Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Apache Tomcat Vulnerability CVE-2025-55752: Risk & Protection

Nov 28, 2025 By Indusface In Indusface
CVE-2025-55752 exposes a dangerous path traversal flaw in Apache Tomcat caused by a rewrite and decoding regression. This video breaks down how the bug works, why it becomes severe when combined with HTTP PUT, which versions are affected, and what teams must do to patch or mitigate it. We also show how WAAP protection blocks exploitation attempts even before servers are updated.
View Video
seal security

Shai-Hulud: The Second Coming Hits npm Users

Nov 26, 2025 By Itamar Sher In Seal Security
Once again, the npm supply chain has been compromised, putting developers relying on these vital open source components at risk. On November 24th, a sophisticated attack that borrows techniques from the Shai-Hulud malware used in the npm hijacking this past September was discovered. This is not an isolated incident. It’s a continuation of an existing campaign that is now abusing CI/CD pipelines, and GitHub automation to spread faster and steal more secrets than before.
Read Post
astra

Introducing Astra Cloud Vulnerability Scanner: Multi-Cloud Security Built for Scale

Nov 26, 2025 By Shikhil Sharma In Astra
1.8X, that’s how much cloud vulnerabilities have skyrocketed over the past year, fueled not just by attackers but by the routine tweaks teams make every day. Modern vulnerability scanners were built to find everything that looks risky. They just never learned to tell what actually is. Dashboards lit with thousands of “critical” alerts, endless CSVs, and reports that read like alarm bells on repeat. Yet less than 10 percent of those alerts ever lead to a real exploit.
Read Post
Snyk

Snyk Log Sniffer: AI-Powered Audit Log Insights for Security Leaders

Nov 26, 2025 By Liran Tal In Snyk
Snyk empowers organizations to build fast and stay secure. As security and engineering teams scale their use of Snyk across the enterprise, understanding what's happening across your group and organizations becomes critical–from API integrations and user access patterns to policy changes and security events. However, raw audit logs alone can be overwhelming and difficult to interpret. Security leaders need instant visibility into critical events, risk patterns, and user activity.
Read Post
ionix

CVE-2025-61757: Critical Pre-Auth RCE in Oracle Identity Manager

Nov 26, 2025 By Zach Bistra In IONIX
A newly disclosed vulnerability, CVE-2025-61757, exposes Oracle Identity Manager (OIM) to unauthenticated remote code execution (RCE). The flaw affects OIM versions 12.2.1.4.0 and 14.1.2.1.0 and carries a CVSS 9.8 Critical rating. CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog — meaning active exploitation is confirmed.
Read Post
The Hidden Vulnerabilities Sitting On Everyday Work Devices

The Hidden Vulnerabilities Sitting On Everyday Work Devices

Nov 26, 2025 By SecuritySenses In SecuritySenses
In the modern workplace, the hum of productivity is typically accompanied by the quiet, persistent glow of computer monitors, the chime of incoming emails, and the seamless operation of countless software applications. These devices, such as laptops, desktops, smartphones, and tablets, are the engines of business operations. However, beneath the surface of this digital efficiency lies a landscape of hidden vulnerabilities. These aren't the flaws of sophisticated cyber-attacks, but the mundane, overlooked security gaps inherent in the very tools employees use every day.
Read Post
nucleus

Built for What's Next: How Nucleus Became the Exposure Assessment Platform for a New Era

Nov 25, 2025 By Scott Kuffer In Nucleus
For nearly a decade, we’ve been building Nucleus with a clear mission: to help security teams make faster, smarter, and more business-aligned decisions about what to fix first. When we started, the world called it vulnerability management. Today, the industry calls it exposure assessment. To us, that evolution isn’t just semantics, t’s the culmination of years spent redefining how organizations understand and reduce risk.
Read Post
seemplicity

From Hats to Heartfelt Advice: Takeaways from a Fireside Chat with CISO @ Crocs

Nov 25, 2025 By Megan Horner In Seemplicity
The fireside chat with Crocs CISO Lena Taylor at our Denver event brought together cybersecurity professionals, allies, and leaders for an evening of honest insight and community. From redefining work-life balance to knowing when to pursue new opportunities, Lena shared grounded, real-world wisdom that resonated far beyond career advice. Here’s a look at the biggest takeaways from the discussion and why the night left such a lasting impression.
Read Post

The Missing Link in OWASP is Found: Business Logic Abuse#owasp #owasptop10 #businesslogic

Nov 25, 2025 By Wallarm In Wallarm
For years, security lists focused on technology (Cloud , Mobile , Serverless ). We desperately needed a list that focused on the core problem: flawed application logic, regardless of the stack. The OWASP Top 10 Business Logic Abuse (BLA) list fills that critical, architectural gap. Why? Because exploitation often happens between technologies, not within them. We must be able to categorize and talk about these intricate logic threats in a technology-agnostic way.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.