CISA Warns of Active Exploitation in SolarWinds Help Desk Software Vulnerability Oct 16, 2024Ravie LakshmananVulnerability / Data Protection The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a critical security flaw impacting SolarWinds Web Help Desk (WHD) software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of Read more…
GitHub Patches Critical Flaw in Enterprise Server Allowing Unauthorized Instance Access Oct 16, 2024Ravie LakshmananEnterprise Security / Vulnerability GitHub has released security updates for Enterprise Server (GHES) to address multiple issues, including a critical bug that could allow unauthorized access to an instance. The vulnerability, tracked as CVE-2024-9487, carries a Read more…
Pentagon shares new cybersecurity rules for government contractors The U.S. Department of Defense introduced new cybersecurity requirements for companies that contract with the federal government. The Pentagon said that its new rules, dubbed Cybersecurity Maturity Model Certification (CMMC), will aim to simplify the process of getting certified to do government Read more…
Ward Christensen, BBS inventor and architect of our online age, dies at age 78 A low-key giant Suess died in 2019, and with the passing of both BBS originators, we find ourselves at the symbolic end of an era, although many BBSes still run today. These are typically piped through Read more…
New Linux Variant of FASTCash Malware Targets Payment Switches in ATM Heists Oct 15, 2024Ravie LakshmananFinancial Fraud / Linux North Korean threat actors have been observed using a Linux variant of a known malware family called FASTCash to steal funds as part of a financially-motivated campaign. The malware is “installed Read more…
TrickMo Banking Trojan Can Now Capture Android PINs and Unlock Patterns Oct 15, 2024Ravie LakshmananMobile Security / Financial Fraud New variants of an Android banking trojan called TrickMo have been found to harbor previously undocumented features to steal a device’s unlock pattern or PIN. “This new addition enables the threat Read more…
New Malware Campaign Uses PureCrypter Loader to Deliver DarkVision RAT Oct 15, 2024Ravie LakshmananMalware / Cybercrime Cybersecurity researchers have disclosed a new malware campaign that leverages a malware loader named PureCrypter to deliver a commodity remote access trojan (RAT) called DarkVision RAT. The activity, observed by Zscaler ThreatLabz in July Read more…
Vulnerable instances of Log4j still being used nearly 3 years later Editor’s note: This article originally appeared in our sister publication SC Magazine UK. Almost three years after the discovery of the Log4Shell vulnerability, 13% of active Log4j installations are running vulnerable versions. According to new research by Sonatype, while 13% Read more…
Why Traditional Security Solutions Fall Short In recent years, the number and sophistication of zero-day vulnerabilities have surged, posing a critical threat to organizations of all sizes. A zero-day vulnerability is a security flaw in software that is unknown to the vendor and remains unpatched at the time of discovery. Read more…
China Accuses U.S. of Fabricating Volt Typhoon to Hide Its Own Hacking Campaigns China’s National Computer Virus Emergency Response Center (CVERC) has doubled down on claims that the threat actor known as the Volt Typhoon is a fabrication of the U.S. and its allies. The agency, in collaboration with the Read more…