Vulnerabilities – Threatpost
Crippling Cyberattacks, Disinformation Top Concerns for Election Day
Cyber-researchers weigh in on what concerns them the most as the U.S. heads into the final weekend …
Read more >>
Vulnerabilities – Threatpost
WordPress Patches 3-Year-Old High-Severity RCE Bug
In all, WordPress patched 10 security bugs as part of the release of version 5.5.2 of its web publi…
Read more >>
Vulnerabilities – Threatpost
Firestarter Android Malware Abuses Google Firebase Cloud Messaging
The DoNot APT threat group is leveraging the legitimate Google Firebase Cloud Messaging server as a…
Read more >>
Vulnerabilities – Threatpost
Halloween News Wrap: The Election, Hospital Deaths and Other Scary Cyberattack Stories
Threatpost breaks down the scariest stories of the week ended Oct. 30 haunting the security industr…
Read more >>
Vulnerabilities – Threatpost
Microsoft Warns Threat Actors Continue to Exploit Zerologon Bug
Tech giant and feds this week renewed their urge to organizations to update Active Directory domain…
Read more >>
Vulnerabilities – Threatpost
NVIDIA Patches Critical Bug in High-Performance Servers
NVIDIA said a high-severity information-disclosure bug impacting its DGX A100 server line wouldn…
Read more >>
Vulnerabilities – Threatpost
REvil Gang Promises a Big Video-Game Hit; Claims Massive Revenue
In a wide-ranging interview, a REvil leader said the gang is earning $100 million per year, and pro…
Read more >>
Technology
U.S. Hospitals Warned of Hacking Threat Amid ‘Coordinated’ Ransomware Attack
Several federal agencies on Wednesday warned hospitals and cyber-researchers about “credib…
Read more >>
Vulnerabilities – Threatpost
Oracle WebLogic Server RCE Flaw Under Active Attack
The flaw in the console component of the WebLogic Server, CVE-2020-14882, is under active attack, r…
Read more >>
Vulnerabilities – Threatpost
Bug-Bounty Awards Spike 26% in 2020
The most-rewarded flaw is XSS, which is among those that are relatively cheap for organizations to …
Read more >>
Vulnerabilities – Threatpost
Microsoft’s SMBGhost Flaw Still Haunts 108K Windows Systems
While Microsoft patched the bug known as CVE-2020-0796 back in March, more than one 100,000 Windows…
Read more >>
Vulnerabilities – Threatpost
Iran-linked APT Targets T20 Summit, Munich Security Conference Attendees
The Phosphorous APT has launched successful attacks against world leaders who are attending the Mun…
Read more >>
Vulnerabilities – Threatpost
Election Security: How Mobile Devices Are Shaping the Way We Work, Play and Vote
With the election just a week away, cybercriminals are ramping up mobile attacks on citizens under …
Read more >>
Vulnerabilities – Threatpost
Experts Weigh in on E-Commerce Security Amid Snowballing Threats
How a retail sector reeling from COVID-19 can lock down their online systems to prevent fraud durin…
Read more >>
Vulnerabilities – Threatpost
Researchers: LinkedIn, Instagram Vulnerable to Preview-Link RCE Security Woes
Popular chat apps, including LINE, Slack, Twitter DMs and others, can also leak location data and s…
Read more >>
Vulnerabilities – Threatpost
Holiday Shopping Craze, COVID-19 Spur Retail Security Storm
Veracode's Chris Eng discusses the cyber threats facing shoppers who are going online due to th…
Read more >>
Vulnerabilities – Threatpost
Containerd Bug Exposes Cloud Account Credentials
The flaw (CVE-2020-15157) is located in the container image-pulling process. Via Vulnerabilities – …
Read more >>
Vulnerabilities – Threatpost
Vastaamo Breach: Hackers Blackmailing Psychotherapy Patients
Cybercriminals have already reportedly posted the details of 300 Vastaamo patients - and are threat…
Read more >>
Vulnerabilities – Threatpost
IoT Device Takeovers Surge 100 Percent in 2020
The COVID-19 pandemic, coupled with an explosion in the number of connected devices, have led to a …
Read more >>
Vulnerabilities – Threatpost
Election Security: Beyond Mail-In Voting
There are many areas of the election process that criminal hackers can target to influence election…
Read more >>
Vulnerabilities – Threatpost
Nvidia Warns Gamers of Severe GeForce Experience Flaws
Versions of Nvidia GeForce Experience for Windows prior to 3.20.5.70 are affected by a high-severit…
Read more >>
Vulnerabilities – Threatpost
Facebook, News and XSS Underpin Complex Browser Locker Attack
An elaborate set of redirections and hundreds of URLs make up a wide-ranging tech-support scam. Via…
Read more >>
Vulnerabilities – Threatpost
Microsoft Teams Phishing Attack Targets Office 365 Users
Up to 50,000 Office 365 users are being targeted by a phishing campaign that purports to notify the…
Read more >>
Vulnerabilities – Threatpost
Bug Parade: NSA Warns on Cresting China-Backed Cyberattacks
The Feds have published a Top 25 exploits list, rife with big names like BlueKeep, Zerologon and ot…
Read more >>
Vulnerabilities – Threatpost
Cisco Warns of Severe DoS Flaws in Network Security Software
The majority of the bugs in Cisco’s Firepower Threat Defense (FTD) and Adaptive Security Appliance …
Read more >>
Vulnerabilities – Threatpost
Oracle Kills 402 Bugs in Massive October Patch Update
Over half of Oracle's flaws in its quarterly patch update can be remotely exploitable without a…
Read more >>
Vulnerabilities – Threatpost
Google Patches Actively-Exploited Zero-Day Bug in Chrome Browser
The memory-corruption vulnerability exists in the browser’s FreeType font rendering library. Via Vu…
Read more >>
Vulnerabilities – Threatpost
Adobe Fixes 16 Critical Code-Execution Bugs Across Portfolio
The out-of-band patches follow a lighter-than-usual Patch Tuesday update earlier this month. Via Vu…
Read more >>
Vulnerabilities – Threatpost
Facebook: A Top Launching Pad For Phishing Attacks
Amazon, Apple, Netflix, Facebook and WhatsApp are top brands leveraged by cybercriminals in phishin…
Read more >>
Vulnerabilities – Threatpost
Mobile Browser Bugs Open Safari, Opera Users to Malware
A set of address-spoofing bugs affect users of six different types of mobile browsers, with some re…
Read more >>
Vulnerabilities – Threatpost
Google’s Waze Can Allow Hackers to Identify and Track Users
The company already patched an API flaw that allowed a security researcher to use the app to find t…
Read more >>
Vulnerabilities – Threatpost
DOJ Charges 6 Sandworm APT Members in NotPetya Cyberattacks
DOJ charges six Russian nationals for their alleged part in the NotPetya, Ukraine power grid and Ol…
Read more >>
Technology
Star Wars: Squadrons Crams Tons of Fun in a Tiny Cockpit
I’m flying through the Nadiri Dockyards, where the New Republic constructs warships to tak…
Read more >>
Vulnerabilities – Threatpost
Ryuk Ransomware Gang Uses Zerologon Bug for Lightning-Fast Attack
Researchers said the group was able to move from initial phish to full domain-wide encryption in ju…
Read more >>
Vulnerabilities – Threatpost
Microsoft Exchange, Outlook Under Siege By APTs
A new threat report shows that APTs are switching up their tactics when exploiting Microsoft servic…
Read more >>
Vulnerabilities – Threatpost
Game Titles Watch Dogs: Legion, Albion Both Targeted by Hackers
In both cases, cybercriminals claim to have reams of information for the popular gaming titles. Via…
Read more >>
Vulnerabilities – Threatpost
Microsoft Fixes RCE Flaws in Out-of-Band Windows Update
The two important-severity flaws in Microsoft Windows Codecs Library and Visual Studio Code could e…
Read more >>
Vulnerabilities – Threatpost
Biden Campaign Staffers Targeted in Cyberattack Leveraging Antivirus Lure, Dropbox Ploy
Google's Threat Analysis Group sheds more light on targeted credential phishing and malware att…
Read more >>
Vulnerabilities – Threatpost
Phishing Lures Shift from COVID-19 to Job Opportunities
Fortinet researchers are seeing a pivot in the spear-phishing and phishing lures used by cybercrimi…
Read more >>
Vulnerabilities – Threatpost
TikTok Launches Bug Bounty Program Amid Security Snafus
The move is a distinct change in direction for the app, which has been criticized and even banned f…
Read more >>
Vulnerabilities – Threatpost
Critical Magento Holes Open Online Shops to Code Execution
Adobe says the two critical flaws (CVE-2020-24407 and CVE-2020-24400) could allow arbitrary code ex…
Read more >>
Vulnerabilities – Threatpost
FIFA 21 Blockbuster Release Gives Fraudsters an Open Field for Theft
In-game features of the just-released FIFA 21 title give scammers easy access its vast audience. Vi…
Read more >>
Vulnerabilities – Threatpost
Zoom Rolls Out End-to-End Encryption After Setbacks
After backlash over false marketing around its encryption policies, Zoom will finally roll out end-…
Read more >>
Vulnerabilities – Threatpost
Travelex, Other Orgs Face DDoS Threats as Extortion Campaign Rages On
Organizations worldwide – including Travelex – have been sent letters threatening to launch DDoS at…
Read more >>
Vulnerabilities – Threatpost
October Patch Tuesday: Microsoft Patches Critical, Wormable RCE Bug
There were 11 critical bugs and six that were unpatched but publicly known in this month's regu…
Read more >>
Vulnerabilities – Threatpost
Lemon Duck Cryptocurrency-Mining Botnet Activity Spikes
Researchers warn of a spike in the cryptocurrency-mining botnet since August 2020. Via Vulnerabilit…
Read more >>
Vulnerabilities – Threatpost
Critical Flash Player Flaw Opens Adobe Users to RCE
The flaw stems from a NULL Pointer Dereference error and plagues the Windows, macOS, Linux and Chro…
Read more >>
Vulnerabilities – Threatpost
Election Systems Under Attack via Microsoft Zerologon Exploits
Cybercriminals are chaining Microsoft's Zerologon flaw with other exploits in order to infiltra…
Read more >>
Vulnerabilities – Threatpost
Authentication Bug Opens Android Smart-TV Box to Data Theft
The streaming box allows arbitrary code execution as root, paving the way to pilfering social-media…
Read more >>
Vulnerabilities – Threatpost
Facebook Debuts Bug-Bounty ‘Loyalty Program’
Facebook bounty hunters will be placed into tiers by analyzing their score, signal and number of su…
Read more >>
Vulnerabilities – Threatpost
Wormable Apple iCloud Bug Allows Automatic Photo Theft
Ethical hackers so far have earned nearly $300K in payouts from the Apple bug-bounty program for di…
Read more >>
Vulnerabilities – Threatpost
Cisco Fixes High-Severity Webex, Security Camera Flaws
Three high-severity flaws exist in Cisco's Webex video conferencing system, Cisco’s Video Surve…
Read more >>
Vulnerabilities – Threatpost
Amazon Prime Day Spurs Spike in Phishing, Fraud Attacks
A spike in phishing and malicious websites aimed at defrauding Amazon.com customers aim to make Pri…
Read more >>
Vulnerabilities – Threatpost
Google Rolls Out Fixes for High-Severity Android System Flaws
The most serious bugs are elevation-of-privilege issues in the Android System component (CVE-2020-0…
Read more >>
Vulnerabilities – Threatpost
Google’s Chrome 86: Critical Payments Bug, Password Checker Among Security Notables
Google is rolling out 35 security fixes, and a new password feature, in Chrome 86 versions for Wind…
Read more >>
Vulnerabilities – Threatpost
Comcast TV Remote Hack Opens Homes to Snooping
Researchers disclosed the 'WarezTheRemote' attack, affecting Comcast's XR11 voice remot…
Read more >>
Vulnerabilities – Threatpost
Grindr’s Bug Bounty Pledge Doesn’t Translate to Security
At SAS@Home, Luta Security CEO Katie Moussouris stressed that bug bounty programs aren't a '…
Read more >>
Vulnerabilities – Threatpost
Male Chastity Device Comes with Massive Security Flaws
Smart sex toy vulnerable to hacks, researchers say -- which could expose users’ most sensitive bits…
Read more >>
Vulnerabilities – Threatpost
Boom! Mobile Customer Data Lost to Fullz House/Magecart Attack
The Magecart spinoff group targeted the wireless service provider in an odd choice of victim. Via V…
Read more >>
Vulnerabilities – Threatpost
Microsoft Zerologon Flaw Under Attack By Iranian Nation-State Actors
Microsoft warns that the MERCURY APT has been actively exploiting CVE-2020-1472 in campaigns for th…
Read more >>
Vulnerabilities – Threatpost
Post Grid WordPress Plugin Flaws Allow Site Takeovers
Team Showcase, a sister plugin, is also vulnerable to the XSS and PHP object-injection bugs -- toge…
Read more >>
Vulnerabilities – Threatpost
Tenda Router Zero-Days Emerge in Spyware Botnet Campaign
A variant of the Mirai botnet, called Ttint, has added espionage capabilities to complement its den…
Read more >>
Vulnerabilities – Threatpost
Voter Registration ‘Error’ Phish Hits During U.S. Election Frenzy
Phishing emails tell recipients that their voter's registration applications are incomplete - b…
Read more >>
Vulnerabilities – Threatpost
305 CVEs and Counting: Bug-Hunting Stories From a Security Engineer
Larry Cashdollar, senior security response engineer at Akamai, talks about the craziest stories he&…
Read more >>
Vulnerabilities – Threatpost
InterPlanetary Storm Botnet Infects 13K Mac, Android Devices
In addition to Windows and Linux machines, a new variant of the malware now targets Mac and Android…
Read more >>
