Microsoft Response to Distributed Denial of Service (DDoS) Attacks against HTTP/2 | MSRC Blog Beginning in September 2023, Microsoft was notified by industry partners about a newly identified Distributed Denial-of-Service (DDoS) attack technique being used in the wild targeting HTTP/2 protocol. This vulnerability (CVE-2023-44487) impacts any internet exposed HTTP/2 endpoints. Read more…
Introducing the Microsoft AI Bug Bounty Program featuring the AI-powered Bing experience | MSRC Blog Today at BlueHat we announced the new Microsoft AI bug bounty program with awards up to $15,000. This new bounty program features the AI-powered Bing experience as the first in scope product. The following products Read more…
Congratulations to the Top MSRC 2023 Q3 Security Researchers! | MSRC Blog Congratulations to all the researchers recognized in this quarter’s Microsoft Researcher Recognition Program leaderboard! Thank you to everyone for your hard work and continued partnership to secure customers. The top three researchers of the 2023 Q3 Security Researcher Read more…
Malvertising Campaign Targets Brazil’s PIX Payment System with GoPIX Malware The popularity of Brazil’s PIX instant payment system has made it a lucrative target for threat actors looking to generate illicit profits using a new malware called GoPIX. Kaspersky, which has been tracking the active campaign since December 2022, said Read more…
VMware Releases Patch for Critical vCenter Server RCE Vulnerability Oct 25, 2023NewsroomVulnerability / Cyber Threat VMware has released security updates to address a critical flaw in the vCenter Server that could result in remote code execution on affected systems. The issue, tracked as CVE-2023-34048 (CVSS score: 9.8), has been described Read more…
How to Identify and Combat It Oct 25, 2023The Hacker NewsRansomware/ Malware Threat In today’s digital landscape, around 60% of corporate data now resides in the cloud, with Amazon S3 standing as the backbone of data storage for many major corporations. Despite S3 being a secure service from a reputable Read more…
Critical OAuth Flaws Uncovered in Grammarly, Vidio, and Bukalapak Platforms Oct 25, 2023Newsroom Critical security flaws have been disclosed in the Open Authorization (OAuth) implementation of popular online services such as Grammarly, Vidio, and Bukalapak, building upon previous shortcomings uncovered in Booking[.]com and Expo. The weaknesses, now addressed by the Read more…
Nation State Hackers Exploiting Zero-Day in Roundcube Webmail Software Oct 25, 2023NewsroomThreat Intelligence / Vulnerability The threat actor known as Winter Vivern has been observed exploiting a zero-day flaw in Roundcube webmail software on October 11, 2023, to harvest email messages from victims’ accounts. “Winter Vivern has stepped up its Read more…
Researchers Warn of Kazakhstan’s Stealthy Cyber Espionage Group Oct 26, 2023NewsroomEndpoint Protection / Malware A relatively new threat actor known as YoroTrooper is likely made up of operators originating from Kazakhstan. The assessment, which comes from Cisco Talos, is based on their fluency in Kazakh and Russian, use of Tenge Read more…
Critical Flaw in NextGen’s Mirth Connect Could Expose Healthcare Data Oct 26, 2023NewsroomVulnerability / Network Security Users of Mirth Connect, an open-source data integration platform from NextGen HealthCare, are being urged to update to the latest version following the discovery of an unauthenticated remote code execution vulnerability. Tracked as CVE-2023-43208, Read more…