πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ Qualys to Unveil VMDR 2.0 at Qualys Security Conference in San Francisco πŸ•΄

Company will detail enhancements to Vulnerability Management, Detection and Response solution next month.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Cybersecurity-Focused SYN Ventures Closes $300 Million Fund II πŸ•΄

Cylance co-founder Ryan Permeh has joined full time as an operating partner.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Vishing Attacks Reach All Time High, According to Latest Agari and PhishLabs Report πŸ•΄

According to the findings, vishing attacks have overtaken business email compromise as the second most reported response-based email threat since Q3 2021.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Zero-Click Zoom Bug Allows Code Execution Just by Sending a Message πŸ•΄

Google has disclosed a nasty set of six bugs affecting Zoom chat that can be chained together for MitM and RCE attacks, no user interaction required.

πŸ“– Read

via "Dark Reading".
πŸ•΄ JFrog Launches Project Pyrsia to Help Prevent Software Supply Chain Attacks πŸ•΄

Open source software community initiative utilizes blockchain technology.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Interpol's Massive 'Operation Delilah' Nabs BEC Bigwig πŸ•΄

A sprawling, multiyear operation nabs a suspected SilverTerrier BEC group ringleader, exposing a massive attack infrastructure and sapping the group of a bit of its strength.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-29402 β€Ό

TP-Link TL-WR840N EU v6.20 was discovered to contain insecure protections for its UART console. This vulnerability allows attackers to connect to the UART port via a serial connection and execute commands as the root user without authentication.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-29248 β€Ό

Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a malicious server to set cookies for unrelated domains. The cookie middleware is disabled by default, so most library consumers will not be affected by this issue. Only those who manually add the cookie middleware to the handler stack or construct the client with ['cookies' => true] are affected. Moreover, those who do not use the same Guzzle client to call multiple domains and have disabled redirect forwarding are not affected by this vulnerability. Guzzle versions 6.5.6 and 7.4.3 contain a patch for this issue. As a workaround, turn off the cookie middleware.

πŸ“– Read

via "National Vulnerability Database".
πŸ” Insider Threats Responsible for 68% of UK Legal Sector Data Breaches πŸ”

Data analyzed this week highlights the percentage of data breaches carried out by insiders at law firms in the U.K.

πŸ“– Read

via "".
πŸ•΄ Is Your Data Security Living on the Edge? πŸ•΄

Gartner's security service edge fundamentally changes how companies should be delivering data protection in a cloud and mobile first world.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Forescout Launches Forescout Frontline to Help Organizations Tackle Ransomware and Real Time Threats πŸ•΄

New threat hunting and risk identification service provides organizations with an enterprise-wide baseline of their threat landscape and risk exposure.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-29256 β€Ό

sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` time when installing versions of `sharp` prior to the latest v0.30.5. If an attacker has the ability to set the value of the `PKG_CONFIG_PATH` environment variable in a build environment then they might be able to use this to inject an arbitrary command at `npm install` time. This is not part of any runtime code, does not affect Windows users at all, and is unlikely to affect anyone that already cares about the security of their build environment. This problem is fixed in version 0.30.5.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-31651 β€Ό

In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-31650 β€Ό

In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.

πŸ“– Read

via "National Vulnerability Database".
πŸ“’ Open source packages with millions of installs hacked to harvest AWS credentials πŸ“’

Two popular open source packages used by Python and PHP developers have been quietly compromised with successful attacks already being reported

πŸ“– Read

via "ITPro".
πŸ“’ DOE β€Œβ€Œβ€Œβ€Œβ€Œβ€Œβ€Œβ€Œβ€Œβ€Œβ€Œβ€Œβ€Œβ€Œβ€Œfundsβ€Œ β€Œdevelopment of Qunnect's Quantum Repeater πŸ“’

The $1.85 million grant will eventually pave the way for quantum internet

πŸ“– Read

via "ITPro".
❌ Cybergang Claims REvil is Back, Executes DDoS Attacks ❌

Actors claiming to be the defunct ransomware group are targeting one of Akami’s customers with a Layer 7 attack, demanding an extortion payment in Bitcoin.

πŸ“– Read

via "Threat Post".
⚠ Poisoned Python and PHP packages purloin passwords for AWS access ⚠

More supply chain trouble - this time with clear examples so you can learn how to spot this stuff yourself.

πŸ“– Read

via "Naked Security".
β€Ό CVE-2021-42692 β€Ό

There is a stack-overflow vulnerability in tinytoml v0.4 that can cause a crash or DoS.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Most Common Threats in DBIR πŸ•΄

Supply chain and ransomware attacks increased dramatically this year, which explains why so many data breaches in this year's DBIR were grouped as system intrusion.

πŸ“– Read

via "Dark Reading".
⚠ Who’s watching your webcam? The Screencastify Chrome extension story… ⚠

When you really need to make exceptions in cybersecurity, specify them as explicitly as you can.

πŸ“– Read

via "Naked Security".