Category Archives: Cyber Security

VMware Windows Tools Vulnerability Causes Authentication Bypass (CVE-2025-22230)

Posted on by

This article peeked my interest due to the nature of it being a VMware vulnerability. Between the fact that I worked for VMware for many years and I was just working inside VMware Workstation Pro building out a Windows environment the last few days made me take a second look on this article.

The bigger company and more widely used your products, the more it makes you a target for hackers. This just proves no matter how much they may dedicate to securing software, there is always someone smarter and with the time and resources to find a way in!

Below article written by Sergiu Gatlan…

Broadcom released security updates today to fix a high-severity authentication bypass vulnerability in VMware Tools for Windows.

VMware Tools is a suite of drivers and utilities designed to improve performance, graphics, and overall system integration for guest operating systems running in VMware virtual machines.

The vulnerability (CVE-2025-22230) is caused by an improper access control weakness and was reported by Sergey Bliznyuk of Positive Technologies (a sanctioned Russian cybersecurity company accused of trafficking hacking tools).

Local attackers with low privileges can exploit it in low-complexity attacks that don’t require user interaction to gain high privileges on vulnerable VMs.

“A malicious actor with non-administrative privileges on a Windows guest VM may gain ability to perform certain high-privilege operations within that VM,” VMware explains in a security advisory published on Tuesday.

Earlier this month, Broadcom also patched three VMware zero days (CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226), which were tagged as exploited in attacks and reported by the Microsoft Threat Intelligence Center.

As the company explained at the time, attackers with privileged administrator or root access can chain these vulnerabilities to escape the virtual machine’s sandbox.

Days after patches were released, threat monitoring platform Shadowserver found over 37,000 internet-exposed VMware ESXi instances vulnerable to CVE-2025-22224 attacks.

Ransomware gangs and state-sponsored hackers frequently target VMware vulnerabilities, as VMware products are widely used in enterprise operations to store or transfer sensitive corporate data.

For instance, in November, Broadcom warned that attackers were exploiting two VMware vCenter Server vulnerabilities: a privilege escalation to root (CVE-2024-38813) and a critical remote code execution flaw (CVE-2024-38812) identified during China’s 2024 Matrix Cup hacking contest.

In January 2024, Broadcom also disclosed that Chinese state hackers had used a critical vCenter Server zero-day vulnerability (CVE-2023-34048) since late 2021 to deploy VirtualPita and VirtualPie backdoors on affected ESXi systems.

SOURCE ARTICLE:

https://www.bleepingcomputer.com/news/security/broadcom-warns-of-authentication-bypass-in-vmware-windows-tools/?utm_source=tldrinfosec

(3) ESXi Zero Day Vulnerabilities: CVE-2025–22224/22225/22226

Posted on by

Written By: Kevin Beaumont

March 4th, VMware quietly released patches for three ESXi zero day vulnerabilities: CVE-2025–22224, CVE-2025–22225, CVE-2025–22226.

Although the advisory doesn’t explicitly say it, this is a hypervisor escape (aka a VM Escape). A threat actor with access to run code on a virtual machine can chain the three vulnerabilities to elevate access to the ESX hypervisor.

This is backed up by VMware’s official Github, which says:

Yes, this is being actively exploited in the wild.

Once you have ESX access, you can access everything on the ESX server — which includes things such as VM data, and crucially ESX config and mounted storage. Using ESX config and mounted network storage, you can traverse the VMware environment.

My pretty diagram:

Feel free to use this carefully prepared graphic to brief your board or the public

For example, orgs use vMotion to allow virtual machines to automatically move across ESX hosts, to balance load and allow for maintenance without downtime (it’s how VMware security patching works). Because of this, a threat actor has direct access to storage of VMs both on and not on that host by design — they’re basically loose on the backend.

Areas of concern

ESXi is a ‘black box’ environment, where you don’t have EDR tools and such — it is locked down. As such, a hypervisor escape means a threat actor is outside of all security tooling and monitoring. They can, for example, access Active Directory Domain Controller databases without triggering any alerts anywhere in the stack, or delete data.

This is frequently seen in ransomware incidents, where people directly exploit the ESX server or vCenter server over the VMware management network using unpatched vulnerabilities. Once they reach ESX, they reach directly into storage across the whole cluster.

However, being able to reach the ESX server hypervisor directly from the Virtual Machine significantly raises the risk. For example, you don’t need to find the ESX server details, or reach a segregated network.

‘But Kevin’ you may say ‘if a threat actor gained access to a VM it’d be game over’. Well… not so much. Threat actors gain access to endpoints all the time in any large org, e.g. malware initial access on end user PCs. When you have VDIs on VMware, you have a problem. When you have shared servers on VMware, you have a problem. Compromise one of system in a company is not usually a big problem in the short term. Immediate compromise of all of them is a big problem.

Additionally, there are around 500 Managed VMware providers, who operate as effectively clouds, allowing SMBs to purchase fully managed VMs, on demand compute basically. A compromise of one customer VM would allow compromise of every customer VM in the same managed provider.

This also applies to companies who have built their own Private Clouds using VMware, and use VMware to segregate business units.

Versions impacted

The Broadcom advisory is currently incomplete for some reason. For example VMware’s Github lists versions 6.5 and 6.7 as impacted, and patches are available on VMware’s website — but VMware’s advisory on the Broadcom site doesn’t list them as impacted as of writing. Basically, every release of ESX is impacted.

I understand 5.5 is also impacted, however it is out of support so no patch is available.

Continue reading article here!

SAML Roulette – The Hackers Typically Win

Posted on by
SAML
SAML

Article by Gareth Heyes

Introduction:

In this post, we’ll show precisely how to chain round-trip attacks and namespace confusion to achieve unauthenticated admin access on GitLab Enterprise by exploiting the ruby-saml library.

While researching this, GitHub independently discovered and patched our vulnerabilities. However, their disclosure omits key technical details, including the specific mutation and how to exploit it without authentication.

https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials/

We believe sharing the full details on how these attacks work is crucial for improving security by empowering everyone with the knowledge needed to identify, mitigate, and defend against such threats effectively.

This research began after we came across a fascinating post by Juho Forsén detailing an XML round-trip vulnerability. What started as curiosity quickly spiraled into a deep dive into the intricacies of SAML, uncovering far more than we initially expected. We spent months exploring various round-trip attacks with the goal of presenting our findings at Black Hat. However, as luck would have it, we ran into a research collision with Alexander Tan ( ahacker1 ), leading to our discoveries being patched before we could submit. Despite that twist, we believe this work is still worth sharing, and while it may not be hitting Black Hat this year, we hope you find it just as compelling.

Round-trip attacks 101

SAML libraries often parse an XML document, store it as a string, and later re-parse it. In Ruby-SAML, this process involves two different parsers: REXML, which is used to parse the document and validate the signature, and Nokogiri, which is used to access attributes. If any mutations occur during this process, the document may not be identical when parsed a second time.

For secure authorization, the document must be parsed and serialized consistently; otherwise, structural inconsistencies may arise. These inconsistencies can be exploited in a round-trip attack. By leveraging XML comments and CDATA sections, an attacker can manipulate the document’s structure during mutation, bypassing signature verification and effectively gaining unauthorized access by assuming another user’s identity.

Round-trip attack on Ruby SAML/REXML

To facilitate testing, we developed a testbed to identify round-trip vulnerabilities and efficiently evaluate multiple SAML libraries. I began by examining the document type definition (DOCTYPE), as similar vulnerabilities had been discovered in the past. My initial approach focused on analyzing how XML entities were parsed, so I conducted tests in that area.

In Juho’s original discovery, notation declarations were used to introduce inconsistencies in how quotes were interpreted. Building on this, I investigated whether any additional vulnerabilities had been overlooked. After extensive testing, I found that mutations could be introduced within the SYSTEM identifier.

Continue reading the rest of the article by Gareth Heyes below!

SOURCE ARTICLE: Click Here!

ChatGPT – SSRF Vulnerability (CVE-2024-27564)

Posted on by
ChatGPT Vulnerability

Threat actors are targeting a year-old server-side request forgery (SSRF) vulnerability in a third-party ChatGPT tool, mainly against financial entities and US government organizations, cybersecurity firm Veriti reports.

The affected tool is called ChatGPT, but it’s not made by OpenAI. Instead, it’s an open source tool created by a Chinese developer, designed to provide an interface for interacting with the ChatGPT gen-AI service.

The bug, tracked as CVE-2024-27564, is a medium-severity issue affecting the pictureproxy.php file. It allows attackers to inject crafted URLs in the url parameter and force the application to make arbitrary requests.

Reported in September 2023 and publicly disclosed one year ago, the flaw can be exploited without authentication, and has had proof-of-concept (PoC) exploit code available publicly for some time.

According to Veriti, at least one threat actor has added an exploit for CVE-2024-27564 to its arsenal, and has started probing the internet for vulnerable applications.

Within a single week, the cybersecurity firm observed over 10,000 attack attempts coming from a single IP address. Roughly one-third of the targeted organizations are potentially at risk of exploitation due to misconfigurations in their protection solutions, Veriti warns.

Most of the attacks were targeting organizations in the US, mainly in the government and financial sector. Financial and healthcare firms in Germany, Thailand, Indonesia, Colombia, and the UK were targeted as well.

“Banks and fintech firms depend on AI-driven services and API integrations, making them vulnerable to SSRF attacks that access internal resources or steal sensitive data,” Veriti notes.

Although a medium-severity issue, CVE-2024-27564 has become a real-world attack vector and organizations should address it as soon as possible. They should also check their intrusion prevention systems and firewalls for any misconfigurations and monitor logs for known attacker IP addresses.

“Ignoring medium-severity vulnerabilities is a costly mistake, particularly for high-value financial organizations,” Veriti says.

*updated to clarify that the ChatGPT tool impacted by CVE-2024-27564 is not in any way related to ChatGPT developer OpenAI.

SOURCE ARTICLE: Click Here!

SANS Sees Phishers Use Tricky Hyphens in URLs

Posted on by

To a phisher, one tiny hyphen can make a big mark.

SANS Technology Institute Dean of Research Johannes Ullrich alerted users to a “clever” phishing tactic that uses a URL containing a “com-” domain prefix. With that tiny, easy-to-miss hyphen, threat actors can disguise a malicious destination.

Ullrich noted on the SANS site that the phishing tactic was placed into fraudulent messages alerting a user of unpaid tolls. (The FBI warned the public of toll trolls in April 2024, when there were over 2,000 complaints of attacks using fake text messages.)

How the “.com-” tactic works. A legitimate site involving Florida’s toll system (SunPass) would involve a forward slash and look something like: “sunpass.com/tolls.”

In instances discovered by Ullrich and shared on the SANS site, the phisher registers for and receives a domain that begins with “com-,” followed by seemingly random letters, then ending with a top-level domain, like .info, .top, .xyz, and even .com.

To a reader, the phishy URL appears as something like: “sunpass.com-[random letters].top”—a tricky difference to notice when you’re quickly looking on a tiny phone screen and it appears that you owe toll money.

Fraud jobs. URL obfuscation is a favorite tactic of opportunistic threat actors, who register mimicking domains to trick fans of events like the Super Bowl or the Olympics. (Business administration company CSC identified 5,000 unique domain registrations mimicking well-known sportsbooks, between Jan. 1, 2023, and Dec. 24, 2024, for example.)

According to the FTC, government impersonation scammers led to $618 million in losses in 2023, up from $497 million in 2022 and $428 million in 2021.

Dash money. Ullrich told IT Brew that he continues to see “com-” domains registered: 315 on Feb. 11, 428 on Feb. 10, and 269 on Feb 9. (The sites are often short-lived and quickly shut down as fraudulent, he added.)

Many of the questionable domains point to the same IP address, Ullrich said, suggesting one actor is registering and rotating between them.

Ullrich also shared with IT Brew a new twist on the hyphen-ishing trend: A “com.-” domain prefix with a “.com” ending to the URL, and a “case number” in between to convince targeted users that the sender is from an IT support team.

“They can use any prefix for the domain to impersonate arbitrary .com domains,” Ullrich told us in an email.

In his Feb. 5 post, Ullrich advised IT pros to review DNS queries for these kinds of prefixes.

SOURCE ARTICLE:

https://www.itbrew.com/stories/2025/02/18/sans-sees-phishers-use-tricky-hyphens-in-urls?mbcid=38663986.101742&mblid=0526c530a3f5&mid=bfeacb7fd34941195bb37df6366acc6f&utm_campaign=itb&utm_medium=newsletter&utm_source=morning_brew

The Art of Linux Kernel Rootkits

Posted on by

1. What is a rooktit?

A rootkit is malware whose main objective and purpose is to maintain persistence within a system, remain completely hidden, hide processes, hide directories, etc., in order to avoid detection.

This makes its detection very complex, and its mitigation even more complex, since one of the main objectives of a rootkit is to remain hidden.

A rootkit, it changes the system’s default behavior to what it wants.

1.1 What is a kernel? Userland and kernel land differences

The kernel is the core of the operating system, responsible for managing system resources and facilitating communication between hardware and software. It operates at the lowest layer of the system, for example components that operate in kernel land include the kernel itself, device drivers and kernel modules (which we call Loadable Kernel Module, short for LKM).

On the other hand, the userland or userspace is the layer where user programs and applications are executed. This is the part of the OS that interacts with the user, including browsers, text editors, games, common programs that the user uses, etc.

1.2 What is a system call?

System calls (syscalls) are fundamental in OS, they allow running processes to request services from the kernel

These services include operations such as file management, inter-process communication, process creation and management, among others.

A very practical example is when we write code in C, a simple hello world, if we analyze it with strace for example, you will notice that it uses sys_write to be able to write Hello world.

root@infect:~# cat hello.c ; ls hello
#include <stdio.h>

int main() {
    printf("Hello, World!\n");
    return 0;
}
hello
root@infect:~# strace ./hello 2>&1 | grep write

write(1, "Hello, World!\n", 14Hello, World!
root@infect:~#
Continue reading →

Palo Alto Networks Tags New Firewall Bug

Posted on by

Palo Alto Networks warns that a file read vulnerability (CVE-2025-0111) is now being chained in attacks with two other flaws (CVE-2025-0108 with CVE-2024-9474) to breach PAN-OS firewalls in active attacks.

The vendor first disclosed the authentication bypass vulnerability tracked as CVE-2025-0108 on February 12, 2025, releasing patches to fix the vulnerability. That same day, Assetnote researchers published a proof-of-concept exploit demonstrating how CVE-2025-0108 and CVE-2024-9474 could be chained together to gain root privileges on unpatched PAN-OS firewalls.

A day later, network threat intel firm GreyNoise reported that threat actors had begun actively exploiting the flaws, with attempts coming from two IP addresses.

CVE-2024-9474 is a privilege escalation flaw in PAN-OS fixed in November 2024 that allows a PAN-OS administrator to execute commands on firewalls with root privileges. Palo Alto Networks warned at the disclosure that the vulnerability was exploited as a zero-day.

CVE-2025-0111 is a file read vulnerability in PAN-OS, allowing authenticated attackers with network access to the management web interface to read files that are readable by the “nobody” user.

The CVE-2025-0111 flaw was also fixed on February 12, 2025, but the vendor updated its bulletin today to warn that it is also now being used in an exploit chain with the other two vulnerabilities in active attacks.

“Palo Alto Networks has observed exploit attempts chaining CVE-2025-0108 with CVE-2024-9474 and CVE-2025-0111 on unpatched and unsecured PAN-OS web management interfaces,” reads the updated bulletin.

While Palo Alto Networks has not shared how the exploit chain is being abused, BleepingComputer has been told they could be chained together to download configuration files and other sensitive information.

Continue reading →

Phishing Evolves Beyond Email, Becomes Latest Android App Threat

Posted on by

There are plenty of phish in the sea, and the latest ones have little interest in your email inbox.

In 2024, Malwarebytes detected more than 22,800 phishing apps on Android, according to the recent 2025 State of Malware report. Of those malicious apps, 5,200 could subvert one of the strongest security practices available today, called “multifactor authentication,” by prying into basic text messages sent to a device. Another 4,800 could even read information from an Android device’s “Notifications” bar to obtain the same info.

These “Android phishing apps” may sound high-tech, but they are not. They don’t crack into password managers or spy on passwords entered for separate apps. Instead, they present a modern wrapper on a classic form of theft: Phishing.

By disguising themselves as legitimate apps—including for services like TikTok, Spotify, and WhatsApp—Android phishing apps can trick victims into typing in their real usernames and passwords on bogus login screens that are controlled entirely by cybercriminals. If enough victims unwittingly send their passwords, the cyber thieves may even bundle the login credentials for sale on the dark web. Once the passwords are sold, the new, malicious owners will attempt to use individual passwords for a variety of common online accounts—testing whether, say, an email account password is the same one used for a victim’s online banking system, their mortgage payment platform, or their Social Security portal.

The volume of these apps and their capabilities underscore the importance of securing yourself and your devices. With vigilance, safe behavior, and some extra support, you can avoid Android phishing apps and protect your accounts from cybercriminals.

Same trick, new delivery

For more than a decade, phishing was often understood as an email threat. Cybercriminals would send emails disguised as legitimate communications from major businesses, such as Netflix, Uber, Instagram, Google, and more. These emails would frequently warn recipients about a problem with their accounts—a password needed to be updated, or a policy change required a login.

But when victims followed the links within these malicious emails, they’d be brought to a website that, while appearing genuine, would actually be in complete control of cybercriminals. Fooled by similar color schemes, company logos, and familiar layouts, victims would “log in” to their account by entering their username and password. In reality, those usernames and passwords would just be delivered to cybercriminals on the other side of the website.

There never was a problem with a user’s account, and there never was a real request for information from the company. Instead, the entire back-and-forth was a charade.

Over time, phishing emails have advanced—cybercriminals have stolen credit card details by posing as charities—but so, too, have phishing protections from major email providers, sending many cybercriminal efforts into people’s “spam” inboxes, where the emails are, thankfully, never retrieved.

Continue reading →

Apple Fixes Zero-Day Vulnerability – Update ASAP!

Posted on by

Apple has released an emergency security update for a vulnerability which it says may have been exploited in an “extremely sophisticated attack against specific targeted individuals.”

The update is available for:

  • iOS 18.3.1 and iPadOS 18.3.1 – iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
  • iPadOS 17.7.5 – iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch, and iPad 6th generation

If you use any of these then you should install updates as soon as you can. To check if you’re using the latest software version, go to Settings (or System Settings) > General > Software Update. It’s also worth turning on Automatic Updates if you haven’t already, which you can do on the same screen.

Technical details

The new-found zero-day vulnerability is tracked as CVE-2025-24200. When exploited, the vulnerability would allow an attacker to disable USB Restricted Mode on a locked device. The attack would require physical access to your device

The introduction of USB Restricted Mode feature came with iOS 11.4.1 in July 2018. The feature was designed to make it more difficult for attackers to unlock your iPhone. When USB Restricted Mode is active, your device’s Lightning port (where you plug in the charging cable) will only allow charging after the device has been locked for more than an hour. This means that if someone tries to connect your locked iPhone to a computer or other device to access its data, they won’t be able to do so unless they have your passcode.

To enhance data security, especially when traveling or in public places, it is recommended that you enable USB Restricted Mode in your device settings. If your iPhone, iPad or iPod Touch is running iOS 11.4.1 or later, USB Restricted Mode is automatically on by default, but if you want to check and enable USB Restricted Mode, this can be done by going to Settings > Face ID & Passcode or Touch ID & Passcode > (USB) Accessories and toggling off (grey) the (USB) Accessories option. Enabling this setting adds an extra layer of protection against unauthorized data access.

Please note: toggling the option to green turns this feature off.

Vulnerabilities like these typically target specific individuals as deployed by commercial spyware vendors like Pegasus and Paragon. This means the average user does not need to fear attacks as long as the details are not published. But once they are, other cybercriminals will try to copy them.

Source Article:

https://www.malwarebytes.com/blog/news/2025/02/apple-fixes-zero-day-vulnerability-used-in-extremely-sophisticated-attack?utm_source=iterable&utm_medium=email&utm_campaign=b2c_pro_oth_20250217_februaryweeklynewsletter_v3_173948923242&utm_content=Apple_fixes

Do You Like to Play Steam Games? BEWARE of Malware!

Posted on by
Steam Games
Steam Games

The free-to-play game, PirateFi, infects users with malware that steals browser cookies, enabling the malware’s creator to hijack access to various online accounts. 

Original story:
A hacker published a PC game on Steam to infect users with Windows-based malware. 

The free-to-play game, PirateFi, was released on Thursday. Days later, Valve was spotted sending out a message to affected users, warning them about the threat to their computers.

“We strongly encourage you to run a full-system scan using an antivirus product that you trust or use regularly, and inspect your system for unexpected or newly installed software,” Steam said.

PirateFi was published as a beta. However, according to Steam forum posts, one user noticed something was off when their antivirus software prevented them from running the game, flagging it as carrying “Trojan.Win32.Lazzzy.gen.”

“The essence of the virus: When you launch the ‘game,’ the virus unpacks into /AppData/Temp/****/ and looks like Howard.exe,” the user wrote in Rusian. The malware then appears to steal browser cookies, enabling the malware’s creator to hijack access to various online accounts. 

Another gamer who downloaded the title wrote on Tuesday: “Most of my stuff has either been hacked and passwords changed or being signed in using cookies that’ve been stolen!” 

Continue to read the rest of the articule below…

Source Article:

https://www.pcmag.com/news/did-you-download-this-steam-game-sorry-its-windows-malware?utm_source=tldrinfosec

Hackers Steal Personal Data from Watergate’s Hotel Network

Posted on by
Watergate Hotel

Bob Woodward and Carl Bernstein would be of limited use with this 21st-century breach though.

The Watergate Hotel in the District suffered a data breach last year and has recently notified those affected online and via mail.

The hackers targeted personal and financial information.

The hotel noticed suspicious activity on its network on April 6, 2024. After securing the network and investigating, the hotel found that the cyber-burglars had gotten access to hotel computers and were therefore able to see and download certain files, the hotel said on its website.

About 2,220 people were affected by the data breach, according to a data breach database maintained by the Office of the Maine Attorney General.

The data stolen varies by individual, the Watergate said, but includes names, financial account and credit card information, health insurance and medical information, and Social Security, government identification and driver’s license numbers.

Source Page:

https://www.washingtontimes.com/news/2025/feb/13/hackers-broke-watergate-hotel-network-stole-person/?utm_source=tldrinfosec

Understanding CVE-2025-1094: PostgreSQL Exploit Risks (US Treasury)

Posted on by

A high-severity SQL injection bug in the PostgreSQL interactive tool was exploited alongside the zero-day used to break into the US Treasury in December, researchers say.

Rapid7’s principal security researcher, Stephen Fewer, disclosed CVE-2025-1094 (8.1) on Thursday, saying it was a key part of the exploit chain that also included the BeyondTrust zero-day (CVE-2024-12356).

In fact, CVE-2025-1094 was so important to the chain that the BeyondTrust attack couldn’t have been pulled off without it, we’re told.

“Rapid7 discovered that in every scenario we tested, a successful exploit for CVE-2024-12356 had to include exploitation of CVE-2025-1094 in order to achieve remote code execution,” said Fewer.

“While CVE-2024-12356 was patched by BeyondTrust in December 2024, and this patch successfully blocks exploitation of both CVE-2024-12356 and CVE-2025-1094, the patch did not address the root cause of CVE-2025-1094, which remained a zero-day until Rapid7 discovered and reported it to PostgreSQL.”

According to Rapid7’s director of vulnerability intelligence, Caitlin Condon, CVE-2025-1094 affects all versions of the PostgreSQL interactive tool, but, fortunately, it isn’t particularly simple to exploit. Given the complexity of the exploit pattern, Rapid7 doesn’t expect attacks to be carried out away from the BeyondTrust versions already known to be vulnerable.

She said via Mastodon: “But with the above said, it’s clear that the adversaries who perpetrated the December attack really knew the target technology, which is yet another example of a zero-day exploit trend Rapid7 started tracking in 2023.”

The vulnerability in the PostgreSQL interactive tool (psql) can lead to arbitrary code execution (ACE) and there is also a technique to exploit it independently from CVE-2024-12356. Rapid7 said BeyondTrust’s patch for its zero-day didn’t address the root cause of the psql bug, but it does prevent the two from being exploited together.

The psql vulnerability can be exploited because of an incorrect assumption that a SQL injection attack can’t be carried out when a malicious input is safely escaped via PostgreSQL’s string escaping routines, Fewer said.

Source Article:

https://www.theregister.com/2025/02/14/postgresql_bug_treasury/?utm_source=tldrinfosec

BACK AT IT AGAIN AND ON A NEW JOURNEY!!

Posted on by

It has been several years since I was actively posting on this site. The last three or so years I stepped away from hands-on keyboard type of work and staying up-to-date on IT related information. I was focused on creating a quarterly enablement plan for all VMware Field Sales/Technical folks had the latest information related to VMware solutions. I did this on a global scale working with all the Program Managers of our solutions as well as the field sales managers ensuring field personnel were getting the proper ongoing enablement.

VMware was acquired a little over a year ago by Broadcom. As usual with acquisitions, positions get eliminated as mine did. So I am back looking for a new opportunity and have decided I want to get into Cyber Security and use my years of experience in IT and technology to support this new venture.

I had my CompTIA Security+ in the past but has expired so I am working on that now to re-certify and help with breaking into the security side of the house. After I finish that I will be doing the Certified Information Systems Professional (CISSP) and Certified Ethical Hacker (CEH) certifications over the next few months.

My hope is with these security focused certifications under my belt, I can break into a Cyber Security role. I know I will have to get an entry-level position, but I am willing to do what it takes.

Needless to say, my posts moving forward will be security focused to support my new career. I plan to post relevant security information related to IT. Hopefully as I learn, my readers will learn as well!

I also would love to hear from any of you in the industry with any suggestions as far as what to post here as well as for myself in my Cyber Security learning journey.

NOW LET THE FUN BEGIN!!