1010.cx

  • Weekly Cybersecurity News Recap : Palo Alto Networks, Zscaler, Jaguar Land Rover, and Cyber Attacks

    ·

    , ,

    Welcome to your weekly cybersecurity briefing. In a digital landscape where the only constant is change, this past week has been a stark reminder that vigilance is not just a best practice, but a necessity for survival.

    From corporate giants making strategic moves to protect the cloud to sophisticated threat actors breaching the defenses of iconic brands, the cyber battleground remains as active as ever, demanding our full attention.

    This week, Palo Alto Networks made headlines by releasing an emergency patch for a critical zero-day vulnerability discovered in its PAN-OS software, affecting its GlobalProtect gateways. The vulnerability allowed for unauthenticated remote code execution, sending ripples of urgency throughout the industry as IT teams scrambled to apply the fix.

    Our deep dive explores the technical specifics of this exploit, the rapid response from Palo Alto’s Unit 42, and the immediate steps security teams must take to mitigate this significant threat before it can be widely exploited in the wild.

    On the proactive front, Zscaler countered the growing threat of AI-driven phishing attacks by unveiling a new suite of features for its Zero Trust Exchange. Their latest research report, also released this week, highlights a substantial increase in sophisticated, context-aware phishing emails over the last quarter.

    We will break down how Zscaler’s new AI-powered capabilities aim to detect and block these evasive threats in real-time, offering a new layer of defense in the fight against social engineering and credential theft.

    In a significant blow to the automotive sector, Jaguar Land Rover (JLR) confirmed it suffered a major data breach. The incident resulted in the exfiltration of sensitive employee data and internal engineering documents.

    While JLR has stated that customer financial information was not compromised, the breach raises serious questions about supply chain security and the protection of intellectual property within the manufacturing industry. We will analyze the attack vector, the potential fallout for JLR, and the lessons other organizations in the sector must learn from this high-profile incident.

    Beyond these major stories, we are also tracking a surge in DDoS attacks targeting financial institutions and new warnings from CISA about state-sponsored actors targeting critical infrastructure. In this edition, we provide in-depth analysis of each of these events, offering expert commentary and actionable insights to help you fortify your organization’s defenses.

    Threats

    Hackers Exploit Email Marketing Services for Phishing

    Cybercriminals are increasingly using legitimate email marketing platforms to bypass security filters and deliver malicious content. By leveraging the trusted domains of these services, attackers can disguise phishing attempts and increase the likelihood of their emails reaching inboxes. These campaigns often use the platform’s own click-tracking and URL redirection features to send users to harmful websites after they click on a seemingly safe link. One notable incident involved a data breach at Mailchimp, where hackers gained access to customer accounts and data. Read More

    macOS Security Features Turned Against Users

    A sophisticated attack trend involves exploiting macOS’s built-in security features to spread malware. Attackers are finding ways to abuse tools like Keychain for credential theft, bypass System Integrity Protection (SIP) for persistent infections, and trick users into granting permissions through Transparency, Consent, and Control (TCC). Other features being manipulated include Gatekeeper, which verifies downloaded apps, and File Quarantine, which flags files from the internet. Read More

    Commercial Spyware Vendors Are a Major Source of Exploits

    A report from Google’s Threat Analysis Group (TAG) highlights the significant role of commercial spyware vendors in the creation and distribution of sophisticated surveillance tools. These companies are responsible for a large number of 0-day exploits that target products from companies like Google and Apple. The report notes that the private sector is now a major player in developing some of the most advanced cyber capabilities, selling them as “turnkey espionage solutions” to government customers. Read More

    New “TinyLoader” Malware Targets Windows Systems

    A stealthy malware loader known as TinyLoader is actively targeting Windows users. It spreads through shared network drives and deceptive shortcut files, acting as an initial access point for more dangerous malware such as RedLine Stealer and DCRat. TinyLoader can move laterally across networks and also infect systems via removable media like USB drives. Once it gains administrator rights, it can hijack file associations to ensure it runs every time a user opens a common file type, like a .txt file. Read More

    “NotDoor” Backdoor Deployed Through Outlook

    The Russian state-sponsored group APT28 (also known as Fancy Bear) is using a new backdoor called “NotDoor” to target organizations through Microsoft Outlook. The malware is disguised within legitimate Outlook macros and can exfiltrate data, upload files, and execute commands on an infected system. It achieves persistence by modifying Outlook’s registry settings to disable security warnings and enable macros to run on startup. Read More

    “GhostRedirector” Manipulates Search Results via IIS

    A hacking group dubbed “GhostRedirector” has been compromising Windows servers to manipulate search engine results for financial benefit. The attackers deploy a malicious module for Microsoft’s Internet Information Services (IIS) web server. This allows them to intercept and redirect web traffic or inject unwanted content into search results. The malicious module can be difficult to detect as it integrates deeply with the server’s legitimate functions. Read More

    Fake Microsoft Teams Sites Used to Distribute Malware

    Threat actors are weaponizing fake Microsoft Teams websites and even initiating Teams calls to trick users into installing malware. In some cases, attackers impersonate IT support staff during calls to convince victims to execute malicious PowerShell commands, leading to the deployment of ransomware. Another campaign uses a fake Teams site to distribute the “Odyssey” information-stealing malware for macOS. Read More

    “GPUGate” Malware Leverages Google Ads and GPUs

    A sophisticated malware campaign named “GPUGate” is abusing Google Ads and GitHub to deliver malware. The attack begins with malicious ads in Google search results for terms like “GitHub Desktop”. A novel aspect of this attack is its use of the computer’s Graphics Processing Unit (GPU) to perform certain operations, which helps it evade detection by security software that primarily focuses on the CPU. Read More

    Cyber Attacks

    Record-Breaking 11.5 Tbps DDoS Attack Hits the Web

    A massive UDP flood Distributed Denial-of-Service (DDoS) attack has been recorded, reaching an unprecedented 11.5 terabits per second (Tbps). This attack highlights the escalating scale of DDoS threats facing organizations. Read More

    Hackers Weaponize Hexstrike-AI to Exploit Zero-Day Flaws

    Threat actors are now leveraging a new AI-powered offensive security framework named Hexstrike-AI. The tool is being used to automatically scan for and exploit previously unknown “zero-day” vulnerabilities, significantly speeding up the attack process. Read More

    “Dire Wolf” Ransomware Emerges with Double Extortion Tactics

    A new and sophisticated ransomware strain, dubbed “Dire Wolf,” has impacted 16 firms across the globe since May 2025. This ransomware employs double extortion methods, advanced encryption, and anti-recovery tactics to pressure victims into paying. Read More

    Colombian Threat Actors Use SWF and SVG Files to Evade Detection

    A malware campaign originating from Colombia is using a multiphase attack that leverages Adobe Flash (SWF) and Scalable Vector Graphics (SVG) file formats. This technique allows the attackers to bypass traditional security detection measures. Read More

    AI Platforms Exploited in Microsoft 365 Phishing Campaigns

    Cybercriminals are increasingly taking advantage of the trust that organizations place in artificial intelligence platforms. These platforms are being used in sophisticated phishing campaigns to steal Microsoft 365 credentials. Read More

    NightshadeC2 Botnet Employs “UAC Prompt Bombing”

    A new botnet, identified as NightshadeC2, has been observed using a novel technique called “UAC Prompt Bombing.” This method allows it to bypass Windows Defender security measures and was first seen in early August 2025. Read More

    Critical SAP S/4HANA Vulnerability Under Active Exploitation

    A critical security flaw in SAP S/4HANA is being actively exploited by attackers. The vulnerability allows individuals with low-level user access to escalate their privileges and gain full control over the affected SAP systems. Read More

    Vulnerabilities

    MediaTek Patches Dozens of Chipset Flaws

    MediaTek released its September 2025 security bulletin, addressing multiple high and medium-severity vulnerabilities across more than 60 chipsets. The flaws, found in modem and firmware components, could lead to denial-of-service attacks or remote privilege escalation if exploited. The vulnerabilities include out-of-bounds writes, out-of-bounds reads, and use-after-free bugs. MediaTek confirmed that device manufacturers received the patches in July and there is no evidence of these vulnerabilities being exploited in the wild. Read more

    Critical Next.js Flaw Allows Authorization Bypass

    A critical vulnerability, CVE-2025-29927, has been discovered in the popular Next.js web development framework. The flaw allows attackers to bypass authorization mechanisms and gain access to restricted areas, such as admin panels. By manipulating the x-middleware-subrequest header, an attacker can trick an application into skipping security checks. Vercel, the company behind Next.js, has released patches to address the issue, which is estimated to affect over 300,000 services. Read more

    Azure Active Directory Flaw Exposes Sensitive Credentials

    A significant vulnerability in Azure Active Directory (Azure AD) configurations allows for the exposure of application credentials, such as ClientId ClientSecret. Attackers who obtain these credentials can impersonate trusted applications, access sensitive data across Microsoft 365 services like SharePoint and OneDrive, and even deploy malicious apps to establish persistent backdoors. The issue stems from credentials being inadvertently exposed in configuration files. Read more

    MobSF Security Tool Vulnerable to Malicious File Uploads

    A critical flaw (CVE-2023-37576) was discovered in the Mobile Security Framework (MobSF), a widely used open-source tool for mobile app security testing. The vulnerability, found in version 4.4.0, was due to improper path validation, which allowed authenticated attackers to upload and execute malicious files on the system running MobSF. This path traversal vulnerability could turn the security tool into a vector for system compromise. The issue has since been patched. Read more

    PoC Exploit Released for IIS Remote Code Execution Flaw

    A proof-of-concept (PoC) exploit has been released for a critical remote code execution (RCE) vulnerability (CVE-2025-53772) in Microsoft’s Internet Information Services (IIS) Web Deploy tool. The vulnerability is caused by the unsafe deserialization of HTTP header content, allowing an authenticated attacker to execute arbitrary code. This follows other campaigns targeting older IIS vulnerabilities, such as a buffer overflow flaw (CVE-2017-7269) in IIS 6.0 that was used to install cryptocurrency miners. Read more

    CISA Warns of Actively Exploited WhatsApp Zero-Day

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a zero-day vulnerability in WhatsApp (CVE-2025-55177) that is being actively exploited. The flaw, categorized as an incorrect authorization issue, allows attackers to manipulate the device synchronization process to send malicious content from a controlled URL. This could lead to data theft or device compromise, potentially through zero-click attacks. The vulnerability was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply patches. Read more

    Google Releases Chrome 140 With Key Security Fixes

    Google has rolled out Chrome 140, which includes patches for six security vulnerabilities. The fixes address medium-severity flaws in components like the Toolbar (CVE-2025-9865), Extensions (CVE-2025-9866), and Downloads (CVE-2025-9867). These vulnerabilities could have led to unexpected browser behavior or security risks like privilege escalation. The update was released for Windows, macOS, and Linux. Read more

    New “Namespace Reuse” Vulnerability Hits Major AI Platforms

    A novel AI supply-chain attack method called “Model Namespace Reuse” has been discovered, affecting platforms like Microsoft Azure AI, Google Vertex AI, and Hugging Face. The vulnerability allows attackers to upload a malicious AI model using the same name as a legitimate but deleted or abandoned one. When a project attempts to pull the model by name, it inadvertently downloads the malicious version, leading to remote code execution (RCE) in the victim’s environment. Read more

    Sitecore Zero-Day Vulnerability

    Information regarding the “Sitecore zero-day vulnerability” from the provided link could not be retrieved at this time. Read more

    Data Breach

    Palo Alto Networks, Zscaler, Cloudflare, and PagerDuty Hit by Supply Chain Attack

    A sophisticated supply chain attack targeting the Salesloft Drift application has impacted several major technology companies, including Palo Alto Networks, Zscaler, Cloudflare, and PagerDuty. The attackers exploited compromised OAuth tokens to gain unauthorized access to the companies’ Salesforce customer relationship management (CRM) environments and exfiltrate data.

    • Palo Alto Networks confirmed that the incident was isolated to its CRM platform, and no company products or services were affected. The breach exposed business contact information and internal sales data. Read More
    • Zscaler also confirmed a data breach affecting customer data stored in Salesforce, including names, email addresses, and phone numbers. Zscaler has stated that its own products and infrastructure were not compromised. Read More
    • Cloudflare disclosed that the attackers accessed customer support case data between August 12 and August 17, 2025. The company warned that any sensitive information shared by customers in support tickets should be considered compromised. Read More
    • PagerDuty reported that the breach exposed customer contact information stored in its Salesforce instance. The company has found no evidence that its own platform or internal systems were accessed. Read More

    Jaguar Land Rover Halts Production After Cyberattack

    Luxury car manufacturer Jaguar Land Rover (JLR) was forced to halt production at its Halewood plant after a significant cybersecurity incident that impacted its global IT systems. The attack, which took place in early September 2025, caused severe disruptions to the company’s manufacturing operations. A group of hackers known as “Scattered Lapsus$ Hunters” has claimed responsibility for the attack. Read More

    Bridgestone Manufacturing Disrupted by Cyberattack

    Tire giant Bridgestone confirmed that a cyberattack in early September 2025 affected some of its manufacturing facilities in North America, leading to operational disruptions. The company stated that it responded quickly to contain the incident and believes no customer data was compromised. The full extent of the impact on the supply chain is still being investigated. Read More

    Wealthsimple Discloses Customer Data Breach

    Canadian financial services firm Wealthsimple announced that it suffered a data breach in late August 2025, resulting in unauthorized access to the personal information of a small percentage of its clients. The company has assured customers that their funds and account passwords remain secure. The breach was caused by a compromised third-party software package. Read More

    Other News

    Salesforce Bolsters Security with New Forensic Investigation Guide

    Salesforce has released a comprehensive forensic investigation guide to help organizations detect, analyze, and respond to security incidents within their environments. The guide focuses on three core pillars for a thorough investigation: analyzing activity logs to track user actions, understanding user permissions to determine the potential impact of a breach, and utilizing backup data to identify data tampering. This initiative aims to provide a structured framework for companies to manage cyber incidents more effectively, especially after a series of sophisticated cyber campaigns. The guide highlights tools like Login History, Setup Audit Trail, and Event Monitoring to gain visibility into user activities. Read More

    Wireshark Releases Version 4.4.9 with Critical Bug Fixes

    The Wireshark team has launched version 4.4.9, a maintenance release focused on improving stability and reliability. This update for the popular network protocol analyzer addresses several critical bugs, including a security vulnerability in the SSH dissector that could cause the application to crash. The new version also includes updated support for various protocols and ensures a more stable experience for users, leading to more efficient network analysis. Read More

    Nmap Celebrates 28 Years of Network Security Innovation

    Nmap, the renowned network scanner, recently marked its 28th anniversary. Launched on September 1, 1997, as a simple port scanner, Nmap has evolved into an essential and comprehensive network security suite used by professionals worldwide. Over the years, it has incorporated advanced features like operating system and service version detection, the Nmap Scripting Engine (NSE) for automated tasks, and sophisticated host discovery techniques. Its continuous evolution has solidified its place as a critical tool for network discovery and security auditing. Read More

    Microsoft to Discontinue Editor Browser Extensions

    Microsoft has announced the retirement of its Editor browser extensions for both Edge and Chrome, effective October 31, 2025. The company plans to integrate the AI-powered writing assistance features, such as grammar and spelling checks, directly into the native proofing tools of the Microsoft Edge browser. This move is intended to streamline the user experience and eliminate the need for a separate extension. Read More

    Mis-Issued TLS Certificates for 1.1.1.1 DNS Service Pose Security Risk

    A potential security threat has emerged after it was discovered that three TLS certificates for the 1.1.1.1 DNS service, operated by Cloudflare and APNIC, were mis-issued. The certificates were issued in May 2025 by a subordinate certificate authority but were not discovered until four months later. DNS over TLS (DoT) is a protocol that encrypts DNS queries to prevent eavesdropping and tampering, and the mis-issuance of certificates could undermine this security measure. Read More

    Google Services Experience Widespread Outages

    Several Google services, including Gmail and YouTube, experienced significant outages across parts of Europe and some U.S. cities on Thursday morning. Monitoring sites reported a surge in complaints from countries like Greece, Bulgaria, Serbia, and Romania. The disruptions affected both personal and professional activities for many users. The cause of the outage has not yet been publicly disclosed by Google. Read More

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post Weekly Cybersecurity News Recap : Palo Alto Networks, Zscaler, Jaguar Land Rover, and Cyber Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • 10 Best Cloud Penetration Testing Companies in 2025

    ·

    , , ,

    As more businesses migrate their infrastructure to the cloud, cloud penetration testing has become a critical service.

    Unlike traditional network tests, cloud pentesting focuses on unique attack vectors such as misconfigured services, insecure APIs, and overly permissive IAM (Identity and Access Management) policies.

    In 2025, the best companies in this field combine deep knowledge of cloud-native vulnerabilities with a flexible, platform-driven approach to provide continuous, actionable security insights.

    Why We Choose It

    Cloud environments, particularly multi-cloud setups, present a complex security challenge.

    Misconfigurations are the leading cause of cloud security breaches, and automated scanners often miss the subtle, exploitable flaws in how services are connected or configured.

    Cloud penetration testing goes beyond automated scans by simulating a real-world attacker’s mindset.

    Expert pentesters exploit weaknesses in Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure, uncovering critical vulnerabilities that could lead to data theft, service disruption, or unauthorized access.

    How We Choose The Best Cloud Penetration Testing Companies in 2025

    We selected the top cloud penetration testing companies for 2025 based on three key criteria:

    • Experience & Expertise (E-E): We looked for companies with a proven track record, a deep understanding of cloud service provider (CSP) nuances, and a history of discovering and responsibly disclosing cloud vulnerabilities.
    • Authoritativeness & Trustworthiness (A-T): We considered market leadership, industry recognition, and the reputation of their offensive security teams.
    • Feature-Richness: We assessed the comprehensiveness of their platforms and services, looking for capabilities in:
    • CSP-Specific Expertise: The ability to test for vulnerabilities unique to AWS, Azure, and GCP.
    • Continuous Testing: A platform or service model that allows for ongoing security validation as the cloud environment changes.
    • Advanced Reconnaissance: The capability to discover all publicly exposed cloud assets.
    • Actionable Reporting: Clear, prioritized reports with detailed remediation guidance and re-testing options.

    Comparison Of Key Features in 2025

    CompanyCSP-Specific ExpertiseContinuous TestingAdvanced ReconnaissanceActionable Reporting
    NetSPI✅ Yes✅ Yes✅ Yes✅ Yes
    Bishop Fox✅ Yes✅ Yes✅ Yes✅ Yes
    Synack✅ Yes✅ Yes✅ Yes✅ Yes
    Rhino Security Labs✅ Yes❌ No✅ Yes✅ Yes
    Astra Security✅ Yes✅ Yes✅ Yes✅ Yes
    Praetorian✅ Yes✅ Yes✅ Yes✅ Yes
    Coalfire✅ Yes✅ Yes✅ Yes✅ Yes
    Pentera Cloud✅ Yes✅ Yes✅ Yes✅ Yes
    TrustedSec✅ Yes❌ No✅ Yes✅ Yes
    Cobalt.io✅ Yes✅ Yes✅ Yes✅ Yes

    Top 10 Best Cloud Penetration Testing Companies in 2025

    • NetSPI
    • Bishop Fox
    • Synack
    • Rhino Security Labs
    • Astra Security
    • Praetorian
    • Coalfire
    • Pentera Cloud
    • TrustedSec
    • Cobalt.io

    1. NetSPI

    cloud penetration testing
    NetSPI

    NetSPI is a leader in cloud penetration testing, distinguished by its PTaaS (Penetration Testing as a Service) platform, Resolve.

    Its team of experts specializes in finding vulnerabilities in multi-cloud environments, including misconfigurations, overly permissive access, and flaws in container security.

    NetSPI’s platform provides real-time visibility into findings, making the entire testing process more efficient and collaborative.

    The company’s work with 9 out of 10 of the top banks in the US and the largest cloud providers highlights their trusted expertise.

    Why You Want to Buy It:

    NetSPI’s Resolve platform streamlines the entire pentest workflow, from scoping to remediation. This makes it an ideal choice for organizations that need to centralize their security findings and measure progress over time.

    FeatureYes/NoSpecification
    CSP-Specific Expertise✅ YesSpecialists in AWS, Azure, and GCP.
    Continuous Testing✅ YesPTaaS model with continuous testing and real-time findings.
    Advanced Reconnaissance✅ YesComprehensive external asset discovery.
    Actionable Reporting✅ YesIn-platform collaboration and detailed reports.

    ✅ Best For: Large enterprises that need a scalable, continuous, and platform-driven approach to cloud security.

    Try NetSPI here → NetSPI Official Website

    2. Bishop Fox

    cloud penetration testing
    Bishop Fox

    Bishop Fox is a top-tier offensive security firm with a strong reputation for its Cloud Penetration Testing services.

    The company’s team of highly creative and technical experts, known as “The Fox,” uses cutting-edge, proprietary and open-source tools to simulate real-world attacks.

    They excel at identifying complex misconfigurations and attack pathways, providing a truly realistic assessment of an organization’s cloud defenses.

    Why You Want to Buy It:

    Bishop Fox’s expertise is unmatched. Their testers go beyond standard checks to find sophisticated vulnerabilities that automated tools and less-experienced firms would miss.

    They provide insights into the most critical and exploitable attack paths.

    FeatureYes/NoSpecification
    CSP-Specific Expertise✅ YesDeep expertise across all major CSPs.
    Continuous Testing✅ YesOffers a continuous attack surface testing (CAST) model.
    Advanced Reconnaissance✅ YesIn-depth discovery of cloud-related attack paths.
    Actionable Reporting✅ YesTailored executive and technical reports with prioritized findings.

    ✅ Best For: Organizations that need a highly customized and technically deep-dive cloud security assessment from one of the most respected offensive security firms.

    Try Bishop Fox here → Bishop Fox Official Website

    3. Synack

    cloud pentest companies
    Synack

    Synack pioneered the PTaaS model and applies its crowdsourced approach to cloud security.

    The company can deploy a diverse community of vetted ethical hackers to test cloud environments, providing broader coverage and finding more vulnerabilities in less time than a small, static team.

    Synack’s platform can integrate with AWS, Azure, and GCP to automatically detect changes and launch on-demand tests, making it a highly agile solution.

    Why You Want to Buy It:

    Synack’s model offers unparalleled scalability and speed. The ability to have multiple researchers from around the world testing your cloud environment simultaneously provides a comprehensive, 24/7 security posture.

    FeatureYes/NoSpecification
    CSP-Specific Expertise✅ YesIntegrations with AWS, Azure, and GCP.
    Continuous Testing✅ YesOn-demand and continuous testing via the Synack Platform.
    Advanced Reconnaissance✅ YesContinuous asset discovery with AI-powered validation.
    Actionable Reporting✅ YesReal-time reporting and patch verification on the platform.

    ✅ Best For: Companies that need continuous, on-demand cloud testing and want to leverage the power of a vast, crowdsourced community of elite hackers.

    Try Synack here → Synack Official Website

    4. Rhino Security Labs

    cloud pentest companies
    Rhino Security Labs

    Rhino Security Labs is a highly specialized cloud penetration testing company, widely recognized for its deep expertise in AWS, Azure, and GCP.

    The company’s research team has a history of discovering and publishing high-profile cloud vulnerabilities and tools, such as the Pacu cloud exploitation framework.

    This research-driven approach ensures that their tests are always up-to-date with the latest attack techniques.

    Why You Want to Buy It:

    Rhino Security Labs’ services are based on a foundation of cutting-edge research, meaning they’ll uncover vulnerabilities that are not yet widely known.

    They are experts in attacking the cloud from the perspective of a sophisticated threat actor.

    FeatureYes/NoSpecification
    CSP-Specific Expertise✅ YesCore specialization in AWS, Azure, and GCP.
    Continuous Testing❌ NoFocuses on traditional, time-boxed engagements.
    Advanced Reconnaissance✅ YesIn-depth cloud asset enumeration.
    Actionable Reporting✅ YesDetailed reports with clear remediation guidance.

    ✅ Best For: Organizations with complex cloud environments that want to work with a firm known for its deep technical expertise and contributions to cloud security research.

    Try Rhino Security Labs here → Rhino Security Labs Official Website

    5. Astra Security

    cloud security testing
    Astra Security

    Astra Security offers a comprehensive Cloud Pentest Suite that combines automated scanning with expert human analysis.

    The company’s platform runs over 13,000 automated security tests and compliance checks, which are then validated by human pentesters.

    This hybrid approach ensures both the speed of automation and the depth of human expertise, making it a highly efficient solution for continuous cloud security.

    Why You Want to Buy It:

    Astra’s blend of automation and manual testing makes it a cost-effective and efficient way to secure your cloud assets.

    The platform simplifies vulnerability management and provides clear, developer-friendly reports to speed up remediation.

    FeatureYes/NoSpecification
    CSP-Specific Expertise✅ YesSupports AWS, Azure, and GCP.
    Continuous Testing✅ YesPTaaS platform with continuous vulnerability scanning.
    Advanced Reconnaissance✅ YesDiscovers and maps cloud infrastructure.
    Actionable Reporting✅ YesDetailed reports with step-by-step remediation advice.

    ✅ Best For: Small to medium-sized businesses and agile development teams that need a fast, affordable, and continuous cloud security solution.

    Try Astra Security here → Astra Security Official Website

    6. Praetorian

    cloud security testing
    Praetorian

    Praetorian is an offensive cybersecurity company that provides expert-led cloud penetration testing services. They use an adversarial mindset to help organizations prioritize and reduce material risks in their cloud environments.

    Praetorian’s services are designed to go beyond simple compliance, focusing on uncovering exploitable vulnerabilities that are most likely to be leveraged by real-world attackers.

    The company also offers Continuous Threat Exposure Management (CTEM) to maintain security over time.

    Why You Want to Buy It:

    Praetorian’s unique approach helps you optimize your security budget by focusing on the vulnerabilities that pose the greatest risk.

    Their expertise ensures that you’re not just finding flaws but understanding their potential impact on your business.

    FeatureYes/NoSpecification
    CSP-Specific Expertise✅ YesStrong expertise across all major CSPs.
    Continuous Testing✅ YesCTEM services for continuous security validation.
    Advanced Reconnaissance✅ YesIdentifies external attack surface and exploitable entry points.
    Actionable Reporting✅ YesProvides insights on material risk and strategic recommendations.

    ✅ Best For: Enterprises that want a strategic partner for offensive security, focusing on real-world risk reduction rather than just compliance.

    Try Praetorian here → Praetorian Official Website

    7. Coalfire

    cloud vulnerability assessment
    Coalfire

    Coalfire is a cybersecurity services firm with a strong focus on compliance, particularly for FedRAMP, PCI, and SOC 2.

    Its cloud penetration testing services are tailored to help organizations meet these stringent regulatory requirements while also strengthening their security posture.

    Coalfire’s experts assess cloud configurations, network segmentation, and application security to ensure that both technical and compliance standards are met.

    Why You Want to Buy It:

    Coalfire’s deep expertise in compliance and its history of working with federal and highly-regulated clients makes it an ideal partner for businesses that need to demonstrate their cloud security posture to auditors and regulators.

    FeatureYes/NoSpecification
    CSP-Specific Expertise✅ YesExpertise in cloud security for various compliance frameworks.
    Continuous Testing✅ YesOffers continuous testing as part of its managed services.
    Advanced Reconnaissance✅ YesIn-depth cloud asset discovery.
    Actionable Reporting✅ YesDetailed reports with a strong focus on compliance requirements.

    ✅ Best For: Organizations in highly regulated industries that need a cloud penetration test that meets strict compliance standards.

    Try Coalfire here → Coalfire Official Website

    8. Pentera Cloud

    cloud vulnerability assessment
    Pentera Cloud

    Pentera Cloud offers a unique, automated security validation and one of the core cloud penetration testing companies platform that simulates cloud-native attacks.

    Unlike manual penetration testing, Pentera’s solution continuously challenges an organization’s cloud environment, finding exploitable misconfigurations and attack paths without the need for human intervention.

    The platform provides a hybrid test, identifying attack vectors that extend across both cloud and on-premises environments.

    Why You Want to Buy It:

    Pentera Cloud provides a continuous, always-on security assessment, making it an excellent tool for organizations with rapidly changing cloud environments.

    Its ability to find exploitable kill-chains between on-premises and cloud systems is a key advantage.

    FeatureYes/NoSpecification
    CSP-Specific Expertise✅ YesAutomated testing for cloud-native vulnerabilities.
    Continuous Testing✅ YesContinuous security validation and attack emulation.
    Advanced Reconnaissance✅ YesMaps cloud workloads, databases, and identities.
    Actionable Reporting✅ YesEvidence-based remediation reports.

    ✅ Best For: Organizations that need to continuously validate their cloud security controls with an automated, hybrid approach.

    Try Pentera Cloud here → Pentera Cloud Official Website

    9. TrustedSec

    AWS penetration testing, Azure penetration testing
    TrustedSec

    TrustedSec is a well-regarded cybersecurity consulting firm known for its expert-led, hands-on penetration testing services.

    Their approach to cloud security is highly customized, with consultants simulating real-world cyberattacks on AWS, Azure, and GCP environments.

    TrustedSec is renowned for its detailed reporting and a strong focus on providing clear, prioritized remediation guidance.

    Why You Want to Buy It:

    TrustedSec’s reputation is built on the expertise of its consultants. If you want a thorough, hands-on assessment from a firm that prioritizes a deep understanding of your unique environment, TrustedSec is an excellent choice.

    FeatureYes/NoSpecification
    CSP-Specific Expertise✅ YesSpecialists in AWS, Azure, and GCP.
    Continuous Testing❌ NoFocuses on traditional, project-based engagements.
    Advanced Reconnaissance✅ YesConducts extensive cloud asset enumeration.
    Actionable Reporting✅ YesDetailed, technical reports with remediation advice.

    ✅ Best For: Companies that value a personalized, white-glove service from a team of highly-skilled and ethical hackers.

    Try TrustedSec here → TrustedSec Official Website

    10. Cobalt.io

    AWS penetration testing, Azure penetration testing
    Cobalt.io

    Cobalt.io is a pioneer of the PTaaS model, offering a platform that connects businesses with a global community of vetted security researchers.

    For cloud penetration testing, Cobalt’s platform enables organizations to quickly scope and launch engagements, providing access to specialized talent and accelerating the testing process.

    The platform centralizes all findings, making it easy to manage and track vulnerabilities.

    Why You Want to Buy It:

    Cobalt’s platform and crowdsourced model allow you to launch a cloud pentest in days, not months.

    The platform’s streamlined workflow and on-demand access to talent make it an efficient way to integrate security into your development lifecycle.

    FeatureYes/NoSpecification
    CSP-Specific Expertise✅ YesOffers network & cloud security testing.
    Continuous Testing✅ YesPTaaS model for on-demand and continuous engagements.
    Advanced Reconnaissance✅ YesIdentifies and tests the cloud attack surface.
    Actionable Reporting✅ YesIn-platform dashboards and bug reports.

    ✅ Best For: Fast-moving tech companies and agile teams that need a flexible, on-demand, and scalable solution for cloud penetration testing.

    Try Cobalt.io here → Cobalt.io Official Website

    Conclusion

    The cloud has fundamentally changed the landscape of cybersecurity, and cloud penetration testing is no longer a niche service it’s a necessity.

    The top firms in 2025 are those that have moved beyond traditional testing to embrace the complexities of multi-cloud environments, continuously evolving attack vectors, and the need for speed.

    While platforms like NetSPI, Synack, and Cobalt.io offer a modern, efficient PTaaS model, firms like Bishop Fox and Rhino Security Labs provide deep, research-backed expertise for the most critical of cloud environments.

    Your choice should align with your organization’s specific needs, whether that is continuous, automated validation, a deep-dive expert assessment, or compliance-focused testing.

    The post 10 Best Cloud Penetration Testing Companies in 2025 appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Top 10 Best AI Penetration Testing Companies in 2025

    ·

    , , ,

    AI is no longer just a buzzword; it’s a fundamental part of business operations, from customer service chatbots to complex financial models. However, this adoption has created a new and specialized attack surface.

    Traditional penetration testing, which focuses on network and application vulnerabilities, is insufficient to secure AI systems.

    AI penetration testing involves adversarial machine learning, prompt injection, and data poisoning to identify and exploit weaknesses unique to AI models and the infrastructure they run on.

    In 2025, these services are crucial for ensuring the security, reliability, and ethical use of AI.

    Why We Choose AI Penetration Testing

    AI systems are vulnerable to a new class of attacks that can corrupt their data, manipulate their behavior, or exfiltrate sensitive information.

    Attack vectors like prompt injection, where malicious input is crafted to bypass safety filters, or model poisoning, where training data is manipulated to introduce backdoors, are not addressed by conventional security tools.

    AI penetration testing provides a proactive way to discover these vulnerabilities and build resilient, trustworthy AI systems, protecting against financial, reputational, and regulatory risks.

    How We Choose It

    To compile this list, we evaluated each company based on three key criteria:

    Experience & Expertise (E-E): We focused on companies with deep research capabilities in AI security, a track record of discovering novel AI vulnerabilities, and teams composed of both security experts and data scientists.

    Authoritativeness & Trustworthiness (A-T): We considered their market leadership, their contributions to AI security frameworks like OWASP, and the trust they have earned from enterprise clients.

    Feature-Richness: We assessed the breadth and depth of their service offerings, looking for capabilities in:

    Adversarial AI Testing: The ability to test for vulnerabilities like data poisoning and evasion attacks.

    LLM Red Teaming: Specialized testing for Large Language Models (LLMs) to find prompt injection and data exfiltration flaws.

    “Shift-Left” Integration: The ability to integrate security into the AI development lifecycle (MLSecOps).

    Comprehensive Coverage: Testing for vulnerabilities in the entire AI stack, from data to model to application.

    Comparison Of Key Features (2025)

    CompanyAdversarial AI TestingLLM Red TeamingShift-Left IntegrationComprehensive Coverage
    CalypsoAI✅ Yes✅ Yes✅ Yes✅ Yes
    HiddenLayer✅ Yes✅ Yes✅ Yes✅ Yes
    Mindgard✅ Yes✅ Yes✅ Yes✅ Yes
    Lakera✅ Yes✅ Yes✅ Yes✅ Yes
    Protect AI✅ Yes✅ Yes✅ Yes✅ Yes
    Robust Intelligence✅ Yes✅ Yes✅ Yes✅ Yes
    Prompt Security❌ No✅ Yes❌ No❌ No
    SplxAI✅ Yes✅ Yes✅ Yes✅ Yes
    HackerOne✅ Yes✅ Yes✅ Yes✅ Yes
    Trail of Bits✅ Yes✅ Yes✅ Yes✅ Yes

    1. CalypsoAI

    AI penetration testing
    CalypsoAI

    CalypsoAI is a market leader in AI security, with a platform built to test and defend against attacks on AI models.

    Its flagship product, the Inference Red-Team solution, automates the discovery of vulnerabilities through real-world attack simulations.

    The company’s expertise is highlighted by its CalypsoAI Security Leaderboard, which ranks major AI models on their security performance, providing a transparent, data-driven view of risk.

    Why You Want to Buy It:

    CalypsoAI offers a unique, automated red-teaming capability that identifies hidden weaknesses and provides a quantifiable security score for AI models.

    This allows organizations to build governance and compliance into their AI systems from the very beginning.

    FeatureYes/NoSpecification
    Adversarial AI Testing✅ YesAutomated red-teaming for real-world attack simulations.
    LLM Red Teaming✅ YesSpecializes in testing for vulnerabilities in GenAI and agents.
    Shift-Left Integration✅ YesIntegrates into the SDLC for continuous security testing.
    Comprehensive Coverage✅ YesSecures the full AI lifecycle, from development to production.

    ✅ Best For: Enterprises that need a purpose-built platform to test and secure mission-critical AI applications and agents against advanced, automated attacks.

    Try CalypsoAI here → CalypsoAI Official Website

    2. HiddenLayer

    AI penetration testing
    HiddenLayer

    HiddenLayer is a specialized AI security company focused on MLSecOps, the practice of integrating security into machine learning operations.

    Its platform provides a robust detection and response capability by monitoring models at runtime.

    HiddenLayer’s AI threat landscape reports and research demonstrate a deep understanding of evolving threats, including adversarial attacks and data poisoning, making it a key player in the space.

    Why You Want to Buy It:

    HiddenLayer provides a critical layer of defense for live AI systems. Its platform can detect and respond to attacks that bypass pre-deployment testing, ensuring the integrity and security of models once they are in production.

    FeatureYes/NoSpecification
    Adversarial AI Testing✅ YesSpecializes in detecting adversarial attacks.
    LLM Red Teaming✅ YesProvides red-teaming services for generative AI.
    Shift-Left Integration✅ YesPart of the MLSecOps workflow.
    Comprehensive Coverage✅ YesProtects AI systems from development to production.

    ✅ Best For: Organizations with mature ML teams that need a dedicated platform to monitor and protect AI models at runtime against adversarial attacks.

    Try HiddenLayer here → HiddenLayer Official Website

    3. Mindgard

    adversarial AI testing
    Mindgard

    Mindgard is a leader in AI Security Testing, a category recognized by Gartner as an emerging innovation.

    Founded in a leading UK university lab, the company’s platform, DAST-AI, is designed to find AI-specific vulnerabilities that traditional AppSec tools miss.

    Mindgard’s expertise is built on over a decade of rigorous AI security research and a vast threat intelligence database of attack scenarios.

    Why You Want to Buy It:

    Mindgard offers a solution that is built from the ground up to address the unique challenges of AI security.

    Its DAST-AI platform reduces testing times from months to minutes, enabling security teams to continuously identify and mitigate risks throughout the AI lifecycle.

    FeatureYes/NoSpecification
    Adversarial AI Testing✅ YesDAST-AI identifies AI-specific runtime vulnerabilities.
    LLM Red Teaming✅ YesSpecializes in testing LLMs and agentic AI.
    Shift-Left Integration✅ YesIntegrates seamlessly into existing CI/CD pipelines.
    Comprehensive Coverage✅ YesCovers a wide range of AI models, including image and audio.

    ✅ Best For: Forward-looking security teams that need a dedicated, purpose-built platform for offensive security testing of AI systems, from chatbots to complex agents.

    Try Mindgard here → Mindgard Official Website

    4. Lakera

    adversarial AI testing
    Lakera

    Lakera offers a comprehensive platform for securing GenAI applications. Its solution is divided into two parts: Lakera Red, for automated red teaming during development, and Lakera Guard, for real-time runtime protection.

    The company’s contributions to the OWASP Top 10 for LLMs (2025) and the AI Vulnerability Scoring System demonstrate its deep involvement in shaping the industry’s security standards.

    Why You Want to Buy It:

    Lakera provides an end-to-end security solution for GenAI, ensuring that vulnerabilities are uncovered before deployment and that live applications are protected against real-time threats like prompt injection and data leakage.

    FeatureYes/NoSpecification
    Adversarial AI Testing✅ YesLakera Red simulates real-world attacks.
    LLM Red Teaming✅ YesAutomated and continuous LLM testing.
    Shift-Left Integration✅ YesIntegrates with development workflows.
    Comprehensive Coverage✅ YesCovers development and runtime stages.

    ✅ Best For: Organizations that need to secure GenAI applications with a two-pronged approach: proactive testing during development and robust protection at runtime.

    Try Lakera here → Lakera Official Website

    5. Protect AI

    AI red teaming
    Protect AI

    Protect AI is a key player in AI security, offering a comprehensive platform to discover, manage, and protect against AI-specific security risks.

    Its solutions focus on securing the entire AI development lifecycle, from model scanning to GenAI runtime security and posture management.

    The company’s expertise has led to its recent acquisition by Palo Alto Networks, which will integrate Protect AI’s capabilities into its Prisma Cloud platform.

    Why You Want to Buy It:

    Protect AI’s platform provides end-to-end security for AI systems, helping businesses meet enterprise requirements for model scanning, risk assessment, and posture management, ensuring they can deploy AI with confidence.

    FeatureYes/NoSpecification
    Adversarial AI Testing✅ YesSpecializes in AI-specific security risks.
    LLM Red Teaming✅ YesCovers GenAI runtime security.
    Shift-Left Integration✅ YesSecures the AI development lifecycle.
    Comprehensive Coverage✅ YesEnd-to-end security from development to runtime.

    ✅ Best For: Organizations that want an enterprise-grade AI security solution with a strong focus on securing the entire AI development and deployment lifecycle.

    Try Protect AI here → Protect AI Official Website

    6. Robust Intelligence

    AI red teaming
    Robust Intelligence

    Robust Intelligence is an AI security and red-teaming company that specializes in making AI models resilient and trustworthy.

    Their services are designed to address the unique fallibility of generative AI systems, which can be vulnerable to prompt injection, data leaks, and model manipulation.

    The company’s approach is similar to traditional security audits, but with a specific focus on the unique vulnerabilities of AI.

    Why You Want to Buy It:

    Robust Intelligence provides a highly specialized and methodical approach to AI security, adopting an attacker’s perspective to uncover hidden vulnerabilities.

    This is essential for organizations deploying AI in sensitive sectors like finance and healthcare.

    FeatureYes/NoSpecification
    Adversarial AI Testing✅ YesExpert-led AI red-teaming.
    LLM Red Teaming✅ YesSpecializes in testing generative AI.
    Shift-Left Integration✅ YesTests are integrated into the SDLC.
    Comprehensive Coverage✅ YesAudits the entire AI system, from data to model.

    ✅ Best For: Organizations that need a dedicated team to conduct in-depth, expert-led AI red-teaming and security audits.

    Try Robust Intelligence here → Robust Intelligence Official Website

    7. Prompt Security

    AI security platform
    Prompt Security

    Prompt Security is an AI security firm that specializes in the unique challenges posed by Large Language Models. Their services focus on AI red-teaming to identify vulnerabilities in homegrown AI applications.

    The company’s insights and predictions for 2025 highlight the rapid evolution of the security landscape, with AI-powered malware and new attack vectors becoming a critical concern.

    Why You Want to Buy It:

    Prompt Security offers highly focused expertise in LLM security, providing a direct solution for a major new attack vector. Their specialization ensures a deep understanding of the unique vulnerabilities that exist within LLM-based applications.

    FeatureYes/NoSpecification
    Adversarial AI Testing❌ NoFocus is primarily on prompt injection.
    LLM Red Teaming✅ YesSpecializes in LLM and agentic AI.
    Shift-Left Integration❌ NoFocus is on testing, not full SDLC integration.
    Comprehensive Coverage❌ NoHighly focused on LLMs.

    ✅ Best For: Organizations whose primary concern is the security of their large language models and the risks associated with prompt injection and data exfiltration.

    Try Prompt Security here → Prompt Security Official Website

    8. SplxAI

    AI security platform
    SplxAI

    SplxAI offers a platform that empowers organizations to adopt AI with confidence by proactively testing, hardening, and monitoring AI systems against advanced attacks.

    The company’s services include automated red-teaming for AI assistants and agents, as well as real-time monitoring. SplxAI’s solutions are designed to be integrated into the CI/CD pipeline, ensuring continuous security throughout the AI lifecycle.

    Why You Want to Buy It:

    SplxAI’s platform allows for continuous risk assessments, ensuring that AI apps remain protected against emerging attack vectors. It helps teams uncover and remediate vulnerabilities before launching GenAI apps into production.

    FeatureYes/NoSpecification
    Adversarial AI Testing✅ YesProvides automated risk assessments and red teaming.
    LLM Red Teaming✅ YesSpecializes in testing GenAI assistants and agents.
    Shift-Left Integration✅ YesIntegrates into the CI/CD pipeline.
    Comprehensive Coverage✅ YesCovers the entire AI application lifecycle.

    ✅ Best For: Organizations that need a platform to perform automated, continuous security validation on their AI applications and agents.

    Try SplxAI here → SplxAI Official Website

    9. HackerOne

    AI vulnerability assessment
    HackerOne

    While best known for its bug bounty platform, HackerOne has become a key player in AI security by offering a managed service for AI red teaming.

    The company leverages its vast community of security researchers to find and fix AI vulnerabilities, including prompt injection, data leakage, and training data poisoning.

    Their platform provides a streamlined workflow for managing findings and collaborating with researchers.

    Why You Want to Buy It:

    HackerOne’s platform provides a scalable and efficient way to conduct AI red teaming. By tapping into a global network of specialists, organizations can get a comprehensive test for a wide range of AI vulnerabilities in less time.

    FeatureYes/NoSpecification
    Adversarial AI Testing✅ YesLeverages a community of security researchers.
    LLM Red Teaming✅ YesOffers managed services for LLM testing.
    Shift-Left Integration✅ YesProvides a platform for vulnerability management.
    Comprehensive Coverage✅ YesCovers both AI and traditional application security.

    ✅ Best For: Companies that want to leverage the power of a crowdsourced community of elite hackers to find AI-specific vulnerabilities.

    Try HackerOne here → HackerOne Official Website

    10. Trail Of Bits

    AI vulnerability assessment
    Trail Of Bits

    Trail of Bits is a highly respected cybersecurity firm known for its deep technical expertise and research-driven approach. The company has a strong reputation for securing some of the world’s most critical systems, including blockchain and AI.

    Its AI security services combine high-end research with a real-world attacker mentality to find and fix fundamental vulnerabilities in AI models and the infrastructure they rely on.

    Why You Want to Buy It:

    Trail of Bits’s expertise goes beyond standard testing. They are not just finding vulnerabilities; they are fixing the underlying software and architecture.

    Their ability to uncover critical flaws in hardened systems makes them a trusted partner for securing high-value AI assets.

    FeatureYes/NoSpecification
    Adversarial AI Testing✅ YesResearch-driven and highly technical.
    LLM Red Teaming✅ YesConducts in-depth security assessments.
    Shift-Left Integration✅ YesSupports secure software development.
    Comprehensive Coverage✅ YesSpecializes in securing the entire AI stack.

    ✅ Best For: Organizations that need a deep, technical security assessment from a firm with a world-class reputation for research and ethical hacking.

    Try Trail of Bits here → Trail of Bits Official Website

    Conclusion

    As AI becomes more integrated into our digital infrastructure, AI penetration testing is rapidly becoming an essential component of a robust security strategy.

    The companies on this list represent the top tier of a new and growing industry, combining cutting-edge research with practical, real-world testing.

    Companies like CalypsoAI, Mindgard, and Lakera stand out for their purpose-built, automated platforms that are specifically designed to address the unique threats to AI systems.

    Meanwhile, established players like HackerOne and Trail of Bits are leveraging their existing expertise and reputation to provide world-class AI security services.

    The right choice depends on your organization’s needs: whether you need a specialized platform for continuous testing, an expert-led assessment for a mission-critical model, or a scalable, crowdsourced solution.

    All of these providers, however, offer the necessary expertise to protect your AI investments from the next generation of cyber threats.

    The post Top 10 Best AI Penetration Testing Companies in 2025 appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • 10 Best Web Application Penetration Testing Companies in 2025

    ·

    , , , , ,

    Securing web applications is a top priority for businesses in 2025 as they’re a primary attack vector for cybercriminals. Web application penetration testing goes beyond automated scanning to use human expertise and a hacker’s mindset to find complex vulnerabilities that automated tools miss, such as business logic flaws and multi-step exploits. A great pen-test provides […]

    The post 10 Best Web Application Penetration Testing Companies in 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Noisy Bear Targets Kazakhstan Energy Sector With BarrelFire Phishing Campaign

    ·

    A threat actor possibly of Russian origin has been attributed to a new set of attacks targeting the energy sector in Kazakhstan. The activity, codenamed Operation BarrelFire, is tied to a new threat group tracked by Seqrite Labs as Noisy Bear. The threat actor has been active since at least April 2025. “The campaign is targeted towards employees of KazMunaiGas or KMG where the threat entity

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Critical Argo CD API Vulnerability Exposes Repository Credentials

    ·

    , , ,

    A critical vulnerability has been discovered in Argo CD that allows API tokens with limited permissions to access sensitive repository credentials.

    The flaw in the project details API endpoint exposes usernames and passwords, undermining the platform’s security model by granting access to secrets without explicit permissions.

    The vulnerability stems from an improper authorization check in the Project API, specifically the /api/v1/projects/{project}/detailed endpoint.

    According to the vulnerability details, API tokens with standard project-level permissions, such as those for managing applications, can retrieve all repository credentials associated with that project.

    The expected behavior is that any request for sensitive information, like secrets, would require explicit, elevated permissions. However, the actual behavior allows tokens with basic access to fetch this data.

    Exploitation

    This issue is not confined to project-specific roles. Any token holding project get permissions is considered vulnerable, including those with broader global permissions like p, role/user, projects, get, *, allow. This widens the potential attack surface significantly, as more general-purpose tokens could be used to exploit the flaw.

    Exploitation is straightforward. An attacker in possession of a valid API token with the necessary permissions can make a simple authenticated call to the detailed project API endpoint.

    The resulting JSON response will incorrectly include an repositories object containing plaintext username and password credentials for the repositories connected to the project. This allows an attacker to easily harvest credentials that can be used to access private source code repositories.

    The consequences of this vulnerability are severe, as exposed credentials could lead to source code theft, malicious code injection into the CI/CD pipeline, and further compromise of development infrastructure.

    The Argo CD development team has addressed the issue and released patches. Administrators are strongly advised to upgrade their instances to one of the following secure versions immediately to mitigate the risk:

    • v3.1.2
    • v3.0.14
    • v2.14.16
    • v2.13.9

    Upgrading to a patched version will ensure that the API endpoint properly enforces permission checks and prevents the unauthorized disclosure of repository credentials.

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post Critical Argo CD API Vulnerability Exposes Repository Credentials appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • “GPUGate” Malware Abuses Google Ads and GitHub to Deliver Advanced Malware Payload

    ·

    , , ,

    A sophisticated malware campaign, dubbed “GPUGate,” abuses Google Ads and GitHub’s repository structure to trick users into downloading malicious software.

    The Arctic Wolf Cybersecurity Operations Center, the attack chain uses a novel technique to evade security analysis by leveraging a computer’s Graphics Processing Unit (GPU).

    The campaign appears to be the work of a Russian-speaking threat actor and is actively targeting IT professionals in Western Europe.

    The attack begins with malicious advertising, where attackers place a sponsored ad at the top of Google search results for terms like “GitHub Desktop.” This ad directs users to what appears to be a legitimate GitHub page.

    Google search results for GitHub Desktop
    Google search results for GitHub Desktop

    In reality, the link leads to a specific, manipulated “commit” page within a repository. This page looks authentic, retaining the repository’s name and metadata, but contains altered download links that point to an attacker-controlled domain.

    This “trust bridge” exploits the user’s confidence in both Google and GitHub to deliver the malicious payload.

    What makes GPUGate particularly notable is its unique evasion method. The initial installer is a large 128 MB file, designed to bypass security sandboxes that often have file size limits.

    weaponized GitHub Desktop
    weaponized GitHub Desktop

    Its most innovative feature is a GPU-gated decryption routine. The malware will only decrypt its malicious payload if it detects a real, physical GPU with a device name longer than ten characters, Arctic Wolf said.

    This is a deliberate tactic to thwart analysis, as the virtual machines and sandboxes used by security researchers often have generic, short GPU names or no GPU at all. On such systems, the payload remains encrypted and inert.

    The primary goal of this campaign is to gain initial access to organizational networks for malicious activities, including credential theft, data exfiltration, and ransomware deployment.

    By targeting developers and IT workers, individuals likely to seek tools like GitHub Desktop, the attackers aim for victims with elevated network privileges.

    Once executed, the malware uses a PowerShell script to gain administrative rights, create scheduled tasks for persistence, and add exclusions to Windows Defender to avoid detection. The campaign has been active since at least December 2024 and represents an evolving and significant threat.

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post “GPUGate” Malware Abuses Google Ads and GitHub to Deliver Advanced Malware Payload appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Malicious npm Packages Impersonate Flashbots, Steal Ethereum Wallet Keys

    ·

    A new set of four malicious packages have been discovered in the npm package registry with capabilities to steal cryptocurrency wallet credentials from Ethereum developers. “The packages masquerade as legitimate cryptographic utilities and Flashbots MEV infrastructure while secretly exfiltrating private keys and mnemonic seeds to a Telegram bot controlled by the threat actor,” Socket researcher

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Kali Linux vs Parrot OS – Which Penetration Testing Platform is Most Suitable for Cybersecurity Professionals?

    ·

    , , ,

    Penetration testing and ethical hacking have been dominated by specialized Linux distributions designed to provide security professionals with comprehensive toolsets for vulnerability assessment and network analysis.

    Among the most prominent options, Kali Linux and Parrot OS have emerged as leading contenders, each offering unique approaches to cybersecurity operations.

    This comprehensive analysis reveals that while Kali Linux maintains its position as the industry standard with superior community support and extensive documentation, Parrot OS presents compelling advantages in terms of resource efficiency, user-friendliness, and privacy-focused features that make it increasingly attractive for both beginners and professionals working with limited hardware resources.

    Understanding Kali Linux

    Kali Linux represents the gold standard in penetration testing distributions, developed by Offensive Security as a Debian-based system specifically engineered for cybersecurity professionals.

    The distribution emerged as the successor to BackTrack OS and has maintained its reputation through consistent updates and comprehensive tool integration.

    The latest Kali Linux 2025.2 update demonstrates the distribution’s commitment to staying current with emerging threats, incorporating 11 new tools, including goshs, graudit, hekatomb, and netexec, which address modern attack surfaces and cloud security challenges.

    The system’s architecture prioritizes functionality over aesthetics, utilizing XFCE as the default desktop environment to maintain resource efficiency while providing a robust platform for security operations.

    This design choice reflects Kali’s philosophy of creating a professional-grade environment that prioritizes performance and tool accessibility over visual appeal.

    Kali Linux ships with over 600 pre-installed penetration testing tools, carefully curated to cover the complete spectrum of security assessment activities.

    The toolset spans multiple categories, including network scanning, vulnerability analysis, exploitation frameworks, digital forensics, and post-exploitation utilities. Notable tools include the Metasploit Framework for exploitation testing, Burp Suite for web application security assessment, Nmap for network discovery, and Wireshark for protocol analysis.

    The distribution’s strength lies in its comprehensive coverage of penetration testing methodologies, with tools organized into logical categories that align with industry-standard testing procedures.

    The inclusion of cutting-edge tools such as Sqlmc for SQL injection testing, Sprayhound for password spraying integrated with Bloodhound, and Obsidian for documentation purposes demonstrates Kali’s commitment to addressing evolving security challenges.

    Kali Linux demands substantial system resources to operate effectively, requiring a minimum of 2 GB RAM with 4 GB recommended for optimal performance. Storage requirements are equally demanding, with 20+ GB needed for a complete installation. The distribution requires modern hardware capabilities, including graphics acceleration for certain operations, making it less suitable for older or resource-constrained systems.

    Despite these requirements, Kali Linux has made efforts to optimize performance, including the transition from GNOME to XFCE in 2019 to reduce resource consumption. The system supports various deployment scenarios, from bare metal installations to virtual machine environments, providing flexibility for different operational needs.

    Understanding Parrot OS

    Parrot OS emerged in 2013 under the leadership of Lorenzo Faletra, positioning itself as a security-focused distribution that balances comprehensive functionality with resource efficiency. Unlike Kali’s singular focus on penetration testing, Parrot OS adopts a broader approach, integrating security tools with privacy protection, digital forensics capabilities, and development environments.

    The distribution utilizes the MATE desktop environment as its default interface, providing an intuitive and lightweight experience that remains accessible to users across different skill levels. This design choice reflects Parrot’s commitment to creating a user-friendly environment that doesn’t sacrifice functionality for ease of use.

    Parrot OS distinguishes itself through its holistic approach to cybersecurity, offering not only penetration testing tools but also integrated privacy and anonymity features.

    The distribution includes over 600 tools covering penetration testing, digital forensics, cryptography, and privacy protection. Key privacy tools include Tor Browser, AnonSurf for traffic anonymization, and Zulu Crypt for encryption operations.

    The system’s tool selection mirrors much of Kali’s functionality while adding unique capabilities focused on privacy protection and secure communications. Tools like ExifTool for metadata analysis, Maltego for intelligence gathering, and Volatility for memory forensics provide comprehensive coverage of modern security assessment needs.

    One of Parrot OS’s most significant advantages lies in its exceptional resource efficiency. The distribution requires only 320 MB RAM minimum, with 2 GB recommended for optimal operation. Storage requirements are equally modest at 15+ GB, making it suitable for deployment on older or resource-constrained hardware.

    This efficiency extends to its overall performance characteristics, with Parrot OS demonstrating superior performance on systems with limited resources while maintaining full functionality.

    The distribution’s ability to operate effectively on older hardware makes it particularly attractive for educational environments and organizations with budget constraints.

    Kali Linux vs Parrot OS comparison
    Kali Linux vs Parrot OS comparison

    Direct Performance and Feature Comparison

    System Resource Analysis

    The most striking difference between these distributions lies in their resource consumption patterns. Kali Linux demands significantly more system resources, requiring 2 GB RAM minimum compared to Parrot OS’s 320 MB minimum. This disparity becomes more pronounced in storage requirements, with Kali needing 20+ GB versus Parrot’s 15+ GB.

    Performance testing reveals that Parrot OS consistently outperforms Kali Linux on identical hardware configurations, particularly on systems with limited resources. This efficiency advantage makes Parrot OS particularly suitable for virtual machine deployments where resource allocation is constrained.

    Tool Coverage and Specialization

    Both distributions offer comprehensive tool coverage with over 600 pre-installed applications, but their focus areas differ significantly. Kali Linux concentrates primarily on penetration testing and security auditing tools, with recent updates adding specialized tools for emerging attack vectors and cloud security. The distribution’s tool selection reflects its professional focus, with each tool carefully vetted for reliability and effectiveness in security assessments.

    Parrot OS provides similar penetration testing capabilities while expanding coverage to include privacy tools, cryptographic utilities, and digital forensics applications. The distribution’s unique privacy-focused tools, including AnonSurf and integrated Tor functionality, set it apart from Kali’s more traditional approach.

    Community Support and Documentation

    Kali Linux benefits from extensive community support backed by Offensive Security’s professional development team. The distribution’s documentation is comprehensive, covering everything from installation procedures to advanced exploitation techniques. The large user base ensures rapid problem resolution and extensive third-party resources.

    Parrot OS maintains an active but smaller community focused on collaborative development and user support. While the community is enthusiastic and responsive, the resource base is more limited compared to Kali’s extensive ecosystem. Documentation quality is good but less comprehensive than Kali’s extensive knowledge base.

    Security Professionals Usage

    Kali Linux maintains its position as the industry standard for professional penetration testing, with many cybersecurity certifications specifically requiring Kali proficiency.

    The OSCP (Offensive Security Certified Professional) certification, widely regarded as a premier penetration testing credential, mandates Kali Linux usage throughout the examination process.

    Professional security teams consistently choose Kali Linux for formal assessments due to its reputation, comprehensive documentation, and industry acceptance. The distribution’s regular updates and professional backing provide confidence in enterprise environments where reliability is paramount.

    Kali Linux presents a steeper learning curve, requiring significant technical expertise to utilize effectively. The distribution’s command-line intensive approach and extensive tool selection can overwhelm beginners, making it more suitable for experienced professionals.

    Parrot OS offers a more accessible entry point for cybersecurity education, with its user-friendly interface and intuitive organization making it ideal for students and professionals transitioning into security roles. The distribution’s emphasis on usability doesn’t compromise its professional capabilities, providing a balanced learning environment.

    Kali Linux excels in formal penetration testing scenarios, professional security assessments, and environments where industry-standard compliance is required. Its comprehensive tool coverage and regular updates make it ideal for security consultants and enterprise security teams.

    Parrot OS demonstrates superior performance in resource-constrained environments, privacy-focused operations, and educational settings. The distribution’s lightweight nature and privacy tools make it particularly suitable for research activities and situations requiring operational security.

    The cybersecurity landscape continues evolving with new attack vectors, cloud security challenges, and IoT vulnerabilities requiring specialized tools and approaches. Kali Linux 2025.2 addresses these challenges with new tools specifically designed for modern threat landscapes, including hekatomb for credential extraction and netexec for large network exploitation.

    Parrot OS responds to privacy concerns and surveillance issues by strengthening its anonymity features and secure communication tools. The distribution’s focus on privacy protection aligns with growing concerns about digital surveillance and data protection.

    Modern cybersecurity operations increasingly rely on virtual environments, cloud deployments, and resource-efficient solutions. Parrot OS positions itself advantageously in this trend through its exceptional resource efficiency and virtual machine optimization.

    The distribution’s ability to operate effectively on minimal resources makes it ideal for cloud-based security operations and containerized deployments.

    Kali Linux addresses these trends through improved virtualization support and ARM architecture compatibility, though its resource requirements remain higher than those of alternatives.

    Recommendations

    The choice between Kali Linux and Parrot OS ultimately depends on specific operational requirements, available resources, and user expertise levels.

    Kali Linux remains the definitive choice for professional penetration testers, security consultants, and organizations requiring industry-standard compliance. Its comprehensive tool coverage, extensive documentation, and professional backing make it indispensable for formal security assessments and certification preparation.

    Parrot OS presents a compelling alternative for educational environments, resource-constrained operations, and privacy-focused activities. Its lightweight architecture, user-friendly interface, and comprehensive privacy tools make it particularly suitable for students, researchers, and professionals working in sensitive environments.

    For experienced cybersecurity professionals working in enterprise environments, Kali Linux provides the reliability, tool coverage, and industry acceptance necessary for professional operations. For beginners and privacy-conscious users, Parrot OS offers an accessible entry point with powerful capabilities and resource efficiency.

    Organizations with mixed requirements might benefit from deploying both distributions, utilizing Kali for formal assessments and Parrot for research and development activities.

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post Kali Linux vs Parrot OS – Which Penetration Testing Platform is Most Suitable for Cybersecurity Professionals? appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Army picks startup Rivet to build AI-enabled soldier glasses

    ·

    The future of soldier “super goggles,” designed to give frontline troops an AI-enabled view of the battlefield and voice command over drone swarms, is unlikely to look like the bulky, Star Wars-style face computer that might come to mind. Instead, the new tech may look more like the glasses you could see on patrons in a Brooklyn coffee shop, according to the company chosen to make them.

    The Army has awarded a $200 million contract to a startup called Rivet to develop prototype computers, goggles, and watches to give soldiers a battlefield intelligence edge, as part of the Soldier Borne Mission Command program. A joint team from tech giants Anduril and Meta will also design a prototype for consideration under a similar contract, according to people familiar with the matter.

    Palmer Luckey, founder of Anduril, hasn’t been shy about his hopes to become the supplier of hands-free augmented reality kits for soldiers and, from there, build out an entire human-machine “ecosystem” to connect operators to drones and AI aides. And as the creator of the Oculus virtual-reality game system, he has something of an advantage. A February blog post featured him with a lab prototype of the Anduril system that looks like something out of science fiction.

    But Rivet’s offering looks very different. Dave Marra, Rivet’s founder, told Defense One on Friday that his approach boils down to four words: “comfort, organization, utility, and compliance.”

    He sees his company’s prototype as a jumping-off point to connect soldiers with a wide array of AI capabilities through simple voice or other commands, as well as to connect logistics professionals, maintainers, and others with AI-enabled tools.

    “These kinds of natural language interactions are the most critical element to enable,” Marra said. “So you think, ‘I have to control robots, and I have to do it without significant training and learning. I want to recognize nouns on the battlefield that could be a target: that could be a good guy, a bad guy, or another noun on the factory floor. I want to identify anomalies, more importantly, correlate in these data sets.’"

    [[Related Posts]]

    The end result is real-time predictive intelligence delivered directly to the eye—information about how the battlefield is changing and might change, or, in another context, which part might break next and what to do about it. Eyewear that sees probabilities in the future.

    The project is part of the Army’s broader pursuit of soldier-borne smart systems, going back more than a decade, before even the Integrated Visual Augmentation System program, which essentially became SBMC. But prototypes from those efforts have faced a number of setbacks.

    Now, Rivet has created what it calls an “integrated task system.” It features a small computer soldiers carry, as well as glasses capable of night vision, map display, and a wide array of applications. They look like something you could buy at the mall. That’s part of the point. They were engineered to be useful in conditions where earlier soldier vision displays failed. 

    “If you’re wearing a pair of glasses on your face, they’ve got to conform to compliance measures for eye protection—not only from a ballistics perspective, but also adversarial lasers. You’re not going to be able to get that at Best Buy,” Marra said.

    The system also runs on Android, to better allow operators to configure features to suit their needs. That flexibility reflects the Pentagon’s new approach of pushing more command and purchasing authority down to individual units—the people actually using the equipment who need to adjust it for rapidly changing conditions.

    Marra said the company is working directly with soldiers to understand those conditions, beyond scheduled touch points. 

    “We’ve gone out and tested it at a high frequency with operational units at scale,” he said. “Over the next 18 months, we’re going to do exactly that. In fact, we’ve programmed every 45 or 90 days, we’re going to be out with a minimum of a squad’s worth of systems, a dozen systems, and we’re going to go do soldiering with the soldier. We’re going to hang out with them every minute of that 72-hour mission, or every minute of that training evolution, and take your feedback and put it into the next iterative loop of hardware and software development.”

    By contrast, Anduril’s offering is bolstered by the Lattice platform, an AI-powered software system that combines thousands of data streams into a single 3D interface. Lattice—more than the headset—is core to Luckey’s vision of building out the “human-machine ecosystem.”

    But Anduril is not alone in that space. Palantir has its own suite of battlefield data-integration products. Marra, who previously worked at Palantir, described that company as a “strategic partner.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶