Data Breaches
Progress Software confirms the SEC has launched its own investigation into costly ransomware zero-days in the MOVEit file transfer software.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
WordPress 6.4.2 patches a flaw that could be chained with another vulnerability to execute arbitrary code.
Cyberwarfare
Russian threat actor APT28 has been exploiting a no-interaction Outlook vulnerability in attacks against 14 countries.
Vulnerabilities
Atlassian has released patches for critical-severity remote code execution flaws in Confluence and other products.
Endpoint Security
LogoFAIL is an UEFI image parser attack allowing hackers to compromise consumer and enterprise devices using malicious logo images.
Vulnerabilities
The Shadowserver Foundation warns of an increase in the number of devices hacked via recent Cisco IOS XE vulnerabilities.
Vulnerabilities
Chrome 120 was released in the stable channel with patches for 10 vulnerabilities, including five externally reported flaws.
ICS/OT
Industrial routers made by Chinese company Yifan are affected by several critical vulnerabilities that can expose organizations to attacks.
ICS/OT
Flaw poses a direct threat to the SOCKS5 proxy handshake process in cURL and can be exploited remotely in some non-standard configurations.
Vulnerabilities
Citrix has released patches for a critical information disclosure vulnerability in NetScaler ADC and NetScaler Gateway.
Vulnerabilities
Google has released Chrome 118 to the stable channel with patches for 20 vulnerabilities, including one rated ‘critical severity’.
Network Security
Organizations respond to HTTP/2 Rapid Reset zero-day vulnerability exploited to launch the largest DDoS attacks seen to date.
Vulnerabilities
CISA has added five bugs to its Known Exploited Vulnerabilities catalog, including the recent WordPad, Skype, and HTTP/2 zero-days.
Cyberwarfare
Microsoft says an APT group tracked as Storm-0062 has been hacking Confluence installations since mid-September, three weeks before Atlassian’s disclosure.
Application Security
Microsoft patches more than 100 vulnerabilities across the Windows ecosystem and warned that three are already being exploited in the wild.
Incident Response
Adobe Commerce customers exposed to code execution, privilege escalation, arbitrary file system read, and security feature bypass attacks.
Vulnerabilities
SAP has released seven new notes as part of its October 2023 Security Patch Day, all rated ‘medium severity’.
Vulnerabilities
A one-click exploit targeting the Libcue component of the GNOME desktop environment could pose a serious threat to Linux systems.
Artificial Intelligence
Researchers have warned that powerful AI models could be used to supercharge online disinformation, cyberattacks or creation of bioweapons.
CISO Strategy
Artificial Intelligence
