A critical authentication bypass vulnerability in CrushFTP, identified as CVE-2025-31161, has been actively exploited by remote attackers following a mishandled disclosure process. The flaw, which allows unauthenticated access to devices running unpatched versions of CrushFTP v10 or v11, has a CVSSv3.1 severity score of 9.8. Security analysts at Outpost24 said they originally discovered the vulnerability and sought to follow a responsible disclosure timeline, working with MITRE to secure a CVE on March 13, 2025. They…

Imagine one of your Agile teams is six months deep into a strategic digital initiative when they realize the solution isn’t working. Maybe it isn’t meeting customer requirements, or there is insufficient visibility into the project to specify where things are going off track. That’s not an uncommon scenario, according to The Agile Advantage study, in which 42% of Agile practitioners cited “unclear project requirements or scope changes” as top reasons for rework. A lack…

What is HellCat? HellCat is the name of a relatively new ransomware-as-a-service (RaaS) group that first came to prominence in the second half of 2024. Like many other ransomware operations, HellCat breaks into organisations, steals sensitive files, and encrypts computer systems – demanding a ransom payment for a decryption key and to prevent the leaking of stolen files. So it’s your typical “double extortion” threat? Yes, although HellCat has been known to take a rather…

A new, relatively low-skilled cyber threat actor has been uncovered leveraging the services of a bulletproof hosting provider (BPH) to deploy malware under the guise of legitimate software. The hacker, known by the moniker ‘Coquettte,’ was discovered by DomainTools researchers while investigating malicious domains hosted on Proton66. Proton66 is a Russian bulletproof hosting provider notorious for enabling cybercrime by ignoring abuse complaints. DomainTools shared its findings on Coquettte’s activity in a report published on April…