CISA released one Industrial Control Systems (ICS) advisory on March 21, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-081-01 Advantech WebAccess/SCADA CISA encourages users and administrators to review the newly released ICS…
Tag: EN
Google Pays $10M in Bug Bounties in 2023
BleepingComputer has the details. It’s $2M less than in 2022, but it’s still a lot. The highest reward for a vulnerability report in 2023 was $113,337, while the total tally since the program’s launch in 2010 has reached $59 million.…
I-Soon Leak: Exposing China’s Cyber Espionage
In the dark caves of cyberspace, where secrets are traded like currency and digital shadows gamble, a recent leak of documents reveals that China’s hacking community is not as advanced and systematic as it appears. The leak is likely from…
Large-Scale StrelaStealer Campaign in Early 2024
We unravel the details of two large-scale StrelaStealer campaigns from 2023 and 2024. This email credential stealer has a new variant delivered through zipped JScript. The post Large-Scale StrelaStealer Campaign in Early 2024 appeared first on Unit 42. This article…
Reddit Shares Surge After Successful NYSE IPO
Reddit enjoys successful initial public offering in New York, as shares rose which in turn pushed its market cap to $8 billion This article has been indexed from Silicon UK Read the original article: Reddit Shares Surge After Successful NYSE…
DHCP Hacked to Escalate Privileges in Windows Domains
Security researchers have uncovered a sophisticated method of exploiting the Dynamic Host Configuration Protocol (DHCP) administrators group to escalate privileges within Windows domains. This technique, dubbed “DHCP Coerce,” leverages legitimate privileges to compromise entire networks potentially. The vulnerability centers around…
Exploit Released For Critical Fortinet RCE Flaw: Patch Soon!
FortiClientEMS (Enterprise Management Server), the security solution used for scalable and centralized management, was discovered with an SQL injection vulnerability that could allow an unauthenticated threat actor to execute unauthorized code or command on vulnerable servers through specially crafted requests. …
One-Click AWS Vulnerability Let Attackers Takeover User’s Web Management Panel
Tenable Research has identified a critical vulnerability within the AWS Managed Workflows for Apache Airflow (MWAA) service, which they have named “FlowFixation.” This vulnerability could have permitted attackers to execute a one-click takeover of a user’s web management panel for…
Tesla, OS, Software Exploits Earn Hackers $1.1 Million at Pwn2Own 2024
Exploits targeting Tesla cars, operating systems, and popular software earned participants over $1.1 million at Pwn2Own Vancouver 2024. The post Tesla, OS, Software Exploits Earn Hackers $1.1 Million at Pwn2Own 2024 appeared first on SecurityWeek. This article has been indexed…
OpenSSL 3.3 Alpha Release Live
The Alpha release of OpenSSL 3.3 is now live. This release is in accordance with our adoption of biannual time-based releases. As this is an alpha release, it is intended for development and testing purposes. It represents the first step…
Upcoming Webinar: Writing Your First OpenSSL Application
We are thrilled to announce our upcoming webinar, Writing Your First OpenSSL Application. This webinar is designed to take you from an understanding of basic cryptography concepts to writing your first secure application using OpenSSL. It’s the perfect starting point…
Unmasking the Vulnerabilities in Telecom Signaling: A Call for Enhanced Security
Mobilizing Collective Action for Telecom Signaling Security By Rowland Corr, Vice President and Head of Government Relations, Enea Telecommunications, particularly mobile networks, have become the backbone of our modern, interconnected […] The post Unmasking the Vulnerabilities in Telecom Signaling: A…
Silicon UK In Focus Podcast: Circular Computing Equals a Circular Economy
Learn how your business can accelerate its sustainability journey by adopting circular computing as a core principle of its ESG. This article has been indexed from Silicon UK Read the original article: Silicon UK In Focus Podcast: Circular Computing Equals…
Understanding ISO 27001:2022 Annex A.7 – Human Resource Security
We started the ISO 27001:2022 series with the promise of explaining how the 14 categories of controls can be implemented. Today we address ISO 27001:2022 Annex A.7, “Human Resource Security”. These controls address the critical role that personnel play in information security…
TeamCity Vulnerability Exploits Leads to Surge in Ransomware Attacks
Attackers are taking advantage of vulnerabilities in JetBrains Teamcity to distribute ransomware, coinminers, and backdoor payloads. Two critical vulnerabilities in the TeamCity On-Premises platform, identified as CVE-2024-27198 and CVE-2024-27199 by JetBrains, were published on March 4, 2024. These flaws enable…
TinyTurla Evolved TTPs To Stealthly Attack Enterprise Organizations
Staying ahead of security measures and exploiting new vulnerabilities requires hackers to change their tactics. By doing so, they manage to bypass better defenses, maximize success rates, and keep on with their illegal activities. The adaptation of techniques by hackers…
How Microsoft Incident Response and Microsoft Defender for Identity work together to detect and respond to cyberthreats
Learn how Microsoft Incident Response works together with Microsoft Defender for Identity to give customers fast, flexible service—before, during, or after a cybersecurity incident occurs. The post How Microsoft Incident Response and Microsoft Defender for Identity work together to detect…
Unsaflok Vulnerability Lets Hackers Open 3M+ Hotel Doors in Seconds
A group of cybersecurity researchers has uncovered several critical security flaws in the Saflok electronic RFID locks by Dormakaba. These locks, widely used in hotels and multi-family housing environments across 131 countries, are now known to be susceptible to a…
MediaWorks – 162,710 breached accounts
In March 2024, millions of rows of data from the New Zealand media company MediaWorks was publicly posted to a popular hacking forum. The incident exposed 163k unique email addresses provided by visitors who filled out online competitions and included…
Evasive Panda Cyber Attacks: Threat Actor Targets Tibetans
Cybersecurity experts at ESET have come across a malicious campaign that targets Tibetans in many countries by leveraging the website of a religious gathering. Evasive Panda cyber attacks are associated with a China-linked Advanced Persistent Threat (APT) actor. The development…