Sullivan Rozar

Software Error Exposes Social Security Numbers and Business Data for Nearly Half a Year PayPal has notified customers of a data exposure incident tied to a software error in its PayPal Working Capital (PPWC) loan application, which left sensitive personal information accessible for nearly six months in 2025. According to breach notification letters, the exposure […]

Default VM Templates Enable Infrastructure That Blends Into Legitimate Hosting Sophos researchers have identified multiple ransomware and malware operations using virtual machines provisioned through ISPsystem to distribute malicious payloads and maintain command-and-control infrastructure. For organizations with complex cloud, SaaS, or third-party dependencies, this technique exposes a critical limitation, allowing infrastructure to appear clean on paper

Large-Scale Phishing Campaign Using Fake Payment and Storage Warnings Over the past few months, a large-scale cloud storage scam has flooded inboxes worldwide with phishing emails claiming accounts are about to be blocked or deleted due to failed payments. Based on numerous reviewed samples, the campaign has intensified, with some recipients now receiving multiple versions

New “Phishing-as-a-Service” Platforms Enable Attackers to Steal Okta SSO Credentials Okta has issued a warning about a new class of phishing platforms built specifically for voice-based social engineering attacks. These tools, now being actively used in campaigns, allow threat actors to steal single sign-on (SSO) credentials by manipulating victims during phone calls. Functioning as live

Public Exploit Code Accelerates Attacks Against Fortinet SIEM Deployments A critical vulnerability affecting Fortinet FortiSIEM is now being actively exploited in the wild, according to multiple security researchers. The flaw, tracked as CVE-2025-64155, has publicly available proof-of-concept (PoC) exploit code and allows unauthenticated remote attackers to execute commands with root-level privileges. The issue was disclosed