Krebs on Security

AUGUST 13, 2024

Microsoft today released updates to fix at least 90 security vulnerabilities in Windows and related software, including a whopping six zero-day flaws that are already being actively exploited by attackers. Image: Shutterstock. This month’s bundle of update joy from Redmond includes patches for security holes in Office ,NET , Visual Studio , Azure , Co-Pilot , Microsoft Dynamics , Teams , Secure Boot, and of course Windows itself.

Internet 248

Internet Internet Malware Software 248

Tech Republic Security

AUGUST 13, 2024

On August 6, 2.7 billion records from National Public Data, including social security numbers, were leaked on a dark web forum.

Data breaches 218

Data breaches 218

The Last Watchdog

AUGUST 13, 2024

Application Security Posture Management ( ASPM ) arose a few years ago as a strategy to help software developers and security teams continually improve the security of business applications. Related: Addressing rising cyber compliance pressures At Black Hat USA 2024, an iteration called Active ASPM is in the spotlight. I had the chance to visit with Neatsun Ziv , CEO and co-founder of Tel Aviv-based OX Security , a leading Active ASPM solutions provider.

CISO 130

CISO Internet Internet Software 130

Tech Republic Security

AUGUST 13, 2024

A StickmanCyber report reveals a critical cybersecurity skills shortage in Australia, which can have both short- and long-term business implications

Cybersecurity 184

Cybersecurity 184

Advertisement

Tech leaders today are facing shrinking budgets and investment concerns. This whitepaper provides insights from over 1,000 tech leaders on how to stay secure and attract top cybersecurity talent, all while doing more with less. Download today to learn more!

Cybersecurity

Penetration Testing

AUGUST 13, 2024

Security researchers have disclosed the technical details and proof-of-concept (PoC) exploit codes for three vulnerabilities (CVE-2023-4206, CVE-2023-4207, and CVE-2023-4208) in the Linux kernel, impacting versions v3.18-rc1 to v6.5-rc4. These “use-after-free”... The post Linux Kernel Vulnerabilities Expose Systems to Privilege Escalation: Flaws Detailed and Exploit Code Released appeared first on Cybersecurity News.

Cybersecurity 135

Cybersecurity 135

Thales Cloud Protection & Licensing

AUGUST 13, 2024

The Post-Quantum Cryptography Algorithms are finalized! Now what? josh.pearson@t… Tue, 08/13/2024 - 16:11 With the recent release from NIST about their final, published Post-Quantum Cryptography (PQC) algorithms (ML-KEM (formerly Kyber), ML-DSA (formerly Dilithium), SLH-DSA (formerly SPHINCS+) and with it the imminent end-of-life of the encryption foundations we have relied upon for decades, many organizations are left wondering exactly what they should do next.

Computers and Electronics 118

Computers and Electronics Encryption Technology Internet 118

Security Boulevard

AUGUST 13, 2024

A report published today by Cato Networks finds three years after its discovery in 2021 there was a 61% increase in attempts to exploit Log4j vulnerabilities in inbound traffic and a 79% increase in the attempted use of Log4j in WANbound traffic in the first half of this year. The post Cato Network Reports Spike in Attempts to Exploit Log4j Vulnerabilities appeared first on Security Boulevard.

Security Awareness 119

Security Awareness Cybersecurity 119

The Hacker News

AUGUST 13, 2024

Microsoft on Tuesday shipped fixes to address a total of 90 security flaws, including 10 zero-days, of which six have come under active exploitation in the wild. Of the 90 bugs, seven are rated Critical, 79 are rated Important, and one is rated Moderate in severity. This is also in addition to 36 vulnerabilities that the tech giant resolved in its Edge browser since last month.

126

126

Security Affairs

AUGUST 13, 2024

CERT-UA warned that Russia-linked actor is impersonating the Security Service of Ukraine (SSU) in a new phishing campaign to distribute malware. The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new phishing campaign targeting organizations in the country, including government entities. The campaign, tracked as UAC-0198, has been active since July.

Government 118

Government Phishing Malware Banking 118

Security Boulevard

AUGUST 13, 2024

North Korean army of remote IT workers enabled by Matthew Isaac Knoot, alleges DoJ. The post WTH? DPRK WFH Ransomware Redux: 3rd Person Charged appeared first on Security Boulevard.

Ransomware 116

Ransomware Social Engineering Data privacy Engineering 116

Speaker: Speakers:

In today's digital age, having an untrained workforce can be a significant risk to your business. Cyber threats are evolving; without proper training, your employees could be the weakest link in your defense. This webinar empowers leaders like you with the tools and strategies needed to transform your employees into a robust frontline defense against cyber attacks.

Cyber Attacks

Security Affairs

AUGUST 13, 2024

Ivanti warned of a critical authentication bypass flaw in its Virtual Traffic Manager (vTM) appliances that can allow attackers to create rogue administrator accounts. Ivanti addressed a critical authentication bypass vulnerability, tracked as CVE-2024-7593 (CVSS score of 9.8), impacting Virtual Traffic Manager (vTM) appliances that can allow attackers to create rogue administrator accounts.

Authentication 115

Authentication Accountability Software Internet 115

We Live Security

AUGUST 13, 2024

Your phone number is more than just a way to contact you – scammers can use it to target you with malicious messages and even exploit it to gain access to your bank account or steal corporate data

Banking 114

Banking Accountability 114

Security Boulevard

AUGUST 13, 2024

That’s a wrap for Black Hat 2024! We had a great show and met many of you at the booth or on the show floor. I hope you were able to come by, watched a session by Jason Kent, Hacker in Residence at Cequence, or Parth Shukla, Security Engineer at Cequence, and maybe even entered […] The post Cequence Storms Black Hat with API Security Testing for Generative AI Applications appeared first on Cequence Security.

Engineering 112

Engineering 112

The Hacker News

AUGUST 13, 2024

A team of researchers from the CISPA Helmholtz Center for Information Security in Germany has disclosed an architectural bug impacting Chinese chip company T-Head's XuanTie C910 and C920 RISC-V CPUs that could allow attackers to gain unrestricted access to susceptible devices. The vulnerability has been codenamed GhostWrite.

Architecture 114

Architecture Information Security 114

Advertisement

IT leaders are experiencing rapid evolution in AI amid sustained investment uncertainty. As AI evolves, enhanced cybersecurity and hiring challenges grow. This whitepaper offers real strategies to manage risks and position your organization for success.

Cybersecurity

Security Boulevard

AUGUST 13, 2024

The FBI and law enforcement agencies from the UK and Germany seized servers and domains belonging to the Dispossessor ransomware gang, which had emerged into the spotlight following a similar operation against the notorious LockBit gang in February. The post FBI Disrupts Operations of the Dispossessor Ransomware Group appeared first on Security Boulevard.

Ransomware 111

Ransomware Malware Cybersecurity Network Security 111

The Hacker News

AUGUST 13, 2024

The China-backed threat actor known as Earth Baku has diversified its targeting footprint beyond the Indo-Pacific region to include Europe, the Middle East, and Africa starting in late 2022. Newly targeted countries as part of the activity include Italy, Germany, the U.A.E., and Qatar, with suspected attacks also detected in Georgia and Romania.

Cyber Attacks 114

Cyber Attacks Media Government 114

eSecurity Planet

AUGUST 13, 2024

It’s been a startling week in vulnerability news, mainly due to a few older vulnerabilities coming to light. While it doesn’t look like they’ve been exploited yet, threat actors may make a move now that the flaws have been publicized. The other major news — which could affect both businesses and individuals — is a zero-day vulnerability found in most major web browsers on both Mac and Linux machines.

Firmware 109

Firmware Software Wireless Security Defenses 109

The Hacker News

AUGUST 13, 2024

Monitoring evolving DDoS trends is essential for anticipating threats and adapting defensive strategies. The comprehensive Gcore Radar Report for the first half of 2024 provides detailed insights into DDoS attack data, showcasing changes in attack patterns and the broader landscape of cyber threats. Here, we share a selection of findings from the full report.

DDOS 113

DDOS Cyber threats 113

Advertisement

How many people would you trust with your house keys? Chances are, you have a handful of trusted friends and family members who have an emergency copy, but you definitely wouldn’t hand those out too freely. You have stuff that’s worth protecting—and the more people that have access to your belongings, the higher the odds that something will go missing.

Cybersecurity

Penetration Testing

AUGUST 13, 2024

In its latest Patch Tuesday security update, Microsoft has disclosed a critical vulnerability in the Windows TCP/IP stack that demands urgent attention. Among the 88 vulnerabilities addressed this August, CVE-2024-38063... The post CVE-2024-38063 (CVSS 9.8): 0-Click RCE Affects All Windows Systems appeared first on Cybersecurity News.

Cybersecurity 112

Cybersecurity 112

The Hacker News

AUGUST 13, 2024

Cybersecurity researchers have discovered two security flaws in Microsoft's Azure Health Bot Service that, if exploited, could permit a malicious actor to achieve lateral movement within customer environments and access sensitive patient data.

Cybersecurity 112

Cybersecurity 112

Security Boulevard

AUGUST 13, 2024

One often overlooked aspect in the aftermath of a breach is the meticulous examination of firewall rule histories. These records not only reveal how an attacker gained access but can illuminate the path they took within an organization’s network. The post The Crucial Role of Firewall Rule Histories appeared first on Security Boulevard.

Firewall 102

Firewall Security Awareness Cybersecurity 102

Penetration Testing

AUGUST 13, 2024

Zoom has released a security bulletin addressing several vulnerabilities in its Workplace Apps and Rooms Clients, some of which pose significant security risks to users. Among the most critical are... The post CVE-2024-39825 and CVE-2024-39818: High-Risk Zoom Flaws Require Urgent Updates appeared first on Cybersecurity News.

Risk 98

Risk Cybersecurity 98

Advertiser: Revenera

In a recent study, IDC found that 64% of organizations said they were already using open source in software development with a further 25% planning to in the next year. Most organizations are unaware of just how much open-source code is used and underestimate their dependency on it. As enterprises grow the use of open-source software, they face a new challenge: understanding the scope of open-source software that's being used throughout the organization and the corresponding exposure.

Risk

ZoneAlarm

AUGUST 13, 2024

In a staggering display of cyber vulnerability, a recent data breach has led to the exposure of 2.7 billion records, including sensitive information such as Social Security numbers and home addresses. The scope and scale of this breach have sent shockwaves through the cybersecurity community, raising serious concerns about data protection and the increasing sophistication … The post Massive Data Breach Exposes 2.7 Billion Records Including Social Security Numbers appeared first on ZoneAlar

Data breaches 97

Data breaches Cybersecurity Data privacy Mobile 97

The Hacker News

AUGUST 13, 2024

Ivanti has rolled out security updates for a critical flaw in Virtual Traffic Manager (vTM) that could be exploited to achieve an authentication bypass and create rogue administrative users. The vulnerability, tracked as CVE-2024-7593, has a CVSS score of 9.8 out of a maximum of 10.0. "Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.

Authentication 102

Authentication 102

Graham Cluley

AUGUST 13, 2024

In episode 11 of The AI Fix, OpenAI battles a Shakespearean lawyer, Graham sings an uncanny bluegrass acrostic, Google drops the ball with a terrible AI ad, and Mark wonders why there's no sound on a video of an AI dentist. Graham finds religion with a little help from a man named "L Ron", a traffic cone saves the world, and Mark has a heated argument with belligerent ChatGPT.

96

96

Heimadal Security

AUGUST 13, 2024

In 2021, it was revealed that a group of hackers dubbed ‘LightBasin’ had compromised over a dozen telecom firms around the world. Their activity had been going on, undetected, for at least five years. This breach is a classic example of an advanced persistent threat, with the hackers stealthily entering their victims’ systems and stealing […] The post EDR Importance: Why Is EDR Important?

95

95

Advertisement

Within the past few years, ransomware attacks have turned to critical infrastructure, healthcare, and government entities. Attackers have taken advantage of the rapid shift to remote work and new technologies. Add to that hacktivism due to global conflicts and U.S. elections, and an increased focus on AI, and you have the perfect recipe for a knotty and turbulent 2024.

Cybersecurity

eSecurity Planet

AUGUST 13, 2024

It’s been a startling week in vulnerability news, mainly due to a few older vulnerabilities coming to light. While it doesn’t look like they’ve been exploited yet, threat actors may make a move now that the flaws have been publicized. The other major news — which could affect both businesses and individuals — is a zero-day vulnerability found in most major web browsers on both Mac and Linux machines.

Firmware 101

Firmware Software Wireless Security Defenses 101

Security Boulevard

AUGUST 13, 2024

Compliance with SOC 2 assures that the company maintains a high standard of information security, and highlights it among market competitors. The post How to Prepare for SOC 2 and ISO 27001 Audit? Tips for Jira Admins appeared first on Security Boulevard.

Marketing 91

Marketing Information Security Security Awareness Risk 91

Penetration Testing

AUGUST 13, 2024

Ivanti has released a security advisory addressing two significant vulnerabilities in its Neurons for IT Service Management (ITSM) platform, urging on-premise customers to take immediate action. The vulnerabilities, identified as... The post Ivanti Issues Critical Fixes for ITSM Vulnerabilities (CVE-2024-7569 and CVE-2024-7570) appeared first on Cybersecurity News.

Cybersecurity 89

Cybersecurity 89

The Hacker News

AUGUST 13, 2024

Traditionally, the focus has been on defending against digital threats such as malware, ransomware, and phishing attacks by detecting them and responding. However, as cyber threats become more sophisticated. There is a growing recognition of the importance of measures that stop new attacks before they are recognized.

Cyber threats 91

Cyber threats Phishing Ransomware Malware 91

Advertisement

The healthcare industry has massively adopted web tracking tools, including pixels and trackers. Tracking tools on user-authenticated and unauthenticated web pages can access personal health information (PHI) such as IP addresses, medical record numbers, home and email addresses, appointment dates, or other info provided by users on pages and thus can violate HIPAA Rules that govern the Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.

Healthcare