Latest Cybersecurity News and Articles

---

Critical Security Flaw Found in Popular LayerSlider WordPress Plugin

A critical security flaw impacting the LayerSlider plugin for WordPress could be abused to extract sensitive information from databases, such as password hashes. The flaw, designated as CVE-2024-2879, carries a CVSS score of 9.8 out of a maximum of 10.0. It has been described as a case of SQL injection impacting versions from 7.9.11 through 7.10.0. The issue has been addressed in version

---

How to Design and Deliver an Effective Cybersecurity Exercise

Armed forces have always utilized war-gaming exercises for battlefield training to prepare for times of conflict. With today’s digital transformation, the same concept is being applied in the form of cybersecurity exercises.

---

FCC to Probe ‘Grave’ Weaknesses in Phone Network Infrastructure

The Federal Communications Commission (FCC) says it is taking action to address significant weaknesses in telecommunications networks that can enable cybercrime and spying.

---

Malicious Code in XZ Utils for Linux Systems Enables Remote Code Execution

The malicious code inserted into the open-source library XZ Utils, a widely used package present in major Linux distributions, is also capable of facilitating remote code execution, a new analysis has revealed. The audacious supply chain compromise, tracked as CVE-2024-3094 (CVSS score: 10.0), came to light last week when Microsoft engineer and PostgreSQL developer Andres Freund

---

Losses Linked to Impersonation Scams Top $1 Billion Yearly, FTC Says

A classic type of fraud — when a crook impersonates a business or a government agency — appears to be bigger than ever, according to federal statistics, and it’s now most likely to begin via text message or email instead of a phone call.

---

FTC denies new COPPA application

The FTC denied an application for approval of a new mechanism for obtaining parental consent under the Children’s Online Privacy Protection Rule.

---

Escalating Malware Tactics Drive Global Cybercrime Epidemic

Evasive, basic, and encrypted malware all increased in Q4 2023, fueling a rise in total malware, according to WatchGuard. The average number of malware detections rose 80% from the previous quarter.

---

OWASP Discloses a Data Breach Due to Wiki Misconfiguration

In late February 2024, the Foundation received a few support requests and became aware of a misconfiguration of OWASP’s old Wiki web server. The misconfiguration led to a data breach involving old member resumes.

---

Vulnerability Database Backlog Due to Increased Volume, Changes in ‘Support,’ NIST Says

The National Institute of Standards and Technology (NIST) blamed increases in the volume of software and “a change in interagency support” for the recent backlog of vulnerabilities analyzed in the organization’s National Vulnerability Database (NVD).

---

Government agencies collaborate on a guide to address DDoS attacks

The CISA and the FBI have partnered with the Multi-State Information Sharing and Analysis Center (MS-ISAC) to release a guideline for organizations to defend against DDoS attacks. 

---

Vultur Banking Malware for Android Poses as McAfee Security App

Fox-IT warned that a new, evasive version of Vultur spreads to victims through a hybrid attack that relies on SMS phishing and phone calls that trick the targets into installing a version of the malware that masquerades as the McAfee Security app.

---

Harnessing the Power of CTEM for Cloud Security

Cloud solutions are more mainstream – and therefore more exposed – than ever before. In 2023 alone, a staggering 82% of data breaches were against public, private, or hybrid cloud environments. What’s more, nearly 40% of breaches spanned multiple cloud environments. The average cost of a cloud breach was above the overall average, at $4.75 million. In a time where cloud has become the de facto

---

Data Leak at Shopping Platform PandaBuy Impacts 1.3 Million Users

"The data was stolen by exploiting several critical vulnerabilities in the platform's API and other bugs were identified allowing access to the internal service of the website," the threat actor named 'Sanggiero' said.

---

China-linked Hackers Deploy New 'UNAPIMON' Malware for Stealthy Operations

A threat activity cluster tracked as Earth Freybug has been observed using a new malware called UNAPIMON to fly under the radar. "Earth Freybug is a cyberthreat group that has been active since at least 2012 that focuses on espionage and financially motivated activities," Trend Micro security researcher Christopher So said in a report published today. "It has been observed to

---

Advanced Cybersecurity Strategies Boost Shareholder Returns

Companies demonstrating advanced cybersecurity performance generate a shareholder return that is 372% higher than their peers with basic cybersecurity performance, according to a new report from Diligent and Bitsight.

---

Update: Prudential Insurance Says Data of 36,000 Exposed During February Cyberattack

“Through the investigation, we learned that the unauthorized third party gained access to our network on February 4, 2024, and removed a small percentage of personal information from our systems,” the breach notification letters said.

---

Skyflow Raises $30M in Extended Series B

Skyflow, a Palo Alto, CA-based data privacy vault company, raised $30M in Extended Series B funding. The round was led by Khosla Ventures with participation from Mouro Capital, Foundation Capital, and Canvas Ventures.

---

India Says it has Rescued 250 Citizens From Cambodian Cyber Slavery

On Saturday, India’s Ministry of External Affairs responded to local media reports about Indians trapped in Cambodia, saying they are closely collaborating with Cambodian authorities to rescue them.

---

AI Abuse and Misinformation Campaigns Threaten Financial Institutions

Though generative AI offers financial firms remarkable business and cybersecurity utility, cyber threats relating to GenAI in financial services are a consistent concern, according to FS-ISAC.

---

Update: Yacht Retailer MarineMax Discloses Data Breach After Cyberattack

MarineMax filed an updated report to regulators at the Securities and Exchange Commission on Monday warning that customer and employee information was stolen during the incident. The Rhysida ransomware gang took credit for the attack on March 21.