Search/volkswagen
● Vendor

volkswagen

Known CVEs
0
Highest CVSS
—
In KEV
0
Vendor
id.3 firmware
Connections
9 relationships
153GB of stolen credentials surface after LiteLLM supply chain attack
153GB of stolen credentials surface after LiteLLM supply chain attack A massive 153GB archive stolen during the LiteLLM supply chain attack exposes credentials and other sensitive data linked to thousands of corporate domains, including AWS, Samsung, Cisco, and Salesforce. Hudson Rock says it obtained and analyzed the archive, which contains 433,909 files, and attributed 118,829 CI runner dumps to 2,488 corporate domains. “We are leveraging this data for a global ethical disclosure effort,” Alon Gal, Hudson Rock’s co-founder and CTO, told Help Net Security. “We see this as an opportunity to help organizations respond proactively before threat actors weaponize the data publicly.” LiteLLM is an open-source proxy gateway that developers use to route requests to different AI models. The LiteLLM breach had its roots in an earlier compromise of Trivy, a popular open-source vulnerability scanner. On March 19, 2026, TeamPCP, a cybercriminal group that emerged in late 2025, used stolen credentials to publish a compromised version of Trivy. LiteLLM’s build pipeline installed Trivy automatically, giving the poisoned scanner read access to the runner environment and allowing the attackers to steal the project’s PyPI publishing tokens. Using those tokens, TeamPCP published two malicious LiteLLM releases, versions 1.82.7 and 1.82.8, to the Python Package Index on March 24. “The key takeaway is how supply chains have evolved to make a single upstream breach affect thousands of companies simultaneously. A window of roughly 40 minutes in which the LiteLLM dependency was hacked led to over 430,000 instances in which millions of secrets were harvested,” Gal said. Tracing exposed secrets back to their owners The dataset contains information linked to organizations including NVIDIA, Volkswagen, Microsoft, FedEx, S&P Global, John Deere, Epic Games, Orange, TomTom, BT Group, ServiceNow, Deloitte, and Siemens. Screenshots published with the research show AWS secret access keys, Salesforce client secrets, Slack signing secrets, Azure environment variables, and AI provider API keys captured during pipeline execution. A trove of internal corporate secrets (Source: Hudson Rock) CloudSEK, working from a separate dataset built from about 434,000 stolen files, put the number of exposed organizations at close to 2,500. The company stressed that its figures reflect exposure rather than confirmed breaches. “I’ve confirmed the data is legit by the way, multiple victim orgs,” security researcher Kevin Beaumont said. “It contains a significant volume of sensitive content at orgs. It’s a massive supply chain breach due to poor AI security—not because AI is the threat, but teens can run circles around orgs obsessed with rushing out AI and poor DevOps security.” “Identifying the victims within this 153GB database presents a unique threat intelligence challenge. Accurate attribution requires looking past the surface level to analyze the actual infrastructure boundaries,” Hudson Rock noted. In one case, a leaked pipeline was tied to a committer email at SiriusXM, but infrastructure markers in the same dump, including a self-hosted GitLab instance at gitlab.adswizz.com, pointed to AdsWizz, a SiriusXM subsidiary. Hudson Rock said correct identification depends on “hard infrastructure markers rather than simple committer emails.” A large share of the dumped files have no obvious owner. According to Hudson Rock, some contain database passwords, third-party API keys, and cloud credentials without a company email address, custom domain, or internal server name that could identify the organization they came from. This means organizations may have exposed credentials in the dataset without knowing they are affected. Organizations urged to act before stolen data leaks Hudson Rock is urging organizations using AI proxy infrastructure, third-party CI/CD vulnerability scanners, or downstream AI packages to audit their environments for LiteLLM versions 1.82.7 and 1.82.8 and treat any secrets accessible to the LiteLLM environment as compromised. Organizations should also rotate cloud IAM keys and access tokens, review audit logs for anomalous activity dating back to March 24, and check for unauthorized .pth files and suspicious systemd services. “While we cannot disclose how we obtained this data, it is not leaked anywhere at the moment and is not circulating widely. This makes it a critical window of opportunity for companies to rotate keys and secrets before it eventually leaks, as is the natural cycle of a breach,” Gal added. Despite the scale of the breach, some organizations appear to be treating the exposure with less urgency than the findings warrant. “These creds date from about March. One of the orgs impacted told me they’d rotated them all and it’s a nothingburger, so I looked at their responsible disclosure policy, it allows trying creds, so I tried them all. Almost every one worked. Submitted report. One of the biggest US techcos,” Beaumont wrote. “This magnitude pushes us into a completely new world regarding the type of response required from the cybersecurity industry,” Gal concluded.
helpnetsecurity.comAug 13, 2026extracted
Will AI Kill the Bug Bounty Industry?
AI is disruptive. Anthropic’s Claude Mythos model, and its successors, promise to be even more disruptive: they could threaten the existing bug bounty and/or in-house offensive security industries. AI has been widely adopted by both cybersecurity attackers and defenders. Attackers use it to help find bugs and craft attacks from sophisticated social engineering through to developing exploit and malware code. Defenders use it to help detect attacks in progress, detect deepfakes, and help code new software, and for bug bounty hunters and offensive security practitioners, to unearth bugs to fix them before they can be exploited. So far, AI has proven to be a force multiplier rather than a position replacement. Mythos threatens to alter this balance. The evolution of bug bounty programs Bug bounties and pentesting are in a state of flux. That’s nothing new: everything in cybersecurity is constantly in flux. But the Mythos arrival may provide the most rapid flux in offensive security yet. A bounty is a reward. ‘Dead or alive’, was an early 19th-century US tagline. That concept still survives, but with law enforcement now offering bounties for information on live cybercriminals. A bug bounty is a reward for finding a bug not a person. In 1983, Hunter & Ready offered a free Volkswagen Beetle car (commonly known as a Bug) as the reward for finding a computer bug in its VRTX operating system. The new tagline was ‘Get a bug if you find a bug’. The concept of bug bounties had arrived and began to expand from the 1990s: Netscape in 1995; IDefence introducing the middleman concept in 2002 (any person could report any bug to any vendor); Mozilla for Firefox in 2004, Google in 2010, and Facebook in 2011. The HackerOne (with Kara Sprague as CEO) and Bugcrowd (co-founded by Casey Ellis) bug-bounty platforms were established in 2012, followed by YesWeHack in 2015, and Intigriti (Inti De Ceukelaire) in 2016. These are the four primary bounty platforms. Throughout the 2010s the concept expanded and many more companies began to offer bug bounties. By 2022, bounty hunter Youssef Samouda was able to tell SecurityWeek, “With Meta and Google, I make around $400,000 per year.” At the end of 2022, AI in the form of LLMs became generally available, and by late 2024 and early 2025 the modern concept of autonomous agentic AI began to take center stage. By June 2025, autonomous offensive security firm XBOW, had achieved #1 position in HackerOne’s leaderboard. The history of bug bounties shows a consistent combination of expansion with an increasing use of automation and artificial intelligence – which brings us to today. In-house offensive security has followed a similar path but driven by salary rather than reward. Bug bounty today Cassim Khouani (known online as Aituglo and listed in the top 30 Hackers on YesWeHack) wrote The state of Bug Bounty in 2026, published on April 13, 2026. In it, he describes using Claude to aid discovery. Overnight, it discovered ten bugs. “Sounds great on paper. Except half of them were duplicates, and the rest took weeks to get triaged because the report queue on that program had become unmanageable. Welcome to bug bounty in 2026.” He believes bug bounty as we know it today is dying. “What comes next can be better, if we play it right.” Everybody, he suggests, is using one or other form of AI to search for bugs, 24/7 without getting tired. It succeeds, but with side effects: “We end up in a constant mental fog, jumping from one tmux pane to another, switching from one program to the next.” And the bounty platforms themselves suffer from so many new AI-assisted submissions, with triaging and payments taking longer. Companies paying bounties are also suffering with more bug reports, some of poor quality and some critical. “More and more companies are stepping back from bug bounty,” he writes, “while others [such as Google] increase their rewards or change their policy.” Note that after Khouani wrote this in mid-April 2026, Google lowered its Chrome bug bounties and raised its Android bounties on April 30, 2026, citing AI as the cause for both. This is flux with its foot on the pedal: rapid change but not necessarily for the better. “The bug bounty of 2024 is dead. The one in 2026 is a different sport. The hunters who will make it are not those who launch the most agents, but those who know what to look for and where to look. AI is a multiplier, not a replacement.” This was written by Khouani based on his experience of using Claude to assist in bug finding. But then along came Claude Mythos, announced almost at the same moment he published his article. Anthropic’s claims for Mythos going forward suggest the future of AI is more than just a force multiplier. Mythos discovering vulnerabilities Mythos reportedly performs better than any other AI model in finding zero day bugs. “Over the past few weeks, we have used Claude Mythos Preview to identify thousands of zero-day vulnerabilities (that is, flaws that were previously unknown to the software’s developers),” announced Anthropic on April 7, 2026, “many of them critical, in every major operating system and every major web browser, along with a range of other important pieces of software.” In May 2026, Anthropic said its Mythos Preview had identified more than 23,000 potential vulnerabilities after scanning thousands of open-source software projects. Anthropic is apparently so concerned about its ability to find unfound bugs that it has released Mythos Preview to major software providers, allowing them to find and fix their own vulnerabilities (Project Glasswing) before the model becomes generally available. The CSA is equally concerned, having published a paper titled, “The ‘AI Vulnerability Storm’: Building a ‘Mythos-ready’ Security Program”, in which it recommends: “Introduce AI agents to the cyber workforce across the board, enabling defenders to match attackers speed and begin closing the gap.” Fed Chair Powell and Treasury Secretary Bessent met with the heads of major US banks to discuss the cyber risks that may be introduced by Mythos; Reuters has reported ‘Banking industry scrambles for Anthropic’s Mythos as global regulators review risks’; and the media has been full of wild, weird, and wonderful reporting. But one area has had little reporting so far: if Mythos is capable of finding bugs and developing exploit chains so rapidly, what effect will this have on the value and future of the existing bug bounty and offensive security industries? Organizations could just point Mythos at their software and find the bugs without needing to pay bounties or employ expensive pentesters and red teams. The future of bug bounty and offensive security Bug bounty and offensive security are not going away; but both must adapt to a new reality. AI is like sniping: the projectile and its effect may be autonomous, but it still needs a human to aim and pull the trigger. Complete autonomy is still in the future, and that human involvement will remain for years to come. It’s the speed of delivery and the accuracy that has changed. Keep Calm and Carry On: Mythos is not revolutionary Tod Beardsley, VP of security research at runZero, counsels that Mythos should be viewed in the historical concept of an industry barely 30 years old: any advance will seem huge and disruptive while it’s happening. “To be blunt, I don’t think Mythos is fundamentally different or the ‘YOU MUST BUY THIS’ security tooling that Anthropic’s marketing would like us to believe. It’s better tooling, for sure…” But, he adds, “To think that this (or any) model is so fundamentally powerful, dangerous, and revolutionary that you’d be a fool to not buy is to ride along with the classic FUD-based marketing that so often colors cybersecurity marketing… This is just another step on the road to better understanding the risk profile of your particular network.” Richard Ford, CTO at Integrity360, agrees with the need to stay calm but adds, ‘be ready to adapt’. “Anthropic’s own system card shows that this level of performance relied on uncensored models, extended compute, and heavy resampling. In other words, this is not yet a real-world scenario.” Nevertheless, he adds, “Bug bounty programs and human-led testing rely on expertise and time. AI will start to reshape that, although areas like business logic will still depend on human understanding.” It’s adaptation, not replacement, says Chris Payne, VP of forward deployed cyber engineers at Sevii. “Discovery accelerates for everyone, but the real bottleneck has always been investigation and remediation. The defenders who win will pair agentic AI with strong governance so they can investigate, hunt, and remediate at machine speed and endless scale, which will close the gap attackers are widening as we speak.” Jon David, co-founder and MD at NR Labs, agrees with this. The power of Mythos and future AI will allow attackers to find and exploit vulnerabilities faster than defenders can fix them. “But if we leverage AI in the same capacity, it also allows us to find and patch the vulnerabilities before they’re public in production. We must just make sure we’re using the same capabilities as the attackers on ourselves before they do.” This should ensure the continuance of in-house offensive security teams. Bounty hunters and bounty platforms have a slightly different problem to solve: participating companies are likely to become reluctant to pay bounties for an increasing volume of existing but largely irrelevant bug slop already found by hunters and their AI agents, and likely to increase with Mythos. “The widely used Curl project ended its HackerOne program in January 2026 because over 95% of submissions were AI-generated junk,” comments Melissa Bischoping, head of threat research & intelligence at Tanium. “HackerOne [also] paused the Internet Bug Bounty in March, explicitly citing an imbalance between AI-assisted discovery and remediation capacity. Mythos makes this worse by an order of magnitude.” The need for adaptation. Evolving AI increases the speed of discovery and decreases the time to exploitation. Kara Sprague, CEO at HackerOne, points out this is not the gap meant in the CSA report. “The gap they are describing isn’t the gap from discovery to exploitation; it’s clear that it has already collapsed. The gap they are referring to is the operational gap between discovery and remediation: organizations still patch on human timelines, manage risk through quarterly assessments and run remediation through change processes that were never designed for AI-velocity threats.” AI-assisted discovery has flooded programs with low-to-mid-severity findings that maintainers cannot absorb. This will increase with Mythos. “The incentives of such bounty programs need to be rebalanced to favor remediation, which is now the key constraint,” she continues. “Vulnerability findings often sit for a long time before remediation, and this trend will continue as the volume increases. It then becomes a question of prioritizing learning from mistakes rather than focusing on individual issues as that approach hasn’t been scalable and certainly won’t be as these advanced models become more distributed,” adds Shlomie Liberow, founder at aisy.ai, and formerly head of hacker R&D at HackerOne. Bounty platforms are already strained by the number of bugs being discovered. And corporations are unable to keep pace with existing patch levels. What is required is the ability to prioritize high severity bugs over low value bugs, and incentives to prioritize high severity over low value will be built into the programs. The longer view. Corporate options for vulnerability detection remain primarily third-party bounty hunters or in-house offensive security teams. The best option will be governed by whichever adopts the latest technology functionality faster and more intelligently. “Today, frontier model providers (like Anthropic) make AI abundantly cheap to use, reducing the cost of vulnerability research,” suggests Aaron Sant Miller, VP and AI lead for Booz Allen’s Integrated Cyber Business. “If organizations increasingly choose to bring this function in-house, you can expect the bug bounty industry to take a hit. Conversely, bounty hunters may find AI reduces their own cost and time – we may see more bounties executed per month, at a lower cost per bounty. Today’s balancing act will be shaped by adoption.” It may be different tomorrow. The current cost of AI is being eaten by the frontier model developers, and the price to users is artificially low. Once the market has been hooked, the developers may increase their prices to reflect the true market cost. When that happens, organizations will reconsider outsourcing again. “Once AI usage costs begin to reflect their true operating costs, the cost of bug discovery will normalize; organizations and hunters alike will have to determine the fair market price for vulnerability discovery,” he continues. “Overall, in-house security teams that readily adopt AI and evolve their workflows will be more resilient to the disruption.” Sprague agrees that the market for vulnerability hunting is already changing, but she notes, “The total value of the bounty market is growing, not shrinking. High-severity, business-logic and AI-specific vulnerability research (for example, prompt injection, model extraction, adversarial manipulation) is paying more than ever, because very few researchers can do it well.” For in-house offensive teams, she says, “Red teaming was already evolving beyond ‘can we get in’ toward mapping business process fraud paths, executive targeting, third-party compromise chains, privileged identity abuse across SaaS estates. Mythos can’t model your business. It can’t tell you that the real crown jewel isn’t in the codebase at all.” She sees continuous AI-executed adversarial testing with human expertise woven throughout. “Novel attack paths, business logic vulnerabilities and the creative lateral thinking that turns a low-severity finding into a crown jewel compromise still require human ingenuity. AI raises the floor; it doesn’t replace the ceiling.” Summary AI is changing the rules for human vulnerability hunters, but not replacing the requirement. AI can find a never-ending volume of bugs – they will always exist, in both old and new software. But this new AI-discovered volume of bugs, with many of them being low severity, ultimately inconsequential slop, has highlighted the real problem. It’s not finding the bugs (that hasn’t been a problem for years); it’s distinguishing the meat from the slop with rapid remediation. AI is not good at this. It requires human knowledge and ingenuity. In-house human offensive security, using AI but not relying on it, can do this well – and the value of in-house detection and remediation will remain. External bounty hunting will be most impacted, but will continue to offer a valuable service if the bounty paid can be refocused on critical bugs and remediation. This will offer a valuable alternative for those companies that find employment of a permanent in-house team to be too costly. Vulnerability hunting, like every other aspect of cybersecurity, is subject to new technology. And like every other aspect of cybersecurity, the advice to practitioners remains the same: keep calm, adapt, and carry on. Related: Cyber Insights 2026: Offensive Security; Where It Is and Where It’s Going Related: OpenAI Launches Bug Bounty Program for Abuse and Safety Risks Related: Microsoft Bug Bounty Program Expanded to Third-Party Code
securityweek.comJun 9, 2026extracted
Škoda warns of customer data breach after online shop hack
Škoda Auto, a wholly owned subsidiary of the Volkswagen Group, has disclosed a data breach after attackers hacked its online shop and stole the personal information of an undisclosed number of customers. The 130-year-old Czech car maker has over 34,000 employees and reported sales of more than €27 billion and a profit of nearly €2 billion in 2025, having delivered over 1 million cars to customers. As Škoda revealed, threat actors gained access by exploiting an unspecified vulnerability in the software of its e-commerce portal. After detecting the breach, the company reported the incident to the relevant authorities and has fixed the security flaw exploited in the attack. "As part of our technical security monitoring, we discovered that unauthorized individuals had exploited a vulnerability in the standard software used for our online store. This allowed them to temporarily gain unauthorized access to the store system," Škoda said. "The vulnerability has since been resolved, and the incident has been handed over to a specialized IT forensics team for technical analysis. Additionally, the incident was reported to the relevant data protection supervisory authority." The customer information accessed by the threat actors includes a combination of names, addresses, contact information (such as email addresses), phone numbers, order information, and login credentials (including the email address and a cryptographic hash of the password). However, according to Škoda, the attackers were unable to access affected customers' financial information because it was not stored on the compromised systems. "Full credit card details are not stored in the shop system but are processed exclusively by the respective payment service providers. Based on current information, direct access to full credit card details was not possible," the company added. Additionally, while it said it has no evidence that the access data has been misused, Škoda warned affected individuals that phishing attacks might target them and that threat actors may try to log in to their other online accounts if they reused the same credentials. Breach only impacts the shop.skoda-auto.de online store A Škoda spokesperson didn't answer BleepingComputer's questions on the breach, including the total number of affected customers and whether the company had been in contact with the attackers about paying a ransom. However, they said the incident only impacted "the online shop operated by the Škoda Auto importer in Germany and does not concern Škoda Auto globally." "The Škoda Connect Portal and all associated services are not affected by the security incident. The online shop at shop.skoda-auto.de and the Škoda Connect Portal are therefore technically separate systems," the spokesperson added. Škoda's announcement comes after carmakers Renault and Dacia also disclosed a data breach affecting UK customers in October, exposing a wide range of personal and vehicle information, including names, addresses, and vehicle identification and registration numbers. One month earlier, Jaguar Land Rover (JLR) was also hit by a cyberattack that led to a 43% decline in third-quarter wholesale volumes and cost the company over $220 million after severely disrupting the automaker's production and retail operations. Update May 13, 09:16 EDT: Added Škoda statement. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report
bleepingcomputer.comMay 12, 2026extracted
Ransomware, Volkswagen conferma l’attacco ma rassicura: “Nessun sistema IT è stato impattato”
Al netto delle rivendicazioni del gruppo cyber criminale 8Base, Volkswagen ha voluto fornire delle rassicurazioni ufficiali. Lo scorso anno Volkswagen ha subìto un attacco ransomware su larga scala, da parte del gruppo cyber criminale 8Base ma non c’è ancora chiarezza sull’entità del danno. In fase di rivendicazione, 8Base ha annunciato di essere in possesso di una gran mole di dati, da oltre un anno. Questi consisterebbero in fatture, ricevute, documenti contabili, file personali dei dipendenti, contratti di lavoro, certificati, registri del personale e numerosi accordi di riservatezza. Volkswagen ha confermato che si è verificato un “incidente” di sicurezza cyber, ma finora ha mantenuto il riserbo sulla portata dell’incidente e sull’eventuale furto di dati. Anzi, ha rassicurato sul fatto che non vi sia stato alcun impatto sui propri sistemi informatici. Da questo punto di vista, la violazione potrebbe essere avvenuta tramite un fornitore terzo o un fornitore di servizi parte del gruppo. Come agisce 8Base? 8Base non è molto conosciuto, essendo apparso sulla scena nel 2023. Si ritiene che il collettivo sia un ramo del gruppo ransomware Phobos. Inoltre, secondo diversi esperti, da quando questo si è formato ha preso di mira più di 1.000 organizzazioni, incassando un totale di 16 milioni di dollari in riscatti. Ottenendo spesso l’accesso iniziale tramite campagne di phishing o acquistando credenziali sul dark web, il gruppo hacker criminale si affida principalmente a una strategia di doppia estorsione. In primo luogo, crittograferebbe i dati delle vittime, per poi minacciare di pubblicare le informazioni rubate. Questo, a meno che non venga pagato un riscatto. L’attacco ransomware contro Volkswagen potrebbe allora rappresentare un cambiamento nel modo di operare di 8Base. Le informazioni sulle minacce che ha fornito Europol mostrano che il gruppo ha tendenzialmente preso di mira soprattutto le piccole e medie imprese. Queste, in effetti, spesso non dispongono delle difese di sicurezza informatica necessarie per proteggersi. L’aver preso di mira un colosso automobilistico come quello tedesco, dunque, potrebbe rappresentare un vero salto di qualità nel loro modo di concepire il crimine informatico. Geo-economia delle catene del valore La messa in sicurezza delle terze parti è nevralgica. La possibilità che i criminali informatici agiscano attaccando fornitori esterni è una variabile sempre più all’ordine del giorno. In particolare nel panorama geopolitico contemporaneo, i supply chain attack rappresentano infatti una delle minacce più insidiose alla sicurezza nazionale e internazionale. Questi attacchi, che prendono di mira la catena di approvvigionamento di prodotti e servizi, hanno rimodulato il concetto stesso di conflitto. Fondono infatti elementi di confronto militare tradizionale con sofisticate operazioni cyber. Sui mercati automobilistici, come del resto in tutti i settori economici e finanziari, la globalizzazione delle catene di approvvigionamento ha creato una rete di interdipendenze estremamente complessa. Tanto da generare vulnerabilità sistemiche sfruttabili da attori malevoli. Non si tratta più solo di compromissione di componenti software. Al contrario, i più recenti casi operativi dimostrano come anche le supply chain fisiche siano diventate obiettivi primari, con conseguenze potenzialmente catastrofiche.
cybersecitalia.itOct 23, 2025extracted
Cybersecurity jobs available right now: October 21, 2025
Cybersecurity jobs available right now: October 21, 2025 CISO Open-Xchange | Germany | Remote – No longer accepting applications As a CISO, you will lead the development and implementation of security strategies and requirements across the OX Group. You will advise management on information security matters, provide transparent reporting, and drive continuous improvement of the organization’s security management system. You will oversee risk assessments, monitor emerging threats, and ensure secure product development, system architecture, and cloud operations. CISO Princeton University | USA | On-site – No longer accepting applications As a CISO, you will guide the CIO and senior leadership on information security strategy, balancing Princeton’s academic mission with risk and compliance needs. You will lead the development and implementation of security and data governance policies in collaboration with University leadership and IT teams. Cyber Infrastructure Specialist GDIT | USA | Remote – No longer accepting applications As a Cyber Infrastructure Specialist, you will design, deploy, and maintain enterprise server and virtualization environments, including VMware vSphere, vSAN, and NSX. Build and configure virtual machines, clusters, storage, and networking for high availability and scalability. Ensure compliance with NIST 800-53, RMF, FISMA, or other federal cybersecurity requirements as applicable. Get weekly updates on new cybersecurity job openings. Subscribe here! Cyber Security Analyst Portakabin | United Kingdom | On-site – No longer accepting applications As a Cyber Security Analyst, you will monitor and analyze security systems, alerts, and daily reports related to phishing, endpoint compliance, and account activity. You will conduct regular security audits, complete customer questionnaires, and investigate and document incidents or breaches. You will also maintain dashboards and metrics, track security trends, and update policies and ISMS documentation to ensure ongoing compliance and improvement. Cyber Security Consultant SOPHTIX | Israel | Hybrid – No longer accepting applications As a Cyber Security Consultant, you will be responsible for conducting security assessments, identifying and analyzing vulnerabilities, creating security strategies, providing recommendations for improvement, and implementing security measures. Additionally, the consultant will stay updated on the latest security trends and technologies and provide expert advice to clients. Cyber Security Engineer RONIN Dynamics | Australia | Remote – No longer accepting applications As a Cyber Security Engineer, you will lead the deployment, configuration, and optimisation of the SentinelOne Singularity XDR platform across enterprise and government environments. Integrate SentinelOne with SIEM/SOAR systems and other security platforms to enhance visibility and automation. Perform threat hunting, incident analysis, and remediation through the console. Cyber Security Engineer Protergo | Indonesia | On-site – No longer accepting applications As a Cyber Security Engineer, you will perform vulnerability assessments, penetration testing, and red teaming in a consulting environment. You will conduct security evaluations across cloud, on-premises, and hybrid infrastructures to identify and mitigate risks. Your work will help strengthen clients’ security posture through comprehensive assessments and actionable recommendations. Cyber Threat Investigator ColorTokens | India | On-site – No longer accepting applications As a Cyber Threat Investigator, you will conduct proactive threat hunting across endpoints, network, cloud, and identity systems using telemetry and behavioral indicators. Develop hunting hypotheses based on current threat landscape, TTPs (MITRE ATT&CK), and internal observations. Utilize threat intelligence to identify new indicators of compromise (IOCs) and behavioral patterns. Cybersecurity Consultant Henkel | Germany | Hybrid – No longer accepting applications As a Cybersecurity Consultant, you will conduct comprehensive security assessments of IT systems, projects and organizations. Collaborate with cross-functional teams to integrate security measures into business processes, IT organizations and IT systems. Develop and implement information security and cybersecurity policies, procedures, and controls. Director of Security THE ICONIC | Australia | Hybrid – View job details As a Director of Security, you will define, own and execute the company’s security strategy and roadmap, aligned with GFG’s security strategy and overall business objectives. Oversee and ensure compliance with relevant security standards and regulations. Conduct risk assessments and vulnerability management to reduce risk exposure through timely identification and mitigation. Head of Cyber Security RSPB | United Kingdom | Remote – No longer accepting applications As a Head of Cyber Security, you will lead the development, implementation, and continuous improvement of the RSPB’s cyber security strategy. Act as the senior accountable executive for cyber risk, compliance, and incident response. Provide expert advice to the CDTO, trustees, and executive board on cyber threats, risks, and mitigation strategies. Maintain oversight of cyber KPIs, threat intelligence, and incident response protocols. Ensure compliance with relevant regulatory frameworks. Head of Information Security Bluedrop Medical | Ireland | Hybrid – No longer accepting applications As a Head of Information Security, you will develop, lead, and continuously improve Bluedrop’ s information security program. Define and enforce policies and procedures aligned with ISO 27001, NIST CSF, HIPAA standards. Oversee risk assessments, vulnerability management, incident response, and third-party risk processes. Manage and prepare for external audits and certifications (e.g., ISO 27001, FedRAMP readiness assessments, HIPAA audits). Information Security Analyst Verdantas | India | On-site – No longer accepting applications As an Information Security Analyst, you will perform vulnerability scans and assessments, prioritizing and tracking remediation efforts. Manage and configure security tools, including EDR/XDR, antivirus, and email security gateways. Implement and manage identity and access management (IAM) policies and practices. Assist in the development and enforcement of security policies, standards, and procedures. Information Security GRC Manager Airties | France | Hybrid – No longer accepting applications As an Information Security GRC Manager, you will develop and maintain policies, procedures, and documentation related to information security governance, risk management, and compliance. Manage and develop information security initiatives, ensuring alignment with organizational goals and industry standards. Conduct internal security audits to assess the effectiveness of security controls and identify areas for improvement. Information Security Risk Manager Pantheon | Canada | Remote – No longer accepting applications As an Information Security Risk Manager, you will define Pantheon’s risk management methodology—establishing the organization’s risk appetite, scoring criteria, and treatment approach to ensure a consistent and effective process. You will lead risk assessments across all assets, develop and document risk treatment plans, and create the Statement of Applicability for ISO 27001 compliance. You will also monitor, report, and maintain all risk-related documentation to keep Pantheon’s information security program resilient and audit-ready. IS Global Cyber Security Lead ABB Robotics ABB | Italy | On-site – No longer accepting applications As an IS Global Cyber Security Lead ABB Robotics, you will develop and maintain cybersecurity policies, standards, and procedures aligned with ISO 27001, GDPR, NIS 2, TISAX, and SOX. Conduct risk assessments, manage the enterprise risk register, and define mitigation strategies with key stakeholders. Monitor emerging threats and coordinate with Security Operations to ensure effective detection and response. IT Security Specialist Volkswagen Group | Italy | Hybrid – No longer accepting applications As an IT Security Specialist, you will Design, implement, and validate security controls for networks, servers, endpoints, cloud services, and applications. Support and guide infrastructure and development teams in adopting secure configurations and practices. Lead technical investigations during security incidents, including root-cause analysis and remediation. Perform vulnerability assessments, penetration testing coordination, and security hardening. Lead Threat Hunter (OT Cybersecurity) CPX | UAE | On-site – No longer accepting applications As a Lead Threat Hunter (OT Cybersecurity), you will detect, investigate, and respond to advanced threats across operational technology environments. You will enhance threat detection by integrating new tools, tuning SIEM use cases, performing vulnerability analysis, and conducting hands-on cybersecurity testing of critical systems. You will collaborate with stakeholders to identify root causes, recommend remediation, and continuously improve detection, response, and threat-hunting processes across multiple environments. Manager, Detection Engineering Datadog | France | On-site – No longer accepting applications As a Manager, Detection Engineering, you will research emerging attack and defense techniques in cloud environments and translate those insights into actionable security content. You will lead your team in designing and delivering high-quality security integrations across Datadog’s Logs, Cloud SIEM, Cloud Security, and Workflow products. You will also define and track key metrics to demonstrate the impact and value of your team’s work to senior leadership. Offensive Security Engineer, Red Team Operations Group Meta | USA | On-site – No longer accepting applications As an Offensive Security Engineer, Red Team Operations Group, you will design, scope, and execute Red Team operations targeting both traditional and bespoke environments across Meta, evading preventions, detections, and response. Incorporate Threat Intelligence research to track APT trends and recreate their Tactics, Techniques, and Procedures for operations and other offensive security testing. Penetration Test Team Lead Clear Gate | Israel | Remote – No longer accepting applications As a Penetration Test Team Lead, you will manage and mentor a team of testers, overseeing client engagements to ensure high-quality, on-time delivery. You will review and approve test reports, guide technical execution, and drive continuous improvement in tools, scripts, and methodologies. You will also contribute to internal knowledge sharing, training, and process enhancements to strengthen overall testing capabilities. Security Assessment Automation Specialist (VP) SMBC Group | Ireland | Hybrid – No longer accepting applications As a Security Assessment Automation Specialist (VP), you will design and implement enterprise-grade security assessment pipelines integrating SAST, DAST, IAST, and SCA tools into CI/CD workflows. Integrate security testing into IaC workflows (Terraform, CloudFormation), ensuring security by design in automated deployments. Establish frameworks for automated enforcement of security baselines and compliance requirements. Senior Security Engineer – Security Automation Samsara | Canada | Remote – No longer accepting applications As a Senior Security Engineer – Security Automation, you will design and implement automation integrations using tools like Tines, AWS Lambda, and related platforms. You will drive infrastructure-as-code adoption with Terraform, managing configurations across enterprise tools such as GitHub, CrowdStrike, Splunk, and MDM systems, and build custom providers where integrations don’t exist. You’ll collaborate with engineers across teams to deliver projects, maintain core security systems, and handle escalations from cross-functional partners. Senior Manager, Threat Intelligence & Detection Nordstrom | USA | Hybrid – No longer accepting applications As a Senior Manager, Threat Intelligence & Detection, you will develop and execute the strategic roadmap for threat intelligence, detection engineering, and threat hunting programs across multiple business units. Drive development of advanced behavior-based, anomaly detections, and AI/ML-powered detection systems aligned with MITRE ATT&CK and emerging threat actor TTPs. Specialist IT, Operations & Information Security Audit Commercial Bank International | UAE | On-site – No longer accepting applications As a Specialist IT, Operations & Information Security Audit, you will support the Head of Audit in developing annual plans and performing risk assessments across IT, operational, and information security domains. You will lead and execute audit assignments, evaluate internal controls, identify risks, document findings, and recommend corrective actions to enhance efficiency and compliance. You will also prepare clear audit reports, coordinate with management on remediation plans, and ensure timely follow-up and continuous improvement of audit processes. Systems Vulnerability Management Analyst Apex Systems | USA | Remote – No longer accepting applications As a Systems Vulnerability Management Analyst, you will Support remediation of system vulnerabilities identified by cybersecurity, including planning and execution of fixes. Manage and maintain Windows OS environments (2008–2025) and Linux systems (Libuntu/Ubuntu). Oversee upgrades, patching, and replacement of end-of-life operating systems.
helpnetsecurity.comOct 21, 2025extracted
Volkswagen punta sull’intelligenza artificiale: un miliardo di euro per ridurre le spese
Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/
redhotcyber.comSep 11, 2025extracted
14th July – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 14th July, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES McDonald’s has suffered a data breach that resulted in the exposure of chat transcripts, session tokens, and personal data from more than 64 million job applications submitted through its AI powered McHire chatbot platform. Data leaked included applicants’ names, email addresses, phone numbers, home addresses, availability, and personality test results, made accessible due to an insecure direct object reference (IDOR) vulnerability and admin accounts protected by weak default credentials. RocketGenius, the developer of WordPress plugin Gravity Forms, has experienced a cyber-attack that resulted in the compromise of plugin versions 2.9.11.1 and 2.9.12 available for manual download and composer install between July 10 and 11. The attack enabled remote code execution, extensive exfiltration of website metadata—including URLs, admin paths, installed themes, plugin and server versions—and the creation of a rogue admin account granting attackers complete control over affected websites, impacting potentially one million sites. Bitcoin Depot, a major Bitcoin ATM operator in the US, has suffered a data breach that resulted in the exposure of sensitive personal information belonging to nearly 27,000 customers, including full names, phone numbers, driver’s license numbers, addresses, dates of birth, and email addresses. Albemarle County in Virgina, United States, was hit by a ransomware attack that resulted in significant phone and technology outages, and the potential exposure of sensitive data belonging to local government and public-school employees, including driver’s license numbers, Social Security numbers, passport numbers, military IDs, and more. Some of the county’s 112,000 residents may have also had their names, addresses, and Social Security numbers compromised. GMX, a decentralized crypto exchange platform, has confirmed a cyber-attack that resulted in the theft of more than $40 million worth of cryptocurrency assets from its platform. The incident impacted user funds, with about $43 million in digital assets—including Ethereum, USDC, and DAI—being stolen and laundered by the hacker, affecting the platform’s more than 700,000 users. Nippon Steel Solutions, Japan’s largest steelmaker, has suffered a data breach after attackers exploited a zero-day vulnerability in its network equipment, resulting in unauthorized access to sensitive information. The breach has potentially exposed personal data of customers, partners, and employees. Ameos Group, a major Swiss hospital group, has experienced a cyber-attack that resulted in significant disruptions to its hospital operations across multiple locations. Critical IT systems were rendered inoperable, affecting both inpatient and outpatient care, as well as internal communication and documentation. VULNERABILITIES AND PATCHES Microsoft has published July’s Patch Tuesday, addressing 137 vulnerabilities across Microsoft products, including a publicly disclosed zero-day (CVE-2025-49719) in Microsoft SQL Server that allows remote, unauthenticated information disclosure due to improper input validation. Critical remote code execution vulnerabilities in Microsoft Office—triggered by malicious documents or preview pane viewing—and additional RCE flaws in Microsoft SharePoint (CVE-2025-49704) are also resolved. Details have been disclosed on a pre-authenticated SQL injection vulnerability (CVE-2025-25257, CVSS 9.8) in Fortinet FortiWeb, where exploitation can lead to remote code execution on unpatched systems. Attackers can inject arbitrary SQL via the Authorization header in HTTP requests, allowing unauthorized file creation and code execution through manipulated Python files. Exploits and technical details have been released publicly, greatly increasing the risk of compromise. Check Point IPS provides protection against this threat (Fortinet FortiWeb SQL Injection CVE-2025-25257) A technical analysis of the PerfektBlue vulnerability chain revealed four chained flaws (CVE-2024-45431 through CVE-2024-45434) in the Blue SDK Bluetooth stack used by OpenSynergy. The vulnerabilities enable remote code execution in over 350 million vehicles from Mercedes-Benz, Volkswagen, Skoda, and possibly Ford, and more than 1 billion embedded devices spanning automotive, industrial, consumer, mobile, and medical sectors. THREAT INTELLIGENCE REPORTS Check Point Research has released its June 2025 Malware Report highlighting AsyncRAT which was ranked number three among Top Malware. AsyncRAT was distributed via sophisticated multi-stage malware campaign exploiting expired Discord vanity invite links, leveraging trusted platforms such as GitHub, Bitbucket, and Discord for payload delivery and data exfiltration. The report also details additional malware families including FakeUpdates and Androxgh0st, affecting sectors such as education, healthcare, and government. Check Point Research has summarized key findings about the Scattered Spider threat group, which has recently targeted major airlines and diverse enterprises using sophisticated social engineering and phishing domain infrastructure. The group employs phishing sites that mimic corporate login portals (e.g., victimname-sso.com), MFA fatigue, vishing, SIM swapping, and uses both remote access tools and infostealers. Check Point has released findings revealing a 39% surge in weekly cyber-attacks targeting organizations in Latin America during the first half of 2025, averaging 2,716 weekly incidents compared to the global average of 1,955. Key threats include advanced malware such as RATs and botnets, while email was identified as the leading delivery vector.
research.checkpoint.comJul 14, 2025extracted