Recent Posts
Play, Pay, Repeat: Why Australia Needs to Stop Chasing Encryption Backdoors and Start Getting Serious About Kids, Games,and Digital Safety
Over the weekend, I read an article by Jackson Ryan in The Guardian that stopped me in my tracks. It asked a pointed question — “Does video game monetisation harm children, and what is Australia doing about it?” — and its answers were far from …
Welcome New Member – Caroline Humer from US
Please welcome our newest member from the United States, Caroline Humer
As an international digital safety advocate, Caroline Humer is dynamic and motivated, with a track record of successfully fostering cross-industry engagement. Growing up in numerous global settings has honed her ability to lead global projects from ideation to execution. Caroline’s exceptional networking skills have enabled her to excel in long-term business development, ultimately helping to safeguard vulnerable populations from harm.
She is also the Co-Founder of STISA (Survivors & Tech Solving Image-based Sexual Abuse), the world’s first NGO focused on providing a voice for survivors of image-based sexual abuse. STISA is raising awareness about this pervasive online violence, fostering international collaborations with hotlines and helplines, and developing cutting-edge technology to remove IBSA content.
It’s good to have you, Caroline! We look forward to the expertise you bring and enabling you here at CyAN. Don’t hesitate to reach out or explore Caroline’s profile to grow your networks mutually.
Week-19 – A critical security vulnerability in the OpenCTI Platform
05 – 11 May 2025 A critical security vulnerability has been identified in the OpenCTI Platform which is designed to structure, store, organize and visualize technical and non-technical information about cyber threats. This vulnerability, tracked as CVE-2025-24977 is our new CVEofTheWeek with an assigned CVSS …
CyAN Voices: Growing Careers Through Mentorship
Empowering Early-Career Web Developer & Cybersecurity Professionals: My Journey with the CyAN Mentorship Program
By Sumandeep Kaur
Acknowledging My Mentor “Shantanu Bhattacharya”: A Pillar in My Professional Growth
Throughout my participation in the CyAN Mentorship Program, I had the privilege of being guided by an exceptional mentor whose unwavering support and expertise were instrumental in my development.
From the outset, my mentor fostered an environment of learning and curiosity. Their deep knowledge provided me with a comprehensive understanding of how these fields intertwine. Whether it was navigating complex coding challenges or understanding the nuances of cybersecurity protocols, their guidance was always insightful and encouraging.
One of the most impactful aspects of our mentorship was their emphasis on best practices and real-world application. They didn’t just teach me the “how,” but also the “why,” ensuring I grasped the underlying principles that would allow me to adapt and grow beyond the program. Their patience and willingness to share personal experiences made our sessions both educational and inspiring.
Beyond technical skills, my mentor instilled in me the importance of continuous learning and ethical responsibility in the tech industry. Their mentorship extended beyond our scheduled sessions, as they were always approachable for questions and discussions, demonstrating a genuine investment in my success.
I am profoundly grateful for the time, knowledge, and encouragement my mentor provided. Their influence has not only enhanced my technical abilities but also shaped my professional ethos. As I continue to build my career, the lessons and values imparted by my mentor will remain a guiding force.
During my tenure in the CyAN Mentorship Program, I immersed myself in a comprehensive learning experience that bridged the realms of full-stack web development and cybersecurity. This dual-focused approach allowed me to understand the intricate relationship between developing robust web applications and ensuring their security against potential threats.
In the realm of full-stack development, I honed my skills in both front-end and back-end technologies. On the front-end, I worked extensively with HTML5, CSS3, and JavaScript, crafting responsive and user-friendly interfaces. I also delved into modern frameworks to build dynamic single-page applications. My experience also encompassed working with databases such as MySQL, ensuring efficient data storage and retrieval.
Parallelly, my exposure to cybersecurity principles was integral to my development process. I learned to implement security best practices, such as input validation, authentication, and authorization mechanisms, to safeguard applications against common vulnerabilities. I familiarized myself with the OWASP Top 10 security risks and integrated preventive measures during the development lifecycle. Additionally, I utilized tools like Splunk for monitoring and analyzing application logs, aiding in the early detection of potential security incidents.
By understanding the full spectrum of application development and its associated security considerations, I am better equipped to build applications that are not only functional and efficient but also resilient against cyber threats.
Key Responsibilities
- Developed responsive web applications using HTML, CSS, JavaScript, ensuring cross-browser compatibility and optimal user experience.
- Collaborated with the cybersecurity team to implement security measures such as input validation, authentication protocols, and secure data storage.
- Conducted vulnerability assessments and applied OWASP Top 10 principles to mitigate common web application security risks.
- Utilized Git and GitHub for version control and collaborative development.
Technical Skills
- Proficient in front-end technologies: HTML5, CSS3, JavaScript.
- Skilled in database management with MySQL.
- Familiar with cybersecurity tools and practices, including penetration testing and secure coding standards.
- Knowledgeable in using SIEM tools like Splunk for monitoring and analyzing security events.
Achievements
- Successfully developed and deployed a full-stack web application with integrated security features, enhancing user data protection.
- Identified and resolved multiple security vulnerabilities in existing web applications, improving overall system integrity.
- Received commendation from mentors for the ability to bridge the gap between development and security, ensuring robust application performance.
Mentorship Engagement
Throughout the mentorship, I regularly engaged in:
- One-on-one mentor sessions to discuss career pathways, technical questions, and soft skills.
- Weekly tasks and challenges designed to simulate real SOC workflows.
- Collaborative feedback sessions focused on improving analytical thinking and report writing.
Integrated Career Goals in Web Development & Cybersecurity
Deepen Expertise in Secure Web Development
Objective: Master secure coding practices by studying the OWASP Top 10 vulnerabilities and implementing mitigation strategies in your projects.
Action Plan: Enroll in courses focused on secure web application development and participate in code review sessions to identify and fix security flaws.
Develop Full-Stack Security Projects
Objective: Create comprehensive web applications that integrate both front-end and back-end security measures.
Action Plan: Design projects that include features like secure authentication, data encryption, and protection against common web threats, showcasing them in a professional portfolio.
Engage in Continuous Learning and Community Involvement
Objective: Stay updated with the latest trends in web development and cybersecurity.
Action Plan: Attend industry conferences, contribute to open-source projects, and participate in forums or local meetups to exchange knowledge and experiences.
About the Mentor
Shantanu Bhattacharya
Shantanu Bhattacharya is a seasoned cybersecurity professional with over 25 years of experience. Known as the “Cyber Doctor,” he helps small businesses in finance, legal, and retail sectors defend against phishing and ransomware. He provides actionable, budget-conscious solutions tailored to client needs delivered within 60 days.
About the Mentee
Sumandeep Kaur
Sumandeep Kaur is a Web Developer and Cybersecurity Intern who brings a dual focus in full-stack development and secure coding. She has hands-on experience with HTML, CSS, JavaScript, MySQL, and cybersecurity tools like Splunk. Passionate about building applications that are both functional and resilient, she is committed to continuous learning and ethical tech practices.
CyAN Voices: Growing Careers Through Mentorship
In this first mentorship story of 2025, Kuljit Kaur (Australia) shares her experience under the guidance of her CyAN mentor, Shakil Khan (UAE). My Mentoring Experience with CyAN Mentorship Program and Mr. Shakil Khan By Kuljit Kaur Starting a career journey in cybersecurity can be …
Week 18 – SAP NetWeaver’s Visual Composer component
28 April – 04 May 2025
White Hat IT Security’s CVE Of The Week, CVE-2025-31324, is a critical zero-day vulnerability affecting SAP NetWeaver’s Visual Composer component, publicly disclosed in late April, 2025.
With a maximum CVSS score of 10.0, it allows unauthenticated attackers to upload malicious files, potentially leading to full system compromise. According to the enterprise application security firm Onapsis, this vulnerability has the potential to expose over 10,000 SAP applications with internet-facing components to cyberattacks.
SAP (Systems, Applications, and Products in Data Processing) is a global leader in enterprise application software. Its NetWeaver platform supports various business-critical applications. Visual Composer within NetWeaver is a development environment that allows users to design and deploy applications with minimal coding effort.
The CVE-2025-31324 vulnerability exists in the Metadata Uploader function of the Visual Composer. Due to missing authorization checks, remote attackers can exploit this flaw to upload executable files such as JSP webshell files or Java classes directly to the server via crafted POST requests. Once uploaded, these files can be executed using simple GET requests, giving attackers control over the vulnerable system.
Exploitation can lead to data theft, installation of persistent backdoors, lateral movement within the corporate network, or even deployment of ransomware.
Post-compromise, attackers leveraged advanced tools including the Brute Ratel command-and-control framework and the Heaven’s Gate technique for memory manipulation and evasion. These tools facilitated persistent access, code injection into trusted Windows processes, and deployment of encrypted payloads, effectively bypassing many traditional endpoint defenses.
This vulnerability is already being exploited in the wild. Threat actors have been observed uploading web shells to compromised servers, allowing them to issue system commands and further infiltrate enterprise environments.
To mitigate this threat, organizations should immediately apply SAP’s patch detailed in Security Note 3594142.
Additionally, SAP customers are strongly advised to disable the deprecated Visual Composer tool, restrict external access to development-related URLs, centralize log monitoring, and inspect application directories—especially `j2ee/cluster/apps/sapcom/irj/servlet_jsp/irj/root/`—for unauthorized files.
Given the active exploitation and high risk posed by this vulnerability, immediate action is strongly recommended to protect business-critical SAP environments.
SAP Security Patch Day Security Notes:
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2025.html
Futher information:
https://www.securityweek.com/sap-zero-day-possibly-exploited-by-initial-access-broker/
White Hat IT Security is a Europe-based Managed Security Services Provider (MSSP) and proud Microsoft Solution Partner. Its Microsoft-verified managed security solutions (MXDR) reflect their deep expertise and commitment to excellence in cybersecurity. The company was awarded the Partner of the Year Hungary Award by Microsoft in 2024.
With the largest incident response capacity in the CEE region, they’re trusted by organizations to deliver fast, effective, and proactive protection. Their portfolio includes penetration testing, vulnerability assessments, managed Cyber Threat Intelligence, as well as Governance, Risk and Compliance (GRC) consulting and specialized security training.
They are committed to supporting professional initiatives that aim to raise cybersecurity awareness and maturity—both for individuals and organizations. They regularly contribute to the community through knowledge sharing, education, and outreach, helping to build a safer digital future for all.
Cyber (In)Securities – Issue 144
News Quantum computer threat spurring quiet overhaul of internet securityCyberscoop – Greg Otto Pro-Russia hacktivists bombard Dutch public orgs with DDoS attacksBleepingComputer – Bill Toulas Dems look to close the barn door after top DOGE dog has boltedThe Register – Brandon Vigliarolo Canadian Electric Utility …