Latest Cybersecurity News and Articles

---

EU Formalizes Cybersecurity Support for Ukraine

The new agreement was signed by the EU security agency ENISA, Ukraine’s National Cybersecurity Coordination Center (NCCC), and the Administration of the State Service of Special Communications and Information Protection of Ukraine (SSSCIP).

---

Addressing the State of AI’s Impact on Cyber Disinformation/Misinformation

By embracing a strategy that combines technological advancements with critical thinking skills, collaboration, and a culture of continuous learning, organizations can safeguard against AI's disruptive effects. The post Addressing the State of AI’s Impact on Cyber Disinformation/Misinformation appeared first on SecurityWeek.

---

Truepill Mail-Order Pharmacy Hack Affects Nearly 2.4 Million People

The breach, which occurred between August 30 and September 1, resulted in the unauthorized access of files containing patient names, medication type, demographic information, and prescribing physician names.

---

RADICL Adds $9 Million in Funding to Fortify Cyber Defenses of SMBs in Defense Industrial Base

RADICL, a cybersecurity startup specializing in providing threat protection to SMBs, secured an additional $9 million in early-stage funding, adding to $3 million that the company had raised previously. The post RADICL Adds $9 Million in Funding to Fortify Cyber Defenses of SMBs in Defense Industrial Base appeared first on SecurityWeek.

---

IPStorm Botnet With 23,000 Proxies for Malicious Traffic Dismantled

The IPStorm botnet evolved since 2019, targeting Windows, Linux, Mac, and Android devices, using the InterPlanetary File System (IPFS) network to hide its activities and offering access to thousands of compromised systems for a high price.

---

Three Ways Varonis Helps You Fight Insider Threats

What do basketball teams, government agencies, and car manufacturers have in common? Each one has been breached, having confidential, proprietary, or private information stolen and exposed by insiders. In each case, the motivations and methods varied, but the risk remained the same: insiders have access to too much data with too few controls. Insider threats continue to prove difficult for

---

State-Backed Hackers a Threat to Australia, Agency Warns

The AUKUS partnership, with its focus on nuclear submarines and other advanced military capabilities, is likely a target for state actors looking to steal intellectual property. The post State-Backed Hackers a Threat to Australia, Agency Warns appeared first on SecurityWeek.

---

Microsoft Releases Patch Updates for Five New Zero-Day Vulnerabilities

The three actively exploited zero-day vulnerabilities, including a Windows SmartScreen bypass and privilege escalation flaws, emphasize the need for users to exercise caution when interacting with internet shortcuts and hyperlinks.

---

Chipmaker Patch Tuesday: Intel, AMD Address Over 130 Vulnerabilities

Intel and AMD have informed their customers about a total of more than 130 vulnerabilities found in their products. The post Chipmaker Patch Tuesday: Intel, AMD Address Over 130 Vulnerabilities appeared first on SecurityWeek.

---

VMware Discloses Critical VCD Appliance Authentication Bypass With No Patch

VMware has disclosed a critical authentication bypass vulnerability (CVE-2023-34060) affecting its Cloud Director appliance deployments. The flaw only affects upgraded versions of the VCD Appliance 10.5.

---

New Intel CPU Vulnerability ‘Reptar’ Can Allow DoS Attacks, Privilege Escalation

A new Intel CPU vulnerability tracked as Reptar and CVE-2023-23583 can be exploited for DoS attacks and possibly privilege escalation. The post New Intel CPU Vulnerability ‘Reptar’ Can Allow DoS Attacks, Privilege Escalation appeared first on SecurityWeek.

---

MySQL Servers, Docker Hosts Infected With DDoS Malware

The attackers upload a malicious DLL as a User-Defined Function library, allowing them to execute commands and deploy the Ddostf malware. The malware collects system information and waits for commands to launch DDoS attacks.

---

Microsoft Fixes Critical Azure CLI Flaw That Leaked Credentials in Logs

Users are advised to avoid exposing Azure CLI output in logs, regularly rotate keys and secrets, and review best practices for securing Azure Pipelines and GitHub Actions to prevent accidental exposure of sensitive information.

---

WP Fastest Cache Plugin Bug Exposes 600K WordPress Sites to Attacks

The SQL injection vulnerability, tracked as CVE-2023-6063 and with a high-severity score of 8.6, can be exploited by manipulating a cookie value to execute unauthorized SQL queries. Over 600,000 websites are still running the vulnerable plugin.

---

Reptar: New Intel CPU Vulnerability Impacts Multi-Tenant Virtualized Environments

Intel has released fixes to close out a high-severity flaw codenamed Reptar that impacts its desktop, mobile, and server CPUs. Tracked as CVE-2023-23583 (CVSS score: 8.8), the issue has the potential to "allow escalation of privilege and/or information disclosure and/or denial of service via local access." Successful exploitation of the vulnerability could also permit a bypass of the CPU's

---

Alert: Microsoft Releases Patch Updates for 5 New Zero-Day Vulnerabilities

Microsoft has released fixes to address 63 security bugs in its software for the month of November 2023, including three vulnerabilities that have come under active exploitation in the wild. Of the 63 flaws, three are rated Critical, 56 are rated Important, and four are rated Moderate in severity. Two of them have been listed as publicly known at the time of the release. The updates are in

---

Urgent: VMware Warns of Unpatched Critical Cloud Director Vulnerability

VMware is warning of a critical and unpatched security flaw in Cloud Director that could be exploited by a malicious actor to get around authentication protections. Tracked as CVE-2023-34060 (CVSS score: 9.8), the vulnerability impacts instances that have been upgraded to version 10.5 from an older version. "On an upgraded version of VMware Cloud Director Appliance 10.5, a malicious actor with

---

Microsoft Patch Tuesday, November 2023 Edition

Microsoft today released updates to fix more than five dozen security holes in its Windows operating systems and related software, including three "zero day" vulnerabilities that Microsoft warns are already being exploited in active attacks.

---

Critical Authentication Bypass Flaw in VMware Cloud Director Appliance

VMware flaw carries a CVSS severity-score of 9.8/10 and can be exploited to bypass login restrictions when authenticating on certain ports. The post Critical Authentication Bypass Flaw in VMware Cloud Director Appliance appeared first on SecurityWeek.

---

Australia politics live: Scott Morrison defends handling of Aukus; data breaches double in a year

Former PM denies lying to French president when securing the nuclear sub deal; signals directorate records huge jump in attacks on networks. Follow the day’s news liveGet our morning and afternoon news emails, free app or daily news podcastDoes Richard Marles want to see a ceasefire in Gaza?He told ABC radio:I think the whole world would love to see this stop. And the humanitarian pauses that have been put in place are certainly very welcome.But in moving to a ceasefire, it cannot be one sided.We’re obviously focussed on this and to keep Australians safe. I remind Australians that we argued against this in this High Court. This is not our decision. But in the decision having been made by the High Court, these people have been released. They’ve been put on bridging visas with the strictest possible conditions.That was something that the government did straightaway. We are continuing to assess what option we have here, which include potential legislative responses and we’ll be working on that very quickly. Obviously, and the other point is, the High Court has actually not released its full judgment yet which makes the situation more difficult but our primary focus here is on keeping the community safe and we will continue to do that. Continue reading...