Latest Cybersecurity News and Articles

---

Pixel Update Bulletin—April 2024 | Android Open Source Project

A total of 24 vulnerabilities leading to elevation of privilege (EoP) and information disclosure were addressed in various Pixel components, and another was resolved in Qualcomm components.

---

Research reveals a resurfaced botnet targeting end-of-life devices

Recent research has identified a campaign that spans several years and targets end-of-life devices. 

---

Google to Delete Billions of Browser Records to Settle ‘Incognito’ Lawsuit

Google will delete billions of data records as part of a settlement for a lawsuit that accused the tech giant of improperly tracking the web-browsing habits of users who thought they were browsing the internet privately.

---

Attack Surface Management vs. Vulnerability Management

Attack surface management (ASM) and vulnerability management (VM) are often confused, and while they overlap, they’re not the same. The main difference between attack surface management and vulnerability management is in their scope: vulnerability management checks a list of known assets, while attack surface management assumes you have unknown assets and so begins with discovery. Let’s look at

---

Mispadu Trojan Targets Europe, Thousands of Credentials Compromised

The banking trojan known as Mispadu has expanded its focus beyond Latin America (LATAM) and Spanish-speaking individuals to target users in Italy, Poland, and Sweden. Targets of the ongoing campaign include entities spanning finance, services, motor vehicle manufacturing, law firms, and commercial facilities, according to Morphisec. "Despite the geographic expansion, Mexico remains the

---

Agent Tesla Targeting United States and Australia

On the 7th of November 2023, an Agent Tesla campaign started against Australian organizations, and the same actor performed another campaign targeting mainly Australian entities.

---

Update: INC Ransom Claims 'Cyber Incident' at UK City Council

The cybercriminals behind INC Ransom are claiming responsibility for the ongoing cybersecurity incident at Leicester City Council, according to a post caught by security researchers.

---

Veracode Acquires Longbow Security to Help Organizations Reduce Application Risk

The acquisition marks the next exciting phase of Veracode, underscoring the company’s commitment to help organizations manage and reduce application risk across the growing attack surface.

---

CISA Sounds Alarm on Deep-Seated Vulnerability in Linux Tool

The Cybersecurity and Infrastructure Security Agency issued an alert Friday warning of a previously unnoticed backdoor in a widely used Linux tool that compresses and encrypts files shared between parties.

---

Critical Security Flaw Found in Popular LayerSlider WordPress Plugin

A critical security flaw impacting the LayerSlider plugin for WordPress could be abused to extract sensitive information from databases, such as password hashes. The flaw, designated as CVE-2024-2879, carries a CVSS score of 9.8 out of a maximum of 10.0. It has been described as a case of SQL injection impacting versions from 7.9.11 through 7.10.0. The issue has been addressed in version

---

How to Design and Deliver an Effective Cybersecurity Exercise

Armed forces have always utilized war-gaming exercises for battlefield training to prepare for times of conflict. With today’s digital transformation, the same concept is being applied in the form of cybersecurity exercises.

---

FCC to Probe ‘Grave’ Weaknesses in Phone Network Infrastructure

The Federal Communications Commission (FCC) says it is taking action to address significant weaknesses in telecommunications networks that can enable cybercrime and spying.

---

Malicious Code in XZ Utils for Linux Systems Enables Remote Code Execution

The malicious code inserted into the open-source library XZ Utils, a widely used package present in major Linux distributions, is also capable of facilitating remote code execution, a new analysis has revealed. The audacious supply chain compromise, tracked as CVE-2024-3094 (CVSS score: 10.0), came to light last week when Microsoft engineer and PostgreSQL developer Andres Freund

---

Losses Linked to Impersonation Scams Top $1 Billion Yearly, FTC Says

A classic type of fraud — when a crook impersonates a business or a government agency — appears to be bigger than ever, according to federal statistics, and it’s now most likely to begin via text message or email instead of a phone call.

---

FTC denies new COPPA application

The FTC denied an application for approval of a new mechanism for obtaining parental consent under the Children’s Online Privacy Protection Rule.

---

Escalating Malware Tactics Drive Global Cybercrime Epidemic

Evasive, basic, and encrypted malware all increased in Q4 2023, fueling a rise in total malware, according to WatchGuard. The average number of malware detections rose 80% from the previous quarter.

---

OWASP Discloses a Data Breach Due to Wiki Misconfiguration

In late February 2024, the Foundation received a few support requests and became aware of a misconfiguration of OWASP’s old Wiki web server. The misconfiguration led to a data breach involving old member resumes.

---

Vulnerability Database Backlog Due to Increased Volume, Changes in ‘Support,’ NIST Says

The National Institute of Standards and Technology (NIST) blamed increases in the volume of software and “a change in interagency support” for the recent backlog of vulnerabilities analyzed in the organization’s National Vulnerability Database (NVD).

---

Government agencies collaborate on a guide to address DDoS attacks

The CISA and the FBI have partnered with the Multi-State Information Sharing and Analysis Center (MS-ISAC) to release a guideline for organizations to defend against DDoS attacks. 

---

Vultur Banking Malware for Android Poses as McAfee Security App

Fox-IT warned that a new, evasive version of Vultur spreads to victims through a hybrid attack that relies on SMS phishing and phone calls that trick the targets into installing a version of the malware that masquerades as the McAfee Security app.