QuoIntelligence discovered the operation called Ticket Heist, with convincing websites selling fake Olympic tickets. The prices on these websites are much higher than the official ones. This article has been indexed from Cyware News – Latest Cyber News Read the…
Category: Cyware News – Latest Cyber News
CISA Adds Microsoft Windows and Rejetto HTTP File Server Bugs to its Known Exploited Vulnerabilities Catalog
The vulnerabilities added include CVE-2024-23692 affecting Rejetto HTTP File Server, CVE-2024-38080 impacting Windows Hyper-V, and CVE-2024-38112 targeting Windows MSHTML Platform. This article has been indexed from Cyware News – Latest Cyber News Read the original article: CISA Adds Microsoft Windows…
Microsoft July 2024 Patch Tuesday Fixes 142 Flaws, 4 Zero-Days
As part of Microsoft’s July 2024 Patch Tuesday, 142 flaws were addressed, including two zero-days actively exploited and two publicly disclosed. Five critical vulnerabilities were fixed, all related to remote code execution. This article has been indexed from Cyware News…
Monocle: Open-Source LLM for Binary Analysis Search
Monocle is an open-source tool powered by an LLM for searching natural language in compiled binaries. It can analyze binaries based on criteria like authentication code or password strings, using Ghidra headless for decompilation. This article has been indexed from…
Blast RADIUS Attack can Bypass Authentication for Clients
This vulnerability, known as Blast RADIUS and rated 7.5 out of 10 on the severity scale, affects the RADIUS networking protocol, potentially granting unauthorized access to network devices and services without credentials. This article has been indexed from Cyware News…
How CISA Plans to Measure Trust in Open-Source Software
The CISA is developing a new framework to assess the trustworthiness of open-source software projects. The agency’s open-source software security roadmap aims to increase visibility into OSS use and risks across the federal government. This article has been indexed from…
New Flaw in OpenSSH can Lead to Remote Code Execution
A vulnerability in certain versions of the OpenSSH secure networking suite may allow for remote code execution. The vulnerability, identified as CVE-2024-6409 with a CVSS score of 7.0, affects specific versions of OpenSSH such as 8.7p1 and 8.8p1. This article…
UK Government Advises Best Practices for Embedded Device Security
The cybersecurity arm of the UK government, RITICS, has released a new guide to assist companies in enhancing the security of their operational technology (OT) and industrial control system (ICS) hardware. This article has been indexed from Cyware News –…
Hackers Target WordPress Calendar Plugin Used by 150,000 Sites
Hackers are targeting a vulnerability in the Modern Events Calendar WordPress plugin found on over 150,000 websites to upload files and execute code remotely. The plugin by Webnus is used to manage events. This article has been indexed from Cyware…
Persistent npm Campaign Shipping Trojanized jQuery
Approximately 68 malicious packages were created between May 26 and June 23, 2024, with deceptive names like cdnjquery and jquertyi. These packages were manually crafted, unlike automated attacks, allowing the threat actor to steal website form data. This article has…
CISA and Partner Agencies Join ASD’S ACSC to Release Advisory on APT40, a Chinese State-Sponsored Group
Cybersecurity agencies from Australia, Canada, Germany, Japan, New Zealand, South Korea, the UK, and the US have warned about APT40, a China-linked cyber espionage group known for quickly exploiting new security bugs after public disclosure. This article has been indexed…
Researchers Catch Yemeni Hackers Spying on Middle East Military Phones
A Yemeni hacking group associated with the Houthi movement has been spying on military personnel in the Middle East by infecting their phones with surveillance software, according to cybersecurity firm Lookout. This article has been indexed from Cyware News –…
Scammers Double-Dip by Offering Prior Victims Help to Recover Stolen Funds
The scammers identify previous scam victims and pose as trusted entities such as government agencies, cybersecurity firms, or fund recovery services, asking for upfront fees or personal information to supposedly help with the recovery process. This article has been indexed…
Apache Fixed a Source Code Disclosure Flaw in Apache HTTP Server
This vulnerability, tracked as CVE-2024-39884 and caused by a regression, can lead to unintentional exposure of sensitive data when legacy content-type configurations are used. This article has been indexed from Cyware News – Latest Cyber News Read the original article:…
Splunk Addresses Critical Vulnerabilities in Enterprise and Cloud Platforms
Splunk has released a set of security updates to address 16 vulnerabilities in Splunk Enterprise and Cloud Platform, including high-severity issues. CVE-2024-36985 allows remote code execution via External Lookup in Splunk Enterprise. This article has been indexed from Cyware News…
Update: Network Segmentation Hobbled Midnight Blizzard’s Attack on TeamViewer
The company revealed that their corporate IT network, production environment, and TeamViewer connectivity platform are segmented to prevent unauthorized access. Immediate remediation measures were effective in blocking suspicious activity. This article has been indexed from Cyware News – Latest Cyber…
Critical Infrastructure Providers Seek Guardrails on Scope, Timeline for CIRCIA Rules
Critical infrastructure providers are urging federal officials for more flexibility in reporting cyber incidents within the first 72 hours under the Cyber Incident Reporting for Critical Infrastructure Act. This article has been indexed from Cyware News – Latest Cyber News…
Increase in the Exploitation of Microsoft SmartScreen Vulnerability
Cyble Research and Intelligence Labs (CRIL) has identified an increase in the exploitation of the Microsoft SmartScreen vulnerability (CVE-2024-21412) through an active campaign targeting regions like Spain, the US, and Australia. This article has been indexed from Cyware News –…
As Cyber Command Evolves, Its Novel Malware Alert System Fades Away
The shift away from public disclosure on Twitter is part of an evolution in how the CNMF communicates cyber threat information. The command now focuses on working closely with industry partners to share information effectively and efficiently. This article has…
Indian Government Issues Serious Warning on Phishing Scams Alleging Sexual Offenses
The emails falsely accuse recipients of sexual offences, using names and seals of authorities to appear authentic. Citizens are advised not to respond to such emails and report them to authorities. This article has been indexed from Cyware News –…