Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Midnight Blizzard and Cloudflare-Atlassian Cybersecurity Incidents: What to Know
The Midnight Blizzard and Cloudflare-Atlassian cybersecurity incidents raised alarms about the vulnerabilities inherent in major SaaS platforms. These incident…
TetrisPhantom: Cyber Espionage via Secure USBs Targets APAC Governments
Government entities in the Asia-Pacific (APAC) region are the target of a long-running cyber espionage campaign dubbedTetrisPhantom."The attacker covertly spie…
Alert: Apache Superset Vulnerabilities Expose Servers to Remote Code Execution Attacks
Patches have been released to address two new securityvulnerabilities in Apache Supersetthat could be exploited by an attacker to gain remote code execution on…
It's a Zero-day? It's Malware? No! It's Username and Password
As cyber threats continue to evolve, adversaries are deploying a range of tools to breach security defenses and compromise sensitive data. Surprisingly, one of…
Debian LTS: DLA-3524-1: linux security update
Daniel Moghimi discovered Gather Data Sampling (GDS), a hardware vulnerability for Intel CPUs which allows unprivileged speculative access to data which was pr…
Mitigations for Eleven Severe Chromium Flaws Released
Eleven severe vulnerabilities have been found in Chromium, including multiple Type Confusion bugs in V8, use-after-frees in Cast, Blink Task Scheduling and Web…
Debian LTS: DLA-3522-1: hdf5 security update
Multiple security vulnerabilities were discovered in HDF5, a Hierarchical Data Format and a library for scientific data. Memory leaks, out-of-bound reads and d…
X.Org DoS, Code Execution Vulns Fixed
Several significant out-of-bounds access vulnerabilities have been found in the X.Org X Server (CVE-2021-4008, CVE-2021-4009, and CVE-2021-4011). These flaws t…
How to Improve Your API Security Posture
APIs, more formally known as application programming interfaces, empower apps and microservices to communicate and share data. However, this level of connectiv…
Mageia 2023-0082: libraw security update
Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/li…
Mageia 2023-0078: nodejs security update
The following CVEs are fixed in this release: CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High) CVE-2023-23920: Node.j…
Patch Where it Hurts: Effective Vulnerability Management in 2023
A recently publishedSecurity Navigatorreport data shows that businesses are still taking 215 days to patch a reported vulnerability. Even for critical vulnerab…
Mageia 2022-0465: matio security update
matio (aka MAT File I/O Library) 1.5.18 through 1.5.21 has a heap-based buffer overflow in ReadInt32DataDouble (called from ReadInt32Data and Mat_VarRead4). (C…
Mageia 2022-0281: python-django security update
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untruste…
Mageia 2022-0152: librecad security upda
A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using …
Fedora 34: grafana 2022-83405f9d
- update to 7.5.15 tagged upstream community sources, see CHANGELOG - resolve CVE-2022-21673 grafana: Forward OAuth Identity Token can allow users to access so…
Red Cross Cyberattack Links Back To A Zoho ManageEngine Vulnerability
A month after the disruptive data breach, Red Cross has shared more details about the…Red Cross Cyberattack Links Back To A Zoho ManageEngine Vulnerability on …
Ukraine: Recent Cyber Attacks Part of Wider Plot to Sabotage Critical Infrastructure
The coordinated cyberattacks targetingUkrainian government websitesand the deployment of a data-wiper malware calledWhisperGateon select government systems are…
Mageia 2022-0002: log4j security upda
Apache Log4j2 is vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a …
Vulnerability Scanning Frequency Best Practices
So you've decided to set up a vulnerability scanning programme, great. That's one of the best ways to avoid data breaches. How often you should run your scans,…
Mageia 2021-0520: couchdb security upda
Privilege escalation that allows an attacker to add or remove data in any database or make configuration changes. (CVE-2021-38295) References: - https://bugs.m…
Cring Ransomware Gang Exploits 11-Year-Old ColdFusion Bug
Unidentified threat actors breached a server running an unpatched, 11-year-old version of Adobe's ColdFusion 9 software in minutes to remotely take over contro…
Researchers Detail Modus Operandi of ShinyHunters Cyber Crime Group
ShinyHunters, a notorious cybercriminal underground group that's been on a data breach spree since last year, has been observed searching companies' GitHub rep…
SciLinux: SLSA-2021-3176-1 Important: microcode_ctl
hw: Vector Register Data Sampling (CVE-2020-0548) * hw: L1D Cache Eviction Sampling (CVE-2020-0549) * hw: Special Register Buffer Data Sampling (SRBDS) (CVE-20…