Latest Cybersecurity News and Articles
11 October 2023
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a high-severity flaw in Adobe Acrobat Reader to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
Tracked as CVE-2023-21608 (CVSS score: 7.8), the vulnerability has been described as a use-after-free bug that can be exploited to achieve remote code execution (RCE) with the
11 October 2023
A report reveals more than 80% of survey respondents indicated a critical security issue in deployed software impacted DevOps delivery schedule in the last year.
11 October 2023
The victims include Hughes Gill Cochrane Tinetti, Saltire Energy, Centek Industries, NachtExpress Austria, WCM Europe, Starr Finley, and an unknown firm. These attacks are part of a wider scheme by the threat actor, targeting major firms globally.
11 October 2023
Passwords are at the core of securing access to an organization's data. However, they also come with security vulnerabilities that stem from their inconvenience. With a growing list of credentials to keep track of, the average end-user can default to shortcuts. Instead of creating a strong and unique password for each account, they resort to easy-to-remember passwords, or use the same password
11 October 2023
Collaboration and information-sharing among North Korean APTs have increased during the COVID-19 pandemic, leading to a more organized and coordinated state-sponsored structure, researchers from Mandiant revealed in a report.
11 October 2023
Google has released Chrome 118 to the stable channel with patches for 20 vulnerabilities, including one rated ‘critical severity’.
The post Chrome 118 Patches 20 Vulnerabilities appeared first on SecurityWeek.
11 October 2023
Threat actors have been exploiting a zero-day vulnerability in the HTTP/2 protocol since August to launch the largest DDoS attacks ever seen, according to several tech infrastructure giants.
11 October 2023
Organizations respond to HTTP/2 Rapid Reset zero-day vulnerability exploited to launch the largest DDoS attacks seen to date.
The post Organizations Respond to HTTP/2 Zero-Day Exploited for DDoS Attacks appeared first on SecurityWeek.
11 October 2023
McLaren Health Care is facing three proposed federal class action lawsuits after a Russian ransomware-as-a-service group stole the personal information of 2.5 million patients, alleging negligence in protecting patient privacy.
11 October 2023
While there is quite a bit of buzz and hype around AI, it is a technology that can add tremendous value to security programs.
The post Applying AI to API Security appeared first on SecurityWeek.
11 October 2023
A new card skimming campaign discovered by Akamai utilizes 404 error pages on online retailers' websites to hide malicious code and steal customers' credit card information. The stolen data is exfiltrated via seemingly benign image requests, thus evading network monitoring tools. One effective mitigation is to regularly monitor and audit website resources, ensuring that no unauthorized modifications have been made.
11 October 2023
The two actively exploited flaws include information disclosure in Microsoft WordPad and privilege escalation in Skype for Business. Microsoft has also fixed flaws in Microsoft Message Queuing, Layer 2 Tunneling Protocol, and Windows IIS Server.
11 October 2023
The Joint Cyber Defense Collaborative published a series of recommendations on Tuesday for operational technology vendors and critical infrastructure facilities to promote the secure use of open-source software.
11 October 2023
CISA has added five bugs to its Known Exploited Vulnerabilities catalog, including the recent WordPad, Skype, and HTTP/2 zero-days.
The post CISA Warns of Attacks Exploiting Adobe Acrobat Vulnerability appeared first on SecurityWeek.
11 October 2023
Organizations are advised to check all their software for the presence of the CVE-2023-4863 vulnerability in the libwebp image rendering library and apply patches accordingly.
11 October 2023
Google is making passkeys the default login setting for users, aiming to replace passwords and enhance security. Passkeys reduce the risk of phishing attacks and offer a more secure alternative to traditional passwords.
11 October 2023
ICS Patch Tuesday: Siemens and Schneider Electric release over a dozen advisories addressing more than 40 vulnerabilities.
The post ICS Patch Tuesday: Siemens Ruggedcom Devices Affected by Nozomi Component Flaws appeared first on SecurityWeek.
11 October 2023
Security researchers exposed a cyberespionage operation named Stayin Alive, which targets the telecommunications sector and government entities in Kazakhstan, Uzbekistan, Pakistan, and Vietnam. The campaign employs spear-phishing emails and DLL side-loading to deliver archive files to the victims’ systems. It is recommended to refrain from attending to unsolicited emails/messages.
11 October 2023
Adobe has released patches for multiple security vulnerabilities, including critical flaws in Adobe Commerce and Photoshop that could lead to code execution and privilege escalation.
11 October 2023
Despite the breach, Volex's operations remain largely unaffected, and the financial impact is expected to be minimal. The details of the breach, including the method of attack and any ransom demands, remain undisclosed.