One told to take down posts that said nice things about WP Engine Organisers of WordCamps, community-organized events for WordPress users, have been ordered to take down some social media posts and share their login credentials for social networks.… This…
Category: The Register – Security
Senator accuses sloppy domain registrars of aiding Russian disinfo campaigns
Also, Change Healthcare sets a record, cybercrime cop suspect indicted, a new Mallox decryptor, and more in brief Senate intelligence committee chair Mark Warner (D-VA) is demanding to know why, in the wake of the bust-up of a massive online…
Worker surveillance must comply with credit reporting rules
US Consumer Financial Protection Bureau demands transparency, accountability from sellers of employee metrics The US Consumer Financial Protection Bureau on Thursday published guidance advising businesses that third-party reports about workers must comply with the consent and transparency requirements set forth…
Just how private is Apple’s Private Cloud Compute? You can test it to find out
Also updates bug bounty program with $1M payout In June, Apple used its Worldwide Developer Conference to announce the creation of the Private Cloud Compute platform to run its AI Intelligence applications, and now it’s asking people to stress test…
Putin’s pro-Trump trolls accuse Harris of poaching rhinos
Plus: Iran’s IRGC probes election-related websites in swing states Russian, Iranian, and Chinese trolls are all ramping up their US election disinformation efforts ahead of November 5, but – aside from undermining faith in the democratic process and confidence in the…
AWS Cloud Development Kit flaw exposed accounts to full takeover
Remember Bucket Monopoly? Yeah, it gets worse Amazon Web Services has fixed a flaw in its open source Cloud Development Kit that, under the right conditions, could allow an attacker to hijack a user’s account completely.… This article has been…
Emergency patch: Cisco fixes bug under exploit in brute-force attacks
Who doesn’t love abusing buggy appliances, really? Cisco has patched an already exploited security hole in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software that miscreants have been brute-forcing in attempted denial of service attacks.… This article…
Bitwarden’s FOSS halo slips as new SDK requirement locks down freedoms
Arguments continue but change suggests it’s not Free Software anymore The Bitwarden online credentials storage service is changing its build requirements – which some commentators feel mean it’s no longer FOSS.… This article has been indexed from The Register –…
Ransomware’s ripple effect felt across ERs as patient care suffers
389 US healthcare orgs infected this year alone Ransomware infected 389 US healthcare organizations this fiscal year, putting patients’ lives at risk and costing facilities up to $900,000 a day in downtime alone, according to Microsoft.… This article has been…
Voice-enabled AI agents can automate everything, even your phone scams
All for the low, low price of a mere dollar Scammers, rejoice. OpenAI’s real-time voice API can be used to build AI agents capable of conducting successful phone call scams for less than a dollar.… This article has been indexed…
China’s top messaging app WeChat banned from Hong Kong government computers
Google and WhatsApp also binned, which is far easier to explain than canning a local hero Hong Kong’s government has updated infosec guidelines to restrict the use of Chinese messaging app WeChat, alongside Meta and Google products like WhatsApp and…
Anthropic’s latest Claude model can interact with computers – what could go wrong?
For starters, it could launch a prompt injection attack on itself… The latest version of AI startup Anthropic’s Claude 3.5 Sonnet model can use computers – and the developer makes it sound like that’s a good thing.… This article has…
Perfctl malware strikes again as crypto-crooks target Docker Remote API servers
Attacks on unprotected servers reach ‘critical level’ An unknown attacker is abusing exposed Docker Remote API servers to deploy perfctl cryptomining malware on victims’ systems, according to Trend Micro researchers.… This article has been indexed from The Register – Security…
Samsung phone users under attack, Google warns
Don’t ignore this nasty zero day exploit says TAG A nasty bug in Samsung’s mobile chips is being exploited by miscreants as part of an exploit chain to escalate privileges and then remotely execute arbitrary code, according to Google security…
Penn State pays DoJ $1.25M to settle cybersecurity compliance case
Fight On, State? Not this time Pennsylvania State University has agreed to pay the Justice Department $1.25 million to settle claims of misrepresenting its cybersecurity compliance to the federal government and leaving sensitive data improperly secured. … This article has been…
Warning! FortiManager critical vulnerability under active attack
Security shop and CISA urge rapid action Fortinet has gone public with news of a critical flaw in its software management platform.… This article has been indexed from The Register – Security Read the original article: Warning! FortiManager critical vulnerability…
‘Satanic’ data thief claims to have slipped into 350M Hot Topic shoppers info
We know where you got your skinny jeans – big deal A data thief calling themselves Satanic claims to have purloined the records of around 350 million customers of fashion retailer Hot Topic.… This article has been indexed from The…
Microsoft SharePoint RCE flaw exploits in the wild – you’ve had 3 months to patch
Plus, a POC to make it extra easy for attackers A Microsoft SharePoint bug that can allow an attacker to remotely inject code into vulnerable versions is under active exploitation, according to the US Cybersecurity and Infrastructure Security Agency (CISA).……
Millions of Android and iOS users at risk from hardcoded creds in popular apps
Azure Blob Storage, AWS, and Twilio keys all up for grabs An analysis of widely used mobile apps offered on Google Play and the Apple App Store has found hardcoded and unencrypted cloud service credentials, exposing millions of users to…
US lawmakers push DoJ to prosecute tax prep firms for leaking taxpayer data to big tech
TaxSlayer, H&R Block, TaxAct, and Ramsey Solutions accused of sharing info with Meta and Google A quartet of lawmakers have penned a letter to the Department of Justice asking it to prosecute tax preparation companies for sharing customer data, including…