Krebs on Security

DECEMBER 3, 2024

Phishing attacks increased nearly 40 percent in the year ending August 2024, with much of that growth concentrated at a small number of new generic top-level domains (gTLDs) — such as.shop ,top ,xyz — that attract scammers with rock-bottom prices and no meaningful registration requirements, new research finds. Meanwhile, the nonprofit entity that oversees the domain name industry is moving forward with plans to introduce a slew of new gTLDs.

Cybercrime 262

Cybercrime Phishing Accountability Internet 262

The Last Watchdog

DECEMBER 3, 2024

In the modern world of software development, code quality is becoming a critical factor that determines a project success. Errors in code can entail severe consequences. Related: The convergence of network, application security For example, vulnerabilities in banking applications can lead to financial data leaks, and errors in medical systems can threaten the health of patients.

Software 200

Software Risk Education Cyber Attacks 200

Tech Republic Security

DECEMBER 3, 2024

The exposed database creates opportunities for staging convincing phishing and social engineering attacks, among other issues.

Social Engineering 188

Social Engineering Engineering Phishing Cybersecurity 188

The Last Watchdog

DECEMBER 3, 2024

Tel Aviv, Israel, Dec. 3, 2024, CyberNewswire — With Sweet, customers can now unify detection and response for applications, workloads, and cloud infrastructure Sweet Security today announced the release of its unified Cloud Native Detection and Response platform, designed to transform the way organizations protect their cloud environments in real time.

CISO 130

CISO Threat Detection Media Technology 130

Advertisement

Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.

Passwords

Penetration Testing

DECEMBER 3, 2024

Veeam Software, a prominent provider of backup and disaster recovery solutions, has released urgent security updates to address two critical vulnerabilities in its Service Provider Console (VSPC). One of these... The post CVE-2024-42448 (CVSS 9.9): Critical RCE Vulnerability in Veeam VSPC appeared first on Cybersecurity News.

Backups 137

Backups Software Cybersecurity 137

Malwarebytes

DECEMBER 3, 2024

Researchers have discovered a huge Google Cloud Storage bucket, found freely accessible on the internet and containing a treasure trove of personal information. AI startup WotNot provides companies with the ability to create their own customized chatbot. The company reportedly has 3,000 customers including some household family names. But the way its solution is set up introduces an extra link in the chain in the flow of personally identifiable information (PII) from the customer to the company

Identity Theft 128

Identity Theft Education Risk Phishing 128

Zero Day

DECEMBER 3, 2024

The company is threatening to add a watermark to the desktop of any unsupported PC running Windows 11.

137

137

Security Affairs

DECEMBER 3, 2024

Cisco warns customers that a decade-old ASA vulnerability, tracked as CVE-2014-2120, is being actively exploited in the wild. Cisco warns that the decade-old ASA vulnerability CVE-2014-2120 is being actively exploited in attacks in the wild, and urges customers to review the updated advisory. The vulnerability resides in the WebVPN login page of Cisco Adaptive Security Appliance (ASA) Software, an unauthenticated, remote attacker could exploit the flaw to conduct a cross-site scripting (XSS) att

Software 120

Software Hacking Information Security 120

The Hacker News

DECEMBER 3, 2024

Cybersecurity researchers have called attention to a novel phishing campaign that leverages corrupted Microsoft Office documents and ZIP archives as a way to bypass email defenses. "The ongoing attack evades #antivirus software, prevents uploads to sandboxes, and bypasses Outlook's spam filters, allowing the malicious emails to reach your inbox," ANY.RUN said in a series of posts on X.

Antivirus 136

Antivirus Phishing Software Cybersecurity 136

Security Affairs

DECEMBER 3, 2024

Poland probes Pegasus spyware abuse under the PiS government; ex-security chief Piotr Pogonowski arrested to testify before parliament. Poland’s government has been investigating the alleged misuse of Pegasus spyware by the previous administration and arrested the former head of Poland’s internal security service Piotr Pogonowski. News of the arrest of Piotr Pogonowski was first reported by the Financial Times.

Spyware 118

Spyware Government Surveillance Hacking 118

Advertisement

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

Software

The Hacker News

DECEMBER 3, 2024

Cisco on Monday updated an advisory to warn customers of active exploitation of a decade-old security flaw impacting its Adaptive Security Appliance (ASA). The vulnerability, tracked as CVE-2014-2120 (CVSS score: 4.

134

134

Tech Republic Security

DECEMBER 3, 2024

Uncover the pros, cons, and everything in between in our in-depth TorGuard VPN review. Explore its features, security, performance, and pricing.

VPN 132

VPN Security Performance 132

Malwarebytes

DECEMBER 3, 2024

Of all the different kinds of malicious search ads we track, those related to customer service are by far the most common. Brands such as PayPal, eBay, Apple or Netflix are among the most coveted ones as they tend to drive a lot of online searches. Tech support scammers are leveraging Google ads to lure victims in, getting them on the phone and finally fleecing them.

Scams 122

Scams Advertising Accountability Engineering 122

The Hacker News

DECEMBER 3, 2024

The North Korea-aligned threat actor known as Kimsuky has been linked to a series of phishing attacks that involve sending email messages that originate from Russian sender addresses to ultimately conduct credential theft. "Phishing emails were sent mainly through email services in Japan and Korea until early September," South Korean cybersecurity company Genians said.

Phishing 130

Phishing Cybersecurity 130

Advertisement

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!

Security Affairs

DECEMBER 3, 2024

The ‘Bootkitty’ Linux UEFI bootkit exploits the LogoFAIL flaws (CVE-2023-40238) to target systems using vulnerable firmware. Cybersecurity researchers from ESET recently discovered the first UEFI bootkit designed to target Linux systems, called by its authors Bootkitty. The bootkit allows attackers to disable the kernel’s signature verification feature and to preload two as yet unknown ELF binaries via the Linux init process.

Firmware 107

Firmware Manufacturing Malware Authentication 107

Trend Micro

DECEMBER 3, 2024

Our research into Retrieval Augmented Generation (RAG) systems uncovered at least 80 unprotected servers. We highlight this problem, which can lead to potential data loss and unauthorized access.

Artificial Intelligence 122

Artificial Intelligence 122

WIRED Threat Level

DECEMBER 3, 2024

When programmer Micah Lee was kicked off X for a post that offended Elon Musk, he didn't look back. His new tool for saving and deleting your X posts can give you that same sweet release.

Media 122

Media 122

Zero Day

DECEMBER 3, 2024

The Lenovo Tab Plus proves big things come in small packages. It is an 11.5-inch tablet that houses a surprisingly powerful speaker system and 2K display.

119

119

Advertisement

Cloud Development Environments (CDEs) are changing how software teams work by moving development to the cloud. Our Cloud Development Environment Adoption Report gathers insights from 223 developers and business leaders, uncovering key trends in CDE adoption. With 66% of large organizations already using CDEs, these platforms are quickly becoming essential to modern development practices.

Software

WIRED Threat Level

DECEMBER 3, 2024

A new proposal by the Consumer Financial Protection Bureau would use a 54-year-old privacy law to impose new oversight of the data broker industry. But first, the agency must survive Elon Musk.

121

121

The Hacker News

DECEMBER 3, 2024

Cybersecurity researchers have disclosed a set of flaws impacting Palo Alto Networks and SonicWall virtual private network (VPN) clients that could be potentially exploited to gain remote code execution on Windows and macOS systems.

VPN 118

VPN Cybersecurity 118

Security Affairs

DECEMBER 3, 2024

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds ProjectSend, North Grid Proself, and Zyxel firewalls bugs to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog : CVE-2023-45727 North Grid Proself Improper Restriction of XML External Entity (XEE) Reference Vulnerability CVE-2024-11680 ProjectSend Improper Authentication Vulnerabil

Firewall 113

Firewall Authentication Accountability Firmware 113

The Hacker News

DECEMBER 3, 2024

A critical security vulnerability has been disclosed in SailPoint's IdentityIQ identity and access management (IAM) software that allows unauthorized access to content stored within the application directory. The flaw, tracked as CVE-2024-10905, has a CVSS score of 10.0, indicating maximum severity. It affects IdentityIQ versions 8.2. 8.3, 8.4, and other previous versions.

Software 110

Software 110

Advertisement

Tech leaders today are facing shrinking budgets and investment concerns. This whitepaper provides insights from over 1,000 tech leaders on how to stay secure and attract top cybersecurity talent, all while doing more with less. Download today to learn more!

Cybersecurity

Security Boulevard

DECEMBER 3, 2024

Trust is not a one-way street. Employees who trust their organization and leadership are one lane, but the organization must trust its employees, too. The post Are We Too Trusting of Employees? appeared first on Security Boulevard.

Security Awareness 109

Security Awareness Cybersecurity 109

Penetration Testing

DECEMBER 3, 2024

A sophisticated supply chain attack has been identified within the widely-used @solana/web3.js JavaScript library, potentially jeopardizing the security of numerous developers and users within the Solana ecosystem. Malicious code was injected... The post Solana Web3.js Library Compromised in Targeted Supply Chain Attack appeared first on Cybersecurity News.

Cybersecurity 90

Cybersecurity Malware 90

Zero Day

DECEMBER 3, 2024

Now you can easily migrate from X with this powerful tool that deletes tweets, likes, and DMs, while backing up your data for a fresh start elsewhere.

106

106

Security Boulevard

DECEMBER 3, 2024

Building a third-party risk management framework (TPRM) is an ongoing process that requires commitment, resources and continuous improvement. The post A Strategic Approach to Building a Comprehensive Third-Party Risk Framework appeared first on Security Boulevard.

Risk 106

Risk Data privacy Cybersecurity 106

Advertisement

Explore how enterprises can enhance developer productivity and onboarding by adopting self-hosted Cloud Development Environments (CDEs). This whitepaper highlights the simplicity and flexibility of cloud-based development over traditional setups, demonstrating how large teams can leverage economies of scale to boost efficiency and developer satisfaction.

GlobalSign

DECEMBER 3, 2024

As we wrap up 2024, it’s time to look forward into 2025 and see what to expect from the PKI industry in the coming year.

Cybersecurity 106

Cybersecurity 106

Security Boulevard

DECEMBER 3, 2024

One of the most alarming methods of attack involves intercepting email attachments during transit, resulting in the theft of personally identifiable information (PII) and other sensitive data. The post Defending Against Email Attachment Scams appeared first on Security Boulevard.

Scams 106

Scams Security Awareness Cybersecurity 106

Zero Day

DECEMBER 3, 2024

While it doesn't flip, fold, or have a built-in S Pen stylus, the Galaxy S24 FE offers all the essentials at a relatively accessible price. Although Cyber Monday sales are over, deals for the phone are still live on Best Buy.

105

105

SecureWorld News

DECEMBER 3, 2024

In a surprising move related to international cybercrime, Russian authorities have charged Mikhail Matveev, also known as "Wazawaka," with creating ransomware to extort commercial organizations, according to Russian media outlet RIA. Matveev, infamous for his involvement in high-profile ransomware operations, is linked to groups such as Babuk, LockBit, Hive, and Conti.

Cybercrime 80

Cybercrime Ransomware Healthcare Cryptocurrency 80

Advertisement

IT leaders are experiencing rapid evolution in AI amid sustained investment uncertainty. As AI evolves, enhanced cybersecurity and hiring challenges grow. This whitepaper offers real strategies to manage risks and position your organization for success.

Cybersecurity