> TODAY'S SUMMARY (120 articles)
Today's cybersecurity landscape highlights significant threats and vulnerabilities. Check Point has linked a suspected Chinese malware supplier to multiple hacking campaigns utilizing a shared malware framework. Meanwhile, critical flaws in Xen Orchestra have been exploited, allowing attackers to execute arbitrary code with admin privileges. Microsoft’s November Patch Tuesday addressed over 1,200 vulnerabilities, including a zero-day in Outlook that could leak NTLM hashes. Additionally, hackers are targeting Qlik Sense servers and exploiting vulnerabilities in Cisco BroadWorks and Openwave. Lastly, the rise of AI-enhanced impersonation fraud continues to pose challenges, with three arrests reported in connection to these schemes. Organizations are urged to prioritize patch management and enhance their security posture against evolving threats.
|
// AI-powered summary generated at 16:00
A security issue was discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. For the oldstable distribution (bookworm), this problem has been fixed in version 144.0.7559.96-1~deb12u1.
The Irish government plans to draft legislation that would make it legal for law enforcement to use spyware, Minister of Justice Jim O’Callaghan said.
Is Your Organization Ready to Scale NHIs Safely and Efficiently? Scaling Non-Human Identities (NHIs) is a complex endeavor, particularly in dynamic industries such as financial services, healthcare, and technology-driven sectors that rely heavily on cloud computing. Where NHIs serve as the backbone...
How Do Non-Human Identities Revolutionize Cloud Security? What are Non-Human Identities (NHIs), and why do they hold the key to revolutionizing cloud security for organizations across various industries? Understanding Non-Human Identities and Their Importance Safeguarding sensitive data requires mor...
Okta is warning about custom phishing kits built specifically for voice-based social engineering (vishing) attacks. BleepingComputer has learned that these kits are being used in active attacks to steal Okta SSO credentials for data theft. [...]
Are Non-Human Identities the Missing Link in Cybersecurity AI Reliability? Cybersecurity is an evolving field, constantly adapting to new threats and vulnerabilities. But have you considered how Non-Human Identities (NHIs) are shaping cybersecurity, especially regarding AI reliability? NHIs, essenti...
What Role Do AI Secrets Play in Ensuring Cloud Security? Where digital threats loom larger than ever, how do organizations navigate complex cloud security? The answer lies in effectively managing AI secrets. This approach ensures that machine identities, an often overlooked aspect of cybersecurity,...
An hours-long outage is preventing Microsoft's enterprise customers from accessing their inboxes, files, and video meetings.
New capability gives enterprises verified, policy-based control over AI agents and automated traffic
The post Kasada Launches AI Agent Trust to Secure Agentic Commerce appeared first on Security Boulevard.
The lawsuit comes a day after a TSA official vigorously defended the practice as critical to “national security” in testimony to Congress.Â
The post Watchdog group sues for TSA data sharing agreement with ICEÂ appeared first on CyberScoop.
pyasn1 could be made to crash if it received specially crafted input.
Ianis Antropenko, a Russian national living in California, admitted to committing ransomware attacks against at least 50 victims. He faces up to 25 years in jail.
The post Leader of ransomware crew pleads guilty to four-year crime spree appeared first on CyberScoop.
Vlatko Kosturjak discovered that BIND, a DNS server implementation, does not properly handle malformed BRID/HHIT records, which may result in denial of service (named daemon crash). For the oldstable distribution (bookworm), this problem has been fixed in version 1:9.18.44-1~deb12u1.
Session 9D: Github + OSN Security
Authors, Creators & Presenters: Aditya Sirish A Yelgundhalli (New York University), Patrick Zielinski (New York University), Reza Curtmola (New Jersey Institute of Technology), Justin Cappos (New York University)
PAPER
Rethinking Trust In Forge-Based Git Securi...
Ring says the new feature will identify if video edits have been made, even if they're minor.
Amit Sheps, head of product marketing at CyCognito, discusses the growing challenges cybersecurity teams face as artificial intelligence accelerates the expansion of enterprise attack surfaces. He explains why visibility, continuous assessment, and proactive risk management are becoming essential i...
A new Android click-fraud trojan family uses TensorFlow ML to visually detect and tap ads, bypassing traditional script-based click techniques. Researchers at cybersecurity firm Dr.Web discovered a new Android click-fraud trojan family that uses TensorFlow.js ML models to visually detect and tap ads...
Logging in, not breaking in Unknown attackers are abusing Microsoft SharePoint file-sharing services to target multiple energy-sector organizations, harvest user credentials, take over corporate inboxes, and then send hundreds of phishing emails from compromised accounts to contacts inside and outsi...
The developer of the popular curl command-line utility and library announced that the project will end its HackerOne security bug bounty program at the end of this month, after being overwhelmed by low-quality AI-generated vulnerability reports. [...]
In this week's newsletter, Bill hammers home the old adage, "Know your environment" — even throughout alert fatigue.