> TODAY'S SUMMARY (84 articles)
Today’s cybersecurity landscape reveals several critical threats and trends. A 25-year-old crypto thief was sentenced for a SIM-swapping scheme that stole nearly $260,000. Cisco and Splunk have patched multiple vulnerabilities that could allow unauthorized access or remote code execution. Meanwhile, attackers targeted a critical flaw in Atlassian products, exploiting it within hours of public disclosure. Notably, a Russian-aligned group, UAC-0099, utilized a new infostealer and RAT against Ukrainian personnel. Additionally, reports indicate that thousands of Android devices shipped with pre-installed ad-fraud malware. Finally, the FBI warns of ongoing FortiBleed attacks that lock victims out of their Fortinet devices, emphasizing the evolving nature of cyber threats.
|
// AI-powered summary generated at 16:01
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
CRPx0 is a complex, stealthy malware campaign that targets macOS and Windows systems, and appears to have Linux capabilities in development.
The post Free OnlyFans Lure Used to Spread Cross-Platform CRPx0 Malware appeared first on SecurityWeek.
Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.
Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.
General Motors has agreed to a $12.75 million settlement with California over allegations that it unlawfully sold drivers’ location and behavioral data to brokers, marking the largest penalty in the history of the state’s Consumer Privacy Act. Prosecutors say GM made approximately $20 million nation...
Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.
Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.
The maker of the Canvas school software said it "reached an agreement" with the hackers, but provided no guarantees that the hackers would not release the data or keep their word.
Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally.
Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network.
Even with strong passwords and MFA, breaches still happen. See the hidden gaps, common risks, and how to close them effectively.
Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.
External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Learn how to build phishing awareness training that helps employees recognize attacks, report them quickly, and reduce risk in your organization.
External control of file name or path in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
The company that operates online learning system Canvas said it struck a deal with hackers to delete the data they pilfered in a cyberattack that created chaos for students, many of them in the middle of finals.
The post Deal Reached With Hackers to Delete Data Stolen From the Canvas Educational Pla...
Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.
Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.