> TODAY'S SUMMARY (22 articles)
Today's cybersecurity landscape highlights several critical threats and vulnerabilities. Fireworks AI has reported a breach stemming from a third-party cloud hack, emphasizing the risks associated with relying on external providers. France has attributed a cyberattack that affected supermarket refrigeration systems to Iranian operatives, signaling geopolitical tensions in cyberspace. Meanwhile, CISA has warned of active exploitation of multiple security flaws in key software, including OpenSSH and IBM products. Additionally, N-able has taken its N-central Cloud offline after the disclosure of 33 zero-day vulnerabilities. On the consumer side, a data breach at Iris Ohyama may expose personal information of 7.7 million individuals. Lastly, Google has issued a security update for Chrome, addressing the eighth actively exploited zero-day this year.
|
// AI-powered summary generated at 08:00
RubyGems, the standard package manager for the Ruby programming language, has temporarily paused account sign ups following what has been described as a "major malicious attack."
"We're dealing with a major malicious attack on Ruby Gems right now," Maciej Mensfeld, senior product manager for softwar...
Anthropic’s AI found five vulnerabilities in curl, but only one low-severity issue proved to be a real vulnerability. In April, Anthropic made considerable noise announcing Mythos, a new artificial intelligence model described as so effective at identifying vulnerabilities in code as to be, in the c...
Mini Shai-Hulud compromises TanStack npm packages and spreads across PyPI
Threat actors obtained names and contact information for an unspecified number of BWH Hotels guests.
The post BWH Hotels Says Hackers Had Access to Reservation Data for 6 Months appeared first on SecurityWeek.
Several vulnerabilities were discovered in the Exim mail transport agent, which may result in remote code execution, denial of service or an information leak. For the oldstable distribution (bookworm), these problems have been fixed in version 4.96-15+deb12u9.
Now that the dust has settled on Mythos dropping, there is space for more considered reflection on the direction of travel. Mythos wasn't a surprise; it's another data point on a trajectory that's bee
Instructure, the company behind the online learning platform Canvas, said it reached an agreement with the extortion group ShinyHunters to prevent data stolen in a recent breach from being leaked online. According to the company’s website, Canvas has more than 30 million active users worldwide and s...
New expat packages are available for Slackware 15.0 and -current to fix a security issue.
Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over an adjacent network.
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.
Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service locally.
Heap-based buffer overflow in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally.
Integer underflow (wrap or wraparound) in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.
External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Insufficient granularity of access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.