Latest Cybersecurity News and Articles

---

Don’t Let Zombie Zoom Links Drag You Down

Many organizations, including Fortune 500 firms, have exposed Zoom links that allow unauthorized individuals to initiate video conference meetings, posing a risk of phishing and social engineering attacks.

---

New ‘Looney Tunables’ Linux Bug Gives Root Privileges on Major Distros

The flaw, introduced in glibc 2.34, highlights the severity and widespread nature of the vulnerability, emphasizing the need for immediate patching by system administrators.

---

ShellTorch Vulnerabilities Put Organizations at Risk of Server Takeover

The vulnerabilities, collectively known as "ShellTorch," have been patched in the latest version of TorchServe (0.8.2), hence, developers are encouraged to update to ensure their systems are secure.

---

LightSpy Spyware Evolves to Add New Plugins for Data Exfiltration

LightSpy, associated with the Chinese APT41 group, was found to contain a Core implant and 14 plugins for data exfiltration, supporting 24 different commands. LightSpy's Core supports 24 different commands, including self and plugin updates, indicating a sophisticated and versatile threat actor behind it.

---

Looney Tunables: New Linux Flaw Enables Privilege Escalation on Major Distributions

A new Linux security vulnerability dubbed Looney Tunables has been discovered in the GNU C library's ld.so dynamic loader that, if successfully exploited, could lead to a local privilege escalation and allow a threat actor to gain root privileges. Tracked as CVE-2023-4911 (CVSS score: 7.8), the issue is a buffer overflow that resides in the dynamic loader's processing of the GLIBC_TUNABLES

---

Qualcomm Releases Patch for Three New Zero-Days Under Active Exploitation

"There are indications from Google Threat Analysis Group and Google Project Zero that CVE-2023-33106, CVE-2023-33107, CVE-2022-22071, and CVE-2023-33063 may be under limited, targeted exploitation," the semiconductor company said in an advisory.

---

Experts Discover Multiple Malicious npm Packages

Researchers at FortiGuard Labs uncovered nine sets of malicious NPM packages designed to steal sensitive data, including system information, user credentials, and source code. These malicious packages use install scripts to exfiltrate data to webhooks or file-sharing links. These npm packages highlight a significant and often overlooked threat within the open-source ecosystem.

---

Motel One Group discloses data breach

The Motel One Group announced that the company was the target of a cyberattack affecting address data and customer credit card information.

---

81% of security leaders say that API security is a higher priority

According to a recent Noname Security report, API security is more of a priority for 81% of security leaders than it was 12 months ago.

---

Qualcomm Releases Patch for 3 new Zero-Days Under Active Exploitation

Chipmaker Qualcomm has released security updates to address 17 vulnerabilities in various components, while warning that three other zero-days have come under active exploitation. Of the 17 flaws, three are rated Critical, 13 are rated High, and one is rated Medium in severity. "There are indications from Google Threat Analysis Group and Google Project Zero that CVE-2023-33106, CVE-2023-33107,

---

Microsoft Edge, Teams Get Fixes for Zero-Days in Open-Source Libraries

The vulnerabilities are caused by heap buffer overflow weaknesses in open-source libraries used by the products, and they can lead to crashes or arbitrary code execution.

---

Warning: PyTorch Models Vulnerable to Remote Code Execution via ShellTorch

Cybersecurity researchers have disclosed multiple critical security flaws in the TorchServe tool for serving and scaling PyTorch models that could be chained to achieve remote code execution on affected systems. Israel-based runtime application security company Oligo, which made the discovery, has coined the vulnerabilities ShellTorch. "These vulnerabilities [...] can lead to a full chain Remote

---

US Executives Targeted in Phishing Attacks Exploiting Flaw in Indeed Job Platform

A recent phishing campaign has exploited an open redirection vulnerability in the popular job search platform Indeed, targeting executives in senior roles to steal their Microsoft credentials.

---

Lorenz Ransomware Group Attacks Allcare Pharmacy in Major Cyber Assault

The Allcare Pharmacy data breach, claimed by the Lorenz ransomware group, has exposed sensitive customer information, including Social Security Numbers, raising concerns about data security and patient privacy in the healthcare sector.

---

Hackers Seen Exploiting Bugs in Browsers and Popular File Transfer Tool

The Cybersecurity and Infrastructure Security Agency (CISA) warned on Monday that hackers are exploiting CVE-2023-5217 — a vulnerability affecting Google Chrome, Mozilla Firefox, and more.

---

Over 3 Dozen Data-Stealing Malicious npm Packages Found Targeting Developers

Nearly three dozen counterfeit packages have been discovered in the npm package repository that are designed to exfiltrate sensitive data from developer systems, according to findings from Fortinet FortiGuard Labs. One set of packages – named @expue/webpack, @expue/core, @expue/vue3-renderer, @fixedwidthtable/fixedwidthtable, and @virtualsearchtable/virtualsearchtable – harbored an obfuscated

---

New Wave of Mirai Botnet Variants Like hailBot, kiraiBot, and catDDoS Mount a Fierce Onslaught

These variants utilize different tactics such as modifying go-live processes, introducing new encryption algorithms, and incorporating OpenNIC domains to evade detection and enhance their malicious activities.

---

Android’s October 2023 Security Updates Patch Two Exploited Vulnerabilities

Google on Monday announced the release of patches for 51 vulnerabilities as part of the October 2023 security updates for Android, including fixes for two zero-day flaws exploited in malicious attacks.

---

Medusa Ransomware Group Claims Intrusions at Two New Victims, Sets Ransom Deadline

The Medusa ransomware group has recently targeted two companies, Karam Chand Thapar & Bros. (Coal Sales) Ltd in India and the Sweden-based Windak Group, demanding significant ransoms for the release of encrypted data.

---

Update: Some Prospect Medical Hospitals in Dire State, Post-Attack

The hospitals are facing financial difficulties and are struggling to pay vendors. This incident highlights the vulnerability of financially unstable hospitals to cyberattacks and the potential risks to patient care.