Latest Cybersecurity News and Articles
11 October 2023
While there is quite a bit of buzz and hype around AI, it is a technology that can add tremendous value to security programs.
The post Applying AI to API Security appeared first on SecurityWeek.
11 October 2023
A new card skimming campaign discovered by Akamai utilizes 404 error pages on online retailers' websites to hide malicious code and steal customers' credit card information. The stolen data is exfiltrated via seemingly benign image requests, thus evading network monitoring tools. One effective mitigation is to regularly monitor and audit website resources, ensuring that no unauthorized modifications have been made.
11 October 2023
The two actively exploited flaws include information disclosure in Microsoft WordPad and privilege escalation in Skype for Business. Microsoft has also fixed flaws in Microsoft Message Queuing, Layer 2 Tunneling Protocol, and Windows IIS Server.
11 October 2023
The Joint Cyber Defense Collaborative published a series of recommendations on Tuesday for operational technology vendors and critical infrastructure facilities to promote the secure use of open-source software.
11 October 2023
CISA has added five bugs to its Known Exploited Vulnerabilities catalog, including the recent WordPad, Skype, and HTTP/2 zero-days.
The post CISA Warns of Attacks Exploiting Adobe Acrobat Vulnerability appeared first on SecurityWeek.
11 October 2023
Organizations are advised to check all their software for the presence of the CVE-2023-4863 vulnerability in the libwebp image rendering library and apply patches accordingly.
11 October 2023
Google is making passkeys the default login setting for users, aiming to replace passwords and enhance security. Passkeys reduce the risk of phishing attacks and offer a more secure alternative to traditional passwords.
11 October 2023
ICS Patch Tuesday: Siemens and Schneider Electric release over a dozen advisories addressing more than 40 vulnerabilities.
The post ICS Patch Tuesday: Siemens Ruggedcom Devices Affected by Nozomi Component Flaws appeared first on SecurityWeek.
11 October 2023
Security researchers exposed a cyberespionage operation named Stayin Alive, which targets the telecommunications sector and government entities in Kazakhstan, Uzbekistan, Pakistan, and Vietnam. The campaign employs spear-phishing emails and DLL side-loading to deliver archive files to the victims’ systems. It is recommended to refrain from attending to unsolicited emails/messages.
11 October 2023
Adobe has released patches for multiple security vulnerabilities, including critical flaws in Adobe Commerce and Photoshop that could lead to code execution and privilege escalation.
11 October 2023
Despite the breach, Volex's operations remain largely unaffected, and the financial impact is expected to be minimal. The details of the breach, including the method of attack and any ransom demands, remain undisclosed.
11 October 2023
An audio clip of UK opposition leader Keir Starmer verbally abusing his staff, which gained significant traction on social media, has been debunked as AI-generated by private-sector and government analysis.
11 October 2023
Microsoft has released its Patch Tuesday updates for October 2023, addressing a total of 103 flaws in its software, two of which have come under active exploitation in the wild.
Of the 103 flaws, 13 are rated Critical and 90 are rated Important in severity. This is apart from 18 security vulnerabilities addressed in its Chromium-based Edge browser since the second Tuesday of September.
The two
11 October 2023
Microsoft has linked the exploitation of a recently disclosed critical flaw in Atlassian Confluence Data Center and Server to a nation-state actor it tracks as Storm-0062 (aka DarkShadow or Oro0lxy).
The tech giant's threat intelligence team said it observed in-the-wild abuse of the vulnerability since September 14, 2023.
"CVE-2023-22515 is a critical privilege escalation vulnerability in
11 October 2023
Listen to the new episode of The Security Podcasts featuring Grayson Milbourne, Security Intelligence Director at OpenText Cybersecurity.
10 October 2023
Microsoft says an APT group tracked as Storm-0062 has been hacking Confluence installations since mid-September, three weeks before Atlassian’s disclosure.
The post Microsoft Blames Nation-State Threat Actor for Confluence Zero-Day Attacks appeared first on SecurityWeek.
10 October 2023
Microsoft today issued security updates for more than 100 newly-discovered vulnerabilities in its Windows operating system and related software, including four flaws that are already being exploited. In addition, Apple recently released emergency updates to quash a pair of zero-day bugs in iOS.
10 October 2023
IT leaders were surveyed on incoming security risks within the next one to three years, including generative AI, data privacy and third parties.
10 October 2023
In late August 2023, Cloudflare discovered a zero-day vulnerability, developed by an unknown threat actor that exploits the standard HTTP/2 protocol.
10 October 2023
Microsoft patches more than 100 vulnerabilities across the Windows ecosystem and warned that three are already being exploited in the wild.
The post Microsoft Fixes Exploited Zero-Days in WordPad, Skype for Business appeared first on SecurityWeek.