πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.1K subscribers
88.4K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ¦… High-Risk CVE-2024-7965 Vulnerability in Chrome’s V8 Engine Requires Quick Fix πŸ¦…

Key Takeaways CISA has included a type of confusion vulnerability affecting Google Chrome and potentially other Chromiumbased browsers in its Known Exploited Vulnerabilities KEV catalog, highlighting its seriousness and potential for exploitation. CVE20247965 affects Chrome's V8 JavaScript engine, allowing attackers to exploit heap corruption through specially crafted HTML pages. Its high CVSS score of 8.8 indicates a severe threat to system confidentiality and integrity. Google has acknowledged that CVE20247965 is actively being exploited. A critical patch has been released in Chrome versions 128.0.6613.84 for Linux and 128.0.6613.84.85 for Windows and Mac. Due to the active exploitation of this vulnerability, it is crucial for all users to update their browsers immediat...

πŸ“– Read more.

πŸ”— Via "CYBLE"

----------
πŸ‘οΈ Seen on @cibsecurity
β™ŸοΈ New 0-Day Attacks Linked to China’s β€˜Volt Typhoon’ β™ŸοΈ

Malicious hackers are exploiting a zeroday vulnerability in Versa Director, a software product used by many Internet and IT service providers. Researchers believe the activity is linked to Volt Typhoon, a Chinese cyber espionage group focused on infiltrating critical U.S. networks and laying the groundwork for the ability to disrupt communications between the United States and Asia during any future armed conflict with China.

πŸ“– Read more.

πŸ”— Via "Krebs on Security"

----------
πŸ‘οΈ Seen on @cibsecurity
❀1
πŸ“” MOVEit Hack Exposed Personal Data of Half Million TDECU Users πŸ“”

The Texas Dow Employees Credit Union told the Maine Attorney General the MOVEit data breach compromised information of over 500,000 members.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ¦… Cloud Storage Bucket Security: PII Leak Brings Renewed Focus to Storage Bucket Access Controls πŸ¦…

Key Takeaways News of a Google Cloud Storage bucket data leak has once again drawn public attention to the risks of misconfigured cloud storage buckets, one of the most common cloud security issues and causes of data leaks. Alices Table, a former contestant on ABCs Shark Tank, inadvertently leaked the personally identifiable information PII of more than 83,000 customers from a misconfigured Google Cloud Storage bucket. The leak underscores the importance of cloud storage bucket access controls as well as regularly auditing permissions and monitoring for data leaks. Cloud storage bucket leaks are very common Cyble Odin is presently detecting more than 500,000 such exposures between AWS and Google Cloud Storage. We look at best practices for cloud storage bucket access con...

πŸ“– Read more.

πŸ”— Via "CYBLE"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ”₯2
πŸ•΅οΈβ€β™‚οΈ PoC Exploit for Zero-Click Vulnerability Made Available to the Masses πŸ•΅οΈβ€β™‚οΈ

The exploit can be accessed on GitHub and makes it easier for the flaw to be exploited by threat actors.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“” Microsoft 365 Copilot Vulnerability Exposes User Data Risks πŸ“”

The flaw in Microsoft 365 Copilot allowed data theft using ASCII smuggling and prompt injection.

πŸ“– Read more.

πŸ”— Via "Infosecurity Magazine"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ macOS Version of HZ RAT Backdoor Targets Chinese Messaging App Users πŸ–‹οΈ

Users of Chinese instant messaging apps like DingTalk and WeChat are the target of an Apple macOS version of a backdoor named HZ RAT. The artifacts "almost exactly replicate the functionality of the Windows version of the backdoor and differ only in the payload, which is received in the form of shell scripts from the attackers' server," Kaspersky researcher Sergey Puzan said. HZ RAT was first.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“’ Nozomi Networks unveils new Mandiant-powered security tools πŸ“’

The Nozomi TI Expansion Pack provides customers with access to both Nozomi and Mandiant threat intelligence capabilities.

πŸ“– Read more.

πŸ”— Via "ITPro"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ“’ Volt Typhoon is wreaking havoc again – this time on US internet providers πŸ“’

Chinese statebacked hackers are thought to be actively exploiting a zeroday in SDWAN software to infect corporate networks at US internet providers.

πŸ“– Read more.

πŸ”— Via "ITPro"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ Hitachi Energy Vulnerabilities Plague SCADA Power Systems πŸ•΅οΈβ€β™‚οΈ

The company has assessed four of the five disclosed vulnerabilities as being of high to critical severity.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ Manufacturing Sector Under Fire From Microsoft Credential Thieves πŸ•΅οΈβ€β™‚οΈ

The emails impersonate wellknown companies in the industry, fooling the victim into thinking they are communicating with a legitimate entity.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ Why LLMs Are Just the Tip of the AI Security Iceberg πŸ•΅οΈβ€β™‚οΈ

With the right processes and tools, organizations can implement advanced AI security frameworks that make hidden risks visible, enabling security teams to track and address them before impact.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ Hundreds of LLM Servers Expose Corporate, Health & Other Online Data πŸ•΅οΈβ€β™‚οΈ

LLM automation tools and vector databases can be rife with sensitive data and vulnerable to pilfering.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ Zimbabwe Trains Government Officials in Cybersecurity Skills πŸ•΅οΈβ€β™‚οΈ

African nation's proactive approach to cybersecurity comes amid a rise in painful cyberattacks, including the breach of a major bank.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ PoC Exploit for Zero-Click Vulnerability Made Available to the Masses πŸ•΅οΈβ€β™‚οΈ

The exploit can be accessed on GitHub and makes it easier for the flaw to be exploited by threat actors.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ•΅οΈβ€β™‚οΈ Microsoft's Sway Serves as Launchpad for 'Quishing' Campaign πŸ•΅οΈβ€β™‚οΈ

The attack is a mashup of QR codes and phishing that gets users to click on links to malicious webpages.

πŸ“– Read more.

πŸ”— Via "Dark Reading"

----------
πŸ‘οΈ Seen on @cibsecurity
🦿 Price Drop: This Complete Ethical Hacking Bundle is Now $40 🦿

Get a comprehensive, potentially lucrative ethical hacking education with 18 courses on today's top tools and tech. This bundle is just 39.97 for a limited time.

πŸ“– Read more.

πŸ”— Via "Tech Republic"

----------
πŸ‘οΈ Seen on @cibsecurity
🦿 GDPR Data Breach Notification Letter (Free Download) 🦿

In the current business environment, it is almost inevitable that an organization will experience a security breach that exposes collected personal data to unauthorized access. Under the provisions of the General Data Protection Regulation, regardless of the severity of the security breach, organizations must inform their EU customers and stakeholders of the incident in a ...

πŸ“– Read more.

πŸ”— Via "Tech Republic"

----------
πŸ‘οΈ Seen on @cibsecurity
🦿 What Is Cybersecurity Awareness Training? Why Your Business Needs it 🦿

Organizations of all sizes are being targeted by bad actors, which is why cybersecurity awareness training is more important than ever. Unfortunately, most organizations are not motivated to implement such training. A study by IBM found that barely half 51 of organizations that had already experienced a data breach in the past year planned to ...

πŸ“– Read more.

πŸ”— Via "Tech Republic"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ Fortra Issues Patch for High-Risk FileCatalyst Workflow Security Vulnerability πŸ–‹οΈ

Fortra has addressed a critical security flaw impacting FileCatalyst Workflow that could be abused by a remote attacker to gain administrative access. The vulnerability, tracked as CVE20246633, carries a CVSS score of 9.8, and stems from the use of a static password to connect to a HSQL database. "The default credentials for the setup HSQL database HSQLDB for FileCatalyst Workflow are.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity
πŸ–‹οΈ APT-C-60 Group Exploit WPS Office Flaw to Deploy SpyGlace Backdoor πŸ–‹οΈ

A South Koreaaligned cyber espionage has been linked to the zeroday exploitation of a nowpatched critical remote code execution flaw in Kingsoft WPS Office to deploy a bespoke backdoor dubbed SpyGlace. The activity has been attributed to a threat actor dubbed APTC60, according to cybersecurity firms ESET and DBAPPSecurity. The attacks have been found to infect Chinese and East Asian users.

πŸ“– Read more.

πŸ”— Via "The Hacker News"

----------
πŸ‘οΈ Seen on @cibsecurity