API, visit the Palo Alto Networks GitHub portal.

Palo Alto Network's groundbreaking Quantum Random Number Generator (QRNG) Open API framework empowers organizations to prepare for quantum security threats. Here is all you need to know. 

Quantum Security Ready: Palo Alto Networks brings QRNG Open API for Organizations

Enterprise firmware and hardware security company Eclypsium has uncovered vulnerabilities in several Palo Alto Networks firewalls, shedding light on potential risks tied to BIOS and bootloader issues. 

![huh.webp](https://strapiassets.blr1.digitaloceanspaces.com/huh_3287432fc3.webp)

While Palo Alto Networks has acknowledged some of the concerns, the company has assured users that the vulnerabilities are challenging to exploit or not applicable to its products in practice.

## Vulnerability & Palo Alto Networks’ Response

Eclypsium analyzed three Palo Alto Networks appliances:

- PA-3260: No longer sold, with an end-of-life scheduled for 2028.

- PA-1410

- PA-415

The analysis revealed that all three devices are impacted by BootHole, a vulnerability in the GRUB2 bootloader. This flaw, which affects billions of devices, allows attackers to bypass the Secure Boot mechanism and install persistent malware. 

However, exploiting BootHole requires elevated privileges. Palo Alto Networks reiterated that attackers would need to compromise the PAN-OS system and gain root Linux privileges to exploit this vulnerability.

Eclypsium noted that a threat actor might achieve the necessary permissions by combining two recently disclosed PAN-OS vulnerabilities, CVE-2024-0012 and CVE-2024-9474, both of which have been exploited in the wild to compromise firewalls.

## Additional Identified Vulnerabilities

**System Management Mode (SMM) Flaws**

The PA-3260 firewall was found to be impacted by a series of SMM vulnerabilities identified in 2022 within InsydeH2O UEFI firmware. These flaws could allow attackers to:

- Escalate privileges

- Bypass Secure Boot

- Install stealthy malware

- Modify device configurations

Palo Alto Networks confirmed these findings and stated that it is collaborating with third-party vendors to develop necessary firmware updates for the **PA-3200, PA-5200, and PA-7200** series firewalls equipped with a Switch Management Card (SMC-B). Other firewalls, the company emphasized, remain unaffected.

**LogoFAIL and PixieFail Vulnerabilities**

Eclypsium discovered that the PA-3260 appliance is also susceptible to LogoFAIL, a set of vulnerabilities that allow attackers to compromise devices through malicious UEFI logo images. 
![1.webp](https://strapiassets.blr1.digitaloceanspaces.com/1_ebaf8f7a52.webp)
Palo Alto Networks denied this impact, explaining that the conditions required to exploit LogoFAIL do not exist in PAN-OS.

Similarly, the PA-1410 and PA-415 appliances were flagged for PixieFail vulnerabilities, which could enable remote code execution. 

Palo Alto Networks countered these claims, stating that PixieFail’s conditions are irrelevant to its products since the BIOS network stack is disabled.

## Reassurance and Proactive Measures

Palo Alto Networks emphasized that its firewalls, when updated and managed according to best practices, are not exploitable under normal conditions. The company stated:

- **Restricted Permissions:** Users and administrators lack access to BIOS firmware or permissions to modify it.

- **Challenging Exploitation**: Attackers would need to first compromise the system and gain root Linux privileges before attempting to exploit these vulnerabilities.

In response to misconfigured SPI flash access controls identified in the PA-415, Palo Alto clarified that exploitation requires physical access to the system and hardware tampering. 

To mitigate risks, the company recommends restricting physical access to firewalls as a best practice.

Palo Alto Networks is actively working on patches and collaborating with third-party vendors to address identified flaws. 

The company’s proactive measures and transparent communication underscore its commitment to maintaining robust cybersecurity standards while mitigating potential risks to its products.

Eclypsium warns that Palo Alto Networks firewalls are impacted by BIOS and bootloader flaws, but the vendor says users should not be concerned.

BIOS and Bootloader Bugs? Palo Alto Networks Puts Its Firewalls on Fix-It Mode!

New strains of ransomware are targeting VMware ESXi hosts, leveraging SSH tunnels to disguise malicious activity as legitimate network traffic. 

These stealthy tactics allow attackers to infiltrate critical virtual machine environments while evading conventional detection methods.

## Why ESXi Hosts Are at Risk

Cybercriminals are exploiting the often-overlooked nature of ESXi appliances, which are rarely monitored closely. By hiding in plain sight, attackers can exfiltrate data, deploy ransomware, and lock down virtual machines with minimal detection. 

![44.webp](https://strapiassets.blr1.digitaloceanspaces.com/44_4ba561ff79.webp)

ESXi hosts enable attackers to encrypt all virtual disks simultaneously, creating a single-point attack that can paralyze entire infrastructures. 

By creating _SSH-based SOCKS tunnels, attackers move laterally, blending malicious traffic with routine administrative activity_. Since ESXi appliances are rarely rebooted and often insufficiently logged, they provide an ideal environment for persistent backdoors.

## Anatomy of the Attack
1. **Gaining Initial Access**
Attackers exploit unpatched vulnerabilities, such as CVE-2021-21974, or use stolen administrative credentials to bypass authentication and gain control of ESXi hosts.

2. **Establishing SSH Tunnels**
Once inside, attackers leverage ESXi’s native SSH functionality to create SOCKS tunnels, routing malicious traffic through the host while evading detection. 
For example, a command like ssh –fN -R 127.0.0.1:<SOCKS port> <user>@<C2 IP address> establishes a remote port-forwarding link between the compromised host and the attacker’s Command and Control (C2) server.

3. **Maintaining Persistence**
Since ESXi servers are rarely rebooted, attackers maintain semi-persistent backdoors using the SSH tunnel, enabling continuous undetected operations.

4. **Reconnaissance and Lateral Movement**
Using the established tunnel, attackers scan the network, identify sensitive targets, and gather intelligence.

5. **Ransomware Deployment**
Once reconnaissance is complete, attackers deploy ransomware to encrypt critical virtual machine files, such as .vmdk (virtual disks) and .vmem (paging files). This effectively locks down entire environments. Ransom demands are often accompanied by threats of data exfiltration or public disclosure.

## Challenges in Detection and Mitigation

The decentralized logging structure of ESXi servers complicates forensic analysis. Logs are spread across multiple files, such as /var/log/shell.log (shell activity) and /var/log/auth.log (authentication events), requiring investigators to piece together evidence. 

Additionally, SSH tunneling masks malicious activity as normal administrative traffic, making it difficult to identify unauthorized operations.

Many organizations fail to actively monitor ESXi hosts, allowing these attacks to persist unnoticed for long periods.

## Strengthening ESXi Security
To counter these sophisticated ransomware tactics, researchers recommend the following measures:

- Restrict Administrative Privileges: Limit access to ESXi appliances to essential personnel only.
- Disable SSH by Default: Enable SSH access only when absolutely necessary and monitor its use closely.
- Apply Regular Patches: Address vulnerabilities that allow remote code execution or credential theft, particularly high-severity flaws.
- Enforce Strong Authentication: Implement robust authentication mechanisms, including multi-factor authentication, to prevent brute-force attacks.

This new wave of ransomware highlights how attackers are evolving to exploit overlooked areas of virtual infrastructure. 

New strains of ransomware are targeting VMware ESXi hosts, leveraging SSH tunnels to disguise malicious activity as legitimate network traffic. 

New Ransomware Strikes VMware ESXi Hosts Through Sneaky SSH Tunnels

SonicWall has issued a warning about a severe vulnerability that may have already been exploited as a zero-day attack.

The flaw, identified as CVE-2025-23006, impacts the Secure Mobile Access (SMA) 1000 series. In an advisory released on Thursday, SonicWall revealed that under specific conditions, a remote, unauthenticated attacker could execute arbitrary OS commands. 

![5555.webp](https://strapiassets.blr1.digitaloceanspaces.com/5555_2a78c4ebbd.webp)

Given the vulnerability's 9.8 critical severity rating, it is reasonable to assume that these conditions are not particularly difficult to meet. SonicWall’s statement leaves room for interpretation, but the high-risk nature of the flaw is clear.

## Vulnerability Details

**CVE-2025-23006** specifically affects the **Appliance Management Console (AMC)** and **Central Management Console (CMC)** of the **SMA 1000 series**. These consoles are used for administrative purposes, such as configuring hardware, monitoring performance, and managing admin accounts.

Although SonicWall has not elaborated on the precise nature of the flaw, the severity score provides some insight:

- **Low Attack Complexity**: Exploiting the vulnerability does not require advanced techniques.
- **No Privileges Required:** Attackers do not need any prior access to the system.
- **High Risk to Confidentiality, Integrity, and Availability:** The potential impact on all three is significant.

## Fixes and Mitigations
SonicWall has addressed the vulnerability with the release of hotfix version **12.4.3-02854 (platform-hotfix)**, which resolves the issue. All earlier versions of the software are considered vulnerable.

For customers unable to apply the patch immediately, SonicWall has recommended a workaround. The advisory states:
"**Restrict access to the AMC and CMC to trusted sources only**."

This recommendation aligns with the Best Practices for Securing the Appliance, as outlined in the SMA 1000's admin documentation.

## Scope and Usage

The SMA 1000 series is widely used by managed security service providers (MSSPs), enterprises, and government organizations **to secure remote access to corporate datacenters**, whether on-premises, in the cloud, or in hybrid environments.

The exact number of affected devices globally remains unclear. SonicWall has been asked for clarification on this but has not yet provided a response.

## Unaffected Systems
The advisory emphasized that other SonicWall products, including the SonicWall Firewall and the SMA 100 series designed for small and medium-sized businesses, are not impacted by **CVE-2025-23006**.

SonicWall credited the Microsoft Threat Intelligence Center for identifying the vulnerability, highlighting the importance of collaboration in addressing emerging threats.

This incident underscores the critical need for organizations to maintain robust security practices, such as regular patching and limiting access to administrative interfaces, to protect against evolving vulnerabilities.

SonicWall has issued a warning about a severe vulnerability that may have already been exploited as a zero-day attack.

SonicWall flags critical bug likely exploited as zero-day, rolls out hotfix

Cyber attackers are actively targeting Palo Alto Networks PAN-OS firewalls by exploiting a recently patched authentication bypass vulnerability, tracked as CVE-2025-0108. 

This high-severity flaw impacts the PAN-OS management web interface, allowing unauthenticated attackers with network access to bypass authentication and execute specific PHP scripts. The exploitation could lead to compromised system integrity and confidentiality.

## Urgent Security Advisory
![hfifea.webp](https://strapiassets.blr1.digitaloceanspaces.com/hfifea_137d4027b6.webp)
In a security bulletin released on February 12, 2025, Palo Alto Networks strongly advised administrators to upgrade their firewalls to the following patched versions:

- 11.2.4-h4 or later

- 11.1.6-h1 or later

- 10.2.13-h3 or later

- 10.1.14-h9 or later

Additionally, PAN-OS 11.0, which is also vulnerable, has reached end-of-life (EoL) and will not receive a security patch. Users running this version are urged to upgrade to a supported release to mitigate potential risks.

##  Vulnerability Exploitation and Attack Methods

The vulnerability was first discovered and reported by security researchers at Assetnote, who later published a detailed analysis upon the patch's release. Their research demonstrates how attackers can exploit the flaw to:

- Extract sensitive system data

- Retrieve firewall configurations

- Manipulate certain settings within PAN-OS

The attack leverages a path confusion issue between Nginx and Apache within PAN-OS, which allows authentication bypass. Threat actors with network access to the management interface can exploit this weakness to gather intelligence for further attacks or weaken security defenses by modifying system settings.

## Active Exploitation in the Wild

Security monitoring service GreyNoise has detected ongoing attacks attempting to exploit unpatched PAN-OS firewalls. Exploitation attempts were first observed on February 13, 2025, at 17:00 UTC, originating from multiple IP addresses, indicating that different threat actors may be involved in these efforts.

Research from Macnica security expert Yutaka Sejiyama reveals that over 4,400 PAN-OS devices are currently exposing their management interface online, making them prime targets for cybercriminals.

## Mitigation Measures and Recommendations
![3213dsjd.webp](https://strapiassets.blr1.digitaloceanspaces.com/3213dsjd_974882d8ac.webp)
Given the public availability of proof-of-concept (PoC) exploits, the likelihood of continued and escalating attacks remains high. To protect against these threats, organizations are urged to take the following actions:

- Apply the latest security patches immediately.

- Restrict access to firewall management interfaces to minimize exposure.

- Follow best practices for securing external-facing management interfaces to reduce the risk of unauthorized access.

## Palo Alto Networks' Official Response

On February 18, 2025, Palo Alto Networks issued a statement confirming active exploitation of CVE-2025-0108 and warning that attackers are chaining it with other vulnerabilities, such as CVE-2024-9474, to gain unauthorized access to unpatched firewalls.

**_"The security of our customers is our top priority. We have confirmed reports of active exploitation targeting CVE-2025-0108. Organizations with internet-facing PAN-OS management interfaces must apply the security updates released on February 12, 2025, as soon as possible. Securing external-facing management interfaces is a fundamental security best practice, and we strongly encourage all organizations to review their configurations to minimize risk."_**

For detailed information and mitigation guidance, users should refer to the official security advisory: CVE-2025-0108 Security Advisory.

As cyber threats continue to evolve, maintaining up-to-date security patches and following best practices for system protection remain crucial in defending against such exploits.

Hackers are actively exploiting a newly patched authentication bypass vulnerability in Palo Alto Networks PAN-OS firewalls, posing a significant security risk to unpatched systems.

Hackers Exploit Authentication Bypass in Palo Alto Networks PAN-OS

A staggering 2.7 billion records containing highly sensitive user data have been exposed in a significant IoT security breach. The leaked information includes Wi-Fi network names, passwords, IP addresses, and device identifiers, raising serious cybersecurity concerns. 

The breach has been linked to Mars Hydro, a China-based manufacturer of grow lights, and LG-LED SOLUTIONS LIMITED, a California-registered company.

## Unprotected Database Discovered
![2131.webp](https://strapiassets.blr1.digitaloceanspaces.com/2131_e3d5068842.webp)
The exposed database, amounting to 1.17 terabytes, was discovered by cybersecurity researcher Jeremiah Fowler and reported to vpnMentor. The database was left publicly accessible without password protection or encryption, making it vulnerable to exploitation.

The leaked records contained crucial data from IoT devices sold worldwide, including:

- Wi-Fi SSIDs (network names) and plaintext passwords

- IP addresses, device IDs, MAC addresses, and OS details (iOS/Android)

- API tokens, application versions, and error logs

This unprotected data poses substantial security risks, as cybercriminals could exploit it for network infiltration, data theft, or device manipulation.

## Links to Mars Hydro and LG-LED SOLUTIONS

The data was traced back to Mars Hydro’s Mars Pro app, used for controlling IoT-enabled grow lights and climate control systems. This raises concerns as the company's privacy policy explicitly states that it does not collect user data. However, the exposed database contradicts this claim.

Further investigation also connected the database to LG-LED SOLUTIONS LIMITED, a company registered in California. The records included API details and URLs linked to Mars Hydro, LG-LED SOLUTIONS, and Spider Farmer—all companies specializing in agricultural grow lights, fans, and cooling systems.

Many of the logs were labeled "Mars-pro-iot-error" or "SF-iot-error," containing device-related information such as tokens, app versions, device types, IP addresses, and SSID credentials.

## Immediate Response to the Breach

Upon discovering the security lapse, Fowler promptly notified both LG-LED SOLUTIONS and Mars Hydro. Within hours, access to the exposed database was restricted.

Mars Hydro confirmed that the Mars Pro app—available on both iOS and Android in multiple languages—is indeed their official product. However, it remains uncertain whether LG-LED SOLUTIONS directly managed the database or if it was handled by a third-party contractor. The duration of the exposure and whether unauthorized parties accessed the database also remain unknown.

## Potential Security Risks
![2131.webp](https://strapiassets.blr1.digitaloceanspaces.com/2131_e3d5068842.webp)
The exposure of such a vast dataset poses severe cybersecurity threats, including:

**Network Breaches**: Attackers could exploit exposed Wi-Fi credentials to infiltrate home or business networks, launching man-in-the-middle attacks, data interception, or ransomware infections.

**IoT Botnet Attacks**: Compromised devices could be hijacked for large-scale Distributed Denial-of-Service (DDoS) attacks, similar to previous incidents linked to the Matrix hacker group.

**Physical System Manipulation**: Cybercriminals could tamper with connected grow lights, fans, or cooling systems, potentially leading to crop destruction.

A particularly alarming tactic, known as the "nearest neighbor attack", was previously used by Russian GRU hackers in 2024 to exploit unsecured Wi-Fi networks in targeted cyber operations. The Palo Alto Networks threat report further emphasizes these risks, noting that:

- 98% of IoT data remains unencrypted

- 57% of IoT devices have severe security vulnerabilities

- Systemic IoT Security Flaws

This breach highlights widespread vulnerabilities in IoT security, exposing systemic flaws such as:

**Weak Encryption Practices**: Many IoT devices still rely on outdated encryption protocols like WPA2, which are prone to brute-force attacks.

**Default Password Misuse**: Users often fail to change factory-set passwords, making devices easily accessible to attackers.

**Cloud Storage Risks**: Storing massive volumes of sensitive data on unsecured servers creates single points of failure that can be easily exploited.

Experts speculate that this incident may be linked to a 2019 data breach involving Orvibo, a Chinese smart-device brand that also exposed vast amounts of IoT data.

## Security Recommendations for IoT Users and Manufacturers

To mitigate future risks, cybersecurity experts recommend the following best practices:

- Encrypt all sensitive data logs and avoid storing plaintext credentials.

- Implement network segmentation to isolate IoT devices from critical business systems.

- Regularly conduct security audits and penetration testing to identify vulnerabilities.

Despite restricting access to the exposed database, Mars Hydro and LG-LED SOLUTIONS have yet to clarify the exact cause of the breach or whether third-party contractors were involved in managing the database.

Cybersecurity researcher Jeremiah Fowler emphasized that his findings aim to raise awareness about IoT security flaws, with no direct evidence of malicious exploitation—yet.

A massive IoT security breach has exposed 2.7 billion records, including sensitive user data such as Wi-Fi passwords, IP addresses, and device identifiers and cloud storage practices.

Massive IoT Data Breach Exposes 2.7 Billion Records, Including Wi-Fi Passwords

## Vulnerabilities
![IToD_Email-Animation-2.gif](https://strapiassets.blr1.digitaloceanspaces.com/I_To_D_Email_Animation_2_2511920da8.gif)
U.S. technology giant Broadcom is warning organizations to swiftly patch a set of critical VMware vulnerabilities that are actively being exploited by malicious hackers. 

**These vulnerabilities—tracked as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226—impact widely used VMware products**, including ESXi, Workstation, and Fusion. 

Collectively **dubbed “ESXicape” by a security researcher**, these flaws allow attackers to escape the virtual machine sandbox and gain unauthorized control over the underlying hypervisor.

This type of attack is particularly dangerous because hypervisors manage multiple virtual machines on a single server. 

If compromised, an attacker could move laterally across the environment,**accessing other virtual machines**, including those belonging to different companies in shared data center infrastructures.

Broadcom, **which acquired VMware in 2023**, confirmed that these vulnerabilities are already being weaponized by threat actors. 

While the company did not disclose specifics regarding the nature of the attacks or the identity of those responsible, it **emphasized the severity of the threat. Microsoft, which discovered and reported the vulnerabilities**, has not provided additional details.

Security researcher Kevin Beaumont noted on Mastodon that an unnamed ransomware group is currently exploiting these flaws. **VMware hypervisor vulnerabilities have long been a prime target** for ransomware operators due to their potential to compromise multiple servers in a single attack.

In 2024, Microsoft identified ransomware groups leveraging a **VMware hypervisor flaw to deploy Black Basta and LockBit ransomware**, while the previous year saw the ESXiArgs campaign exploit a two-year-old VMware vulnerability to target thousands of organizations globally.

In response to the growing threat, Broadcom has issued emergency security patches and is urging all **VMware customers to apply them immediately**. These vulnerabilities are classified as “zero-day” threats, meaning they were exploited before a fix was available.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also sounded the alarm, **adding these flaws to its list of actively exploited vulnerabilities and directing federal agencies to patch their systems without delay**.

With attackers actively leveraging these flaws, **organizations using VMware products should act swiftly to secure their systems before more widespread attacks unfold**.

Broadcom is urging VMware customers to immediately patch critical zero-day vulnerabilities that hackers are actively exploiting to gain unauthorized access to virtualized environments.

Broadcom Urges Immediate Patching of Critical VMware Zero-Day Vulnerabilities

Dell Technologies has stepped up its game with a powerful suite of data protection tools designed to shield businesses from breaches, ransomware, and data loss. 

Here’s how Dell’s solutions can be your frontline defense—and what makes them stand out in today’s crowded cybersecurity market.

## 1. Proactive Defense with Intelligent Threat Detection
![efewf.webp](https://strapiassets.blr1.digitaloceanspaces.com/efewf_bd691a586c.webp)
Dell’s new data protection tools are built on AI-driven analytics that constantly monitor for unusual behavior across your infrastructure.

Rather than relying solely on perimeter-based defense, Dell employs advanced anomaly detection to flag threats before they cause damage.

This real-time monitoring helps IT teams detect suspicious activities, such as unauthorized access or rapid data encryption—common signs of ransomware.

**Key benefit:** Early detection and response significantly reduce breach impact time and data exposure.

## 2. Air-Gapped Backup & Recovery to Minimize Downtime
Even with top-tier defense, no system is invincible. 

Dell's integrated backup and disaster recovery solution, PowerProtect, ensures that your data is always recoverable—even in the event of a full-scale breach or encryption attack. 

The system utilizes immutable, air-gapped backups—copies of your data that cannot be altered or deleted by attackers.

**Key benefit:** Fast, secure recovery minimizes downtime and gets your business back on track without paying ransoms.

## 3. Security Management for Scalable Protection
![NIST-framework-v2.webp](https://strapiassets.blr1.digitaloceanspaces.com/NIST_framework_v2_25da25f9bd.webp)
One of Dell’s biggest advantages is its seamless, centralized management console. 

IT administrators can monitor, configure, and manage data protection policies across physical, virtual, and cloud environments—all from a single dashboard. 

This simplifies compliance, audit preparation, and real-time response.

**Key benefit:** Saves time, ensures consistency, and enables scalable security across hybrid and multi-cloud environments.

## Final Thought
Dell’s approach to data protection combines intelligence, automation, and resilience. 

Whether you're a small business or a global enterprise, these tools offer a critical layer of defense in a threat landscape where every second—and every byte—counts. 

If you're dealing with (or worried about) a breach, Dell’s solutions could be the difference between a quick recovery and a costly catastrophe.

Downtime, Data Loss, and Damage—Origen’s Solutions Shield You from It All.

Dell’s latest data protection tools offer a powerful shield against breaches, helping businesses stay secure, resilient, and recovery-ready.

Why Dell’s New Data Protection Tools Could Save You from a Breach

Cyber threats are becoming more advanced, more persistent, and harder to detect, businesses can’t afford to sleep on security—literally. 

That’s why Managed Detection and Response (MDR) has emerged as a game-changer for organizations needing around-the-clock protection. 
![1.webp](https://strapiassets.blr1.digitaloceanspaces.com/1_4cfba5ab7a.webp)
It’s more than just another cybersecurity buzzword. MDR represents a shift from reactive defense to proactive **threat hunting, giving companies access to real-time detection, expert analysis, and rapid response without building their own Security Operations Center (SOC) from scratch.**

Let’s explore what makes MDR the future of 24/7 threat monitoring—and why it’s one of the smartest security moves your organization can make.

## Traditional Security Tools Aren’t Enough Anymore

Firewalls, antivirus software, and even SIEM (Security Information and Event Management) platforms are all essential—but they’re not foolproof. 

Many of these tools generate alerts without context, lack real-time response, and require in-house expertise to interpret and act upon the data.

**The result? Alert fatigue, missed threats, and delayed remediation.**

This is where MDR fills the gap. It doesn’t just notify you about a problem—it investigates, confirms, and acts on it. 

Think of it as having an elite cybersecurity team on standby 24/7, equipped with the tools, threat intel, and expertise to stop attacks before they cause damage.

## What Makes MDR Different: Human Expertise + Advanced Tech
![managed-detection-response-mdr 1.webp](https://strapiassets.blr1.digitaloceanspaces.com/managed_detection_response_mdr_1_b75a606d9d.webp)
At its core, MDR combines cutting-edge threat detection tools with skilled cybersecurity analysts who monitor, investigate, and respond to threats on your behalf. 

Unlike traditional monitoring solutions, MDR is outcome-driven—its goal is to reduce dwell time, contain breaches fast, and guide your team with actionable insights.

Here’s what you typically get with an MDR service:

- 24/7 Threat Monitoring – Always-on visibility across endpoints, networks, and cloud environments.

- Threat Hunting – Proactively searching for hidden or dormant threats that evade standard defenses.

- Incident Response – Real-time action plans to contain and eliminate threats before they spread.

- Expert Guidance – Detailed reports, context, and advice on how to improve your overall security posture.

- Scalable Coverage – Whether you're a startup or an enterprise, MDR scales with your needs.

This hybrid approach of AI-driven detection paired with human-led analysis is what makes MDR stand out in a landscape crowded with automation tools that lack strategic thinking.

## Real-World Impact and Why It Matters

Let’s put this into perspective. 

Imagine a ransomware attack that begins with a compromised employee credential. A traditional system might log the activity, but unless someone sees and understands the anomaly quickly, the attack can escalate. 

With MDR, suspicious behavior triggers immediate investigation by a live analyst who can **isolate the device, block the IP, and alert your team**—often before encryption even begins.

**MDR also helps organizations meet compliance requirements (like ISO 27001, HIPAA, GDPR)**, and lowers the burden on internal teams. Instead of reacting to thousands of daily alerts, IT teams get focused, high-priority incidents that matter.

**And the best part?** MDR evolves. As threat actors grow more sophisticated, MDR providers continuously update their threat models, detection methods, and response protocols—keeping you ahead of the curve.

## Security That Never Sleeps

Cyber threats don’t keep office hours. **With MDR, your defenses don’t have to either. It’s not just about having tools—it’s about having the right people, processes, and intelligence to act when it matters most.**

For technical professionals, adopting MDR means shifting from a passive security mindset to an agile, informed, and responsive one. 

Whether you’re building your cybersecurity stack or looking to offload the operational burden of incident response, MDR is your always-on partner in the fight against cybercrime.

Need round-the-clock protection? Origen’s human-led MDR detects and defends—24/7.

In a world where cyber threats never sleep, Managed Detection and Response (MDR) offers businesses a smarter, faster, and always-on way to stay secure.

Managed Detection and Response (MDR): The Future of 24/7 Threat Monitoring

Reacting to threats is no longer enough. By the time you identify a breach, the damage may already be done. 

That’s why leading organizations are turning to predictive defense—**a powerful fusion of AI and big data that doesn’t just respond to attacks, but anticipates them**. 

Let’s explore how this transformation is happening—and what it means for technical professionals building the next generation of digital defenses.

## From Reactive to Predictive
![Picture2.webp](https://strapiassets.blr1.digitaloceanspaces.com/Picture2_573703a319.webp)
Traditional cybersecurity relies heavily on known threat signatures and manual interventions. 

While these methods still hold value, they often fall short against sophisticated, **zero-day exploits, advanced persistent threats (APTs), and insider attacks that don’t fit the usual patterns**.

Predictive defense flips the script. It uses machine learning models trained on vast datasets—**logs, user behavior, traffic patterns, threat intel feeds—to spot anomalies and patterns before an attack unfolds**.

Instead of playing catch-up, security teams can now act based on probability, behavior modeling, and early indicators.

**This isn’t science fiction—it’s already in action**. 

Financial institutions, healthcare providers, and cloud-native businesses are leveraging **AI to detect lateral movement, flag unusual access attempts**, and prevent credential abuse—all in real time.

## Big Data: AI Defense Engine

**AI needs data—and lots of it—to make smart predictions**. 

That’s where big data steps in. Enterprises today **generate petabytes of data from endpoints, applications, users, and devices**. 

Tapping into this digital exhaust gives predictive AI the context it needs to learn what’s normal—and what’s not.

Here’s how big data and AI work hand in hand:

- Behavioral Analysis: Tracking how users and devices behave over time helps flag subtle deviations that may signal a breach.

- Threat Intelligence Integration: Real-time threat feeds enrich AI models with knowledge about global attack vectors and indicators of compromise (IOCs).

- Correlated Insights: AI can correlate diverse signals—like a login from an unusual location and a file download spike—to uncover threats that would be invisible in isolation.

These capabilities make predictive defense incredibly efficient at narrowing down false positives and surfacing high-confidence alerts that your security team can act on fast.

## Real-World Impact

So what does this look like in practice?

Imagine a user account suddenly accessing sensitive files at 3 a.m. from a device it’s never used before. 

A rule-based system might miss it. But a predictive model trained on behavior baselines instantly sees this as suspicious, triggers an alert, and even automatically restricts access while notifying the SOC team.

Or take a network-level view—**predictive AI can monitor traffic spikes and forecast DDoS attacks before they take down your services.**

It’s not just about knowing something is wrong—it’s about knowing what will go wrong and when.

**The end result?** Faster containment, minimal damage, and a shift from firefighting to foresight.

**Final Word: AI-Powered Cybersecurity Is the Future—Start Building It Now**

**For technical professionals, predictive defense is more than a buzzword—it’s an opportunity to design systems that learn, adapt, and defend autonomously. As threats evolve, your defenses must too.**

**AI and big data aren’t replacing human expertise**—they’re amplifying it, helping security teams see around corners and act decisively. 

If you’re building modern security stacks, predictive defense should be at the core of your strategy.

Want smarter defenses? Origen spots threats before they strike—powered by AI.

Discover how AI and big data are powering predictive cybersecurity to stop attacks before they happen.

heroBanner.title

heroBanner.sub_title heroBanner.sub_title_one

featured_partners

protectionOverview.title

keyServices.titlekeyServices.subtitle

keyServices.items.customSolutions.title

keyServices.items.vulnerability.title

keyServices.items.incidentResponse.title

keyServices.items.training.title

secureDigitalWorld.title

secureDigitalWorld.mission.title

secureDigitalWorld.objectives.title

secureDigitalWorld.clientApproach.title

oneClickProtection.title

digitalAssetProtection.title digitalAssetProtection.subtitle

digitalAssetProtection.services.assessment.title

digitalAssetProtection.services.intrusionDetection.title

digitalAssetProtection.services.incidentResponse.title

how_to_choose_section.header

how_to_choose_section.question

related_case_studies_section.header

trust_companies

cyber_security_blogs

Canada

USA

Qatar

navigation.comm_connect

navigation.ai_services

navigation.infra

navigation.security