Welcome to OpenText Cybersecurity Community | OpenText Cybersecurity Community

Categories
Recently active
Help others

Secure Cloud

Make security simple with Secure Cloud

MDR

10 topics

Endpoint Protection

1152 topics

Email Threat Protection

0 topics

DNS Protection

36 topics

Security Awareness Training

57 topics

Email Continuity

0 topics

Email Encryption

0 topics

Information Archiving

0 topics

Threat Intel Hub

Experts share their insights on protecting against cyber threats and staying ahead of evolving security risks.

Security Industry News

36423 topics

Security Expert Perspectives

14 topics

Threat Reports

18 topics

Ransomware Spotlight

103 topics

Phish Tank

32 topics

Vulnerability Vault

392 topics

Data Protection

Carbonite product portfolio

Cloud to Cloud Backup

2 topics

Endpoint Backup

0 topics

Migrate

3 topics

Core Business Communication Archive

0 topics

Server Backup

1 topic

Availability

2 topics

Webroot

Comprehensive security at your fingertips.

Got a Question?

581 topics

Webroot® SecureAnywhere™ - Home

10797 topics

Webroot® SecureAnywhere™ - Internet Security Plus

1601 topics

Webroot® SecureAnywhere™ - Complete

2080 topics

Webroot Mobile

1239 topics

Webroot® Unity API

125 topics

Webroot® Legacy Products (2011 and Prior)

33 topics

Welcome

News, Announcements, Tech Discussions

Community 101

2080 topics

News & Announcements

1226 topics

Malware Manifesto

73 topics

Events & Conferences

289 topics

Tech Talk

4989 topics

Water Cooler

970 topics

Trivia

49 topics

API

All Things API

Unity API Forum

0 topics

Carbonite Replication API

0 topics

Product Releases

Patch Notes & Software Updates

Business Product Releases

235 topics

Consumer Product Releases

262 topics

What's New

48 topics

Integrations

Webroot Integration Discussions

Nable

1 topic

ConnectWise Automate Integration

13 topics

ConnectWise Manage Integration

1 topic

Kaseya VSA Integrations

16 topics

Crypto Corner

A place to discuss all things cryptocurrency

News

9 topics

Wallet Security

3 topics

Common Scams

3 topics

ConnorMThreat Research Analyst

Security Industry News

Cyber News Rundown: Operation Elicius targets DiskStation ransomwareNews

In a recent international law enforcement collaboration, Operation Elicius was focused on taking down the Romania-based ransomware group, DiskStation, who are known for targeting Network-Attached Storage (NAS) devices over the last 4 years. By finding unsecured devices and encrypting them, DiskStation masqueraded as a security service to warn victims of their vulnerabilities before demanding a ransom for decryption. The results of Operation Elicius led to multiple raids on residences throughout Romania and the arrest of the alleged primary admin of the DiskStation ransomware group. UK data breach trend hits Louis VuittonAs the string of UK retailers falling victim to data breaches continues, Louis Vuitton has recently confirmed that they were the latest in line to have customer data exfiltrated. It is believed that the breach occurred on July 2nd and the threat actors gained access to a significant amount of personally identifiable information (PII). This incident comes just weeks afte

113

1 hour ago

TripleHelixModerator

Water Cooler

Goodnight Thread - 2

The old thread (10 years) has run it’s course as you can’t post in there anymore so I started a new one! Thanks @Ssherjj

50881010

2 hours ago

vonsheatingandairNew Member

MDR

HVAC Services Jacksonville

SPAM TH….

2 hours ago

TripleHelixModerator

Vulnerability Vault

Alert CISA Adds One Known Exploited Vulnerability to Catalog Release Date July 18, 2025

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-25257 Fortinet FortiWeb SQL Injection VulnerabilityThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vu

11 hours ago

TripleHelixModerator

Vulnerability Vault

Microsoft security update summary's for July 2025

July 2025 Security UpdatesThis release consists of the following 130 Microsoft CVEs:Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations?Service Fabric CVE-2025-21195Windows Kernel CVE-2025-26636Remote Desktop Client CVE-2025-33054Windows Visual Basic Scripting CVE-2025-47159Microsoft Intune CVE-2025-47178Virtual Hard Disk (VHDX) CVE-2025-47971Microsoft Input Method Editor (IME) CVE-2025-47972Virtual Hard Disk (VHDX) CVE-2025-47973Windows SSDP Service CVE-2025-47975Windows SSDP Service CVE-2025-47976Windows Kerberos CVE-2025-47978Windows Imaging Component CVE-2025-47980Windows SPNEGO Extended Negotiation CVE-2025-47981Windows Storage VSP Driver CVE-2025-47982Windows GDI CVE-2025-47984Windows Event Tracing CVE-2025-47985Universal Print Management Service CVE-2025-47986Windows Cred SSProvider Protocol CVE-2025-47987Azure Monitor Agent CVE-2025-47988Microsoft Input Method Editor (IME) CVE-2025-47991Microsoft PC Manager CVE-2025-47993Microsoft Office CVE-2025-47994W

558

11 hours ago

Jasper_The_RasperModerator

Security Industry News

UK ties GRU to stealthy Microsoft 365 credential-stealing malware

July 18, 2025 By Bill Toulas The UK National Cyber Security Centre (NCSC) has formally attributed ‘Authentic Antics’ espionage malware attacks to APT28 (Fancy Bear), a threat actor already linked to Russia’s military intelligence service (GRU).The NCSC revealed in a detailed technical analysis of the Authentic Antics malware dated May 6th that it is stealing credentials and OAuth 2.0 tokens that allow access to a target's email account.The malware was observed in use in 2023 and runs inside the Outlook process and produces multiple Microsoft login prompts in its attempts to intercept the victim's sign-in data and authorization code.The agency says that because Microsoft 365 apps are configurable per tenant, it is possible that sensitive data also works for Exchange Online, SharePoint, and OneDrive.Authentic Antics exfiltrates the stolen data by using the victim’s own Outlook account to send it to an attacker-controlled email address, and hides the operation by disabling the “save to se

11 hours ago

Jasper_The_RasperModerator

Security Industry News

'PoisonSeed' Attacker Skates Around FIDO Keys

Researchers discovered a novel phishing attack that serves the victim a QR code as part of supposed multifactor authentication (MFA), in order to get around FIDO-based protections. July 18, 2025 By Alexander Culafi A threat actor known as "PoisonSeed" was credited with a novel attack technique that is able to bypass FIDO-based protections in an organization.That's according to a report this week from MDR vendor Expel, titled "PoisonSeed bypassing FIDO keys to 'fetch' user accounts." FIDO, or Fast Identity Online, refers to a technology-agnostic set of specifications for authentication. The technology, which was originally developed by the FIDO Alliance, is considered a gold standard in security, commonly seen in non-password authentication technologies like physical security keys.Expel's research concerns a strategy for gaining access to a victim through the cross-device sign-in features available in FIDO security keys in a way that can bypass certain safeguards. Though the report does

12 hours ago

Jasper_The_RasperModerator

Vulnerability Vault

Hackers scanning for TeleMessage Signal clone flaw exposing passwords

July 18, 2025 By Bill Toulas Researchers are seeing exploitation attempts for the CVE-2025-48927 vulnerability in the TeleMessage SGNL app, which allows retrieving usernames, passwords, and other sensitive data.TeleMessage SGNL is a Signal clone app now owned by Smarsh, a compliance-focused company that provides cloud-based or on-premisses communication solutions to various organizations.Scanning for vulnerable endpointsThreat monitoring firm GreyNoise has observed multiple attempts to exploit CVE-2025-48927, likely by different threat actors.“As of July 16, GreyNoise has observed 11 IPs attempting to exploit CVE-2025-48927,” reports GreyNoise.“Related reconnaissance behavior is ongoing. Our telemetry shows active scanning for Spring Boot Actuator endpoints, a potential precursor to identifying systems affected by CVE-2025-48927.”According to GreyNoise, more than two thousand IPs have scanned for Sprint Boot Actuator endpoints over the past months, a little over 75% of them targeting t

12 hours ago

Jasper_The_RasperModerator

Security Industry News

Anne Arundel Dermatology Data Breach Impacts 1.9 Million People

Anne Arundel Dermatology said hackers had access to its systems for three months and may have stolen personal and health information. July 18, 2025 By Eduard Kovacs Maryland-based dermatology services provider Anne Arundel Dermatology has disclosed a data breach impacting roughly 1.9 million individuals.Data breach notifications sent out to affected people reveal that hackers had access to its systems for roughly three months, between February 14 and May 13. An investigation launched after the intrusion was detected showed that the attacker could have stolen files containing patients’ personal and health information.Anne Arundel Dermatology provides general, surgical, and cosmetic dermatology services at over 60 locations in the Mid-Atlantic and Southeastern regions.The healthcare firm was unable to determine whether the hackers actually viewed or exfiltrated personal and health information, and says it’s not aware of any misuse or fraudulent activity stemming from the incident, but i

12 hours ago

Jasper_The_RasperModerator

Security Industry News

4 Chinese APTs Attack Taiwan's Semiconductor Industry

Chinese threat actors have turned to cyberattacks as a way to undermine and destabilize Taiwan's most important industrial sector. July 18, 2025 By Nate Nelson New Chinese threat actors have been trying to use phishing as a means of breaching Taiwan's famed semiconductor industry.Taiwan's semiconductor industry is one of the most geopolitically significant on the planet. Far beyond just earning income, it is a unique and presently irreplaceable supply chain cog to various global technologies. That makes Taiwan's prosperity — and by extension, the Chinese Communist Party's (CCP) aims to take over the island — of critical importance to countries besides itself, most notably the US.More than ever before, China is now using cyberattacks as a weapon to undermine Taiwan's semiconductors and, by extension, Taiwan's national defense. Proofpoint researchers have identified three as yet unclassified advanced persistent threats (APT) targeting its chip industry in only the past few months, in add

12 hours ago

vonsheatingandairNew Member

MDR

HVAC Services Jacksonville

SPAM TH….

2 hours ago

EzraMNew Member

Webroot® Unity API

How to get the entities of all sites that needs attention

In the Management Console, the user can list out all the entities that needs attention by using the filters. I would also like to get all of those entities via the API. I have found this endpoint:/service/api/status/gsm/{keyCode}With the field BasicInfo having the subfield of AttentionRequired: bool This is great, but somehow the data from the API does not match the entities in the web console (Some missing, there’s some entities from the API not present in the web console, etc.) Also I can’t get the entityId, and the marname, these fields are from when I inspected the network request from the web console, the data is in JSON form and it seems to be perfect for what we need.

584

2 days ago

hungphamPopular Voice

Endpoint Protection

Cannot finish the installation on a new Mac

A new Macbook Air, M3 CPU. Sequoia 15.5.I downloaded the Endpoint Protection Agent from Management Console. Run installation. Finished with information: Next Steps:The Webroot SecureAnywhere® application will launch automatically after you close this window. You will be guided through a few additional steps to finish activating your product. But Webroot is never coming up. Even I tried to run it manually, no success. Don’t have any warning, for example, that I need to allow an downloading app either. Any idea why? And how to continue the installation steps?Thanks.

552

24 days ago

mborgeaudNew Voice

Webroot® SecureAnywhere™ - Home

Internet restarting

Webroot appears to be causing my internet connection to continually restart or reset at least a dozen times a day. Sometimes it does it once and I have connection back after 20 seconds and other times I have waited for up to 15 minutes before I can use the internet again.The only way I can get continual and uninterrupted internet connection is to disable Webroot entirely. I have changed my DNS setup from “auto” to manual and am using Google’s DNS servers.I have also removed WR and reinstalled - same result.Has anyone else experienced this - I cannot seem to find it in the various threads posted here.

21615

1 month ago

dm661New Member

Endpoint Protection

How to edit keycode on all domain PCs?

Is there a supported method for mass updating the keycode on many PCs on a domain via GPO or otherwise?

300

4 months ago

MajorHavocBronze VIP

Webroot® SecureAnywhere™ - Home

WSA holding onto volumes from DMG or USB when trying to eject.

Anyone else see this issue and hopefully have a work around:When I mount a DMG disk image, or plug in a USB drive to my MacBookPro, I cannot eject it because I am told one or more programs may be using it. This even happens if NO programs are shown as running. I have noted that if I quit WSA (shut it down) I can then eject these drives But WSA scanning the drives it seems leaves some process open that still has an active pin to the drives. I do not want to force eject an HD, or even a DMG as it can damage the image or drive. Suggestions anyone? (FYI: Webroot Customer Service suggested I shut down WSA, eject the drive, and then turn it back on. WORST SOLUTION EVER.)

21918

5 months ago

chrisroseNew Voice

Webroot® Unity API

DNS ProtectionPolicy mapping via UnityAPI

Good day,I am working on enabling DNS Protection and setting some of its options using Unity API. I can successfully enable and disable the module using Unity API and I can set the site policy to one that includes DNS Protection on our endpoints, and the network wide DNS Protection Policy for a Static IP. However, I cannot see a way to set the Agent/Endpoint DNS Protection Policy. It does not even seem this is possible with the current set of commands.Am I missing something? Or is this not possible? Might it be an option that will be enabled in the future?Thanks,Chris

734

8 months ago

Events Calendar

User leaderboard

Show full leaderboard

Join the Conversation

Tweets by OpenTextSec

Consumer Common KB Articles

Business Common KB Articles

Check out this year's Threat Report

Featured Topics

Recent Articles

Upcoming Events

Events Calendar

User leaderboard

Join the Conversation

Sign up

Login to the community

Scanning file for viruses.

This file cannot be downloaded