September 13, 2023
Watchdog urges change of HART: Late, expensive US biometric ID under fire
Uncle Sam warns deepfakes are coming for your brand and bank account
September 13, 2023
Airbus suffers data leak turbulence to cybercrooks’ delight
September 13, 2023
Will you give X your biometric data? – Week in security with Tony Anscombe
The update to X’s privacy policy has sparked some questions among privacy and security folks, including how long X will retain users’ biometric information and how the data will be stored and secured
September 13, 2023
ESET Research Podcast: Sextortion, digital usury and SQL brute-force
Closing intrusion vectors force cybercriminals to revisit old attack avenues, but also to look for new ways to attack their victims
September 13, 2023
Staying ahead of threats: 5 cybercrime trends to watch
New reports from Europol and the UK’s National Crime Agency (NCA) shed a light on how the battle against cybercrime is being fought
September 13, 2023
Sponsor with batch-filed whiskers: Ballistic Bobcat’s scan and strike backdoor
ESET Research uncovers the Sponsoring Access campaign, which utilizes an undocumented Ballistic Bobcat backdoor we have named Sponsor
September 13, 2023
Fake Signal and Telegram apps – Week in security with Tony Anscombe
ESET research uncovers active campaigns targeting Android users and spreading espionage code through the Google Play store, Samsung Galaxy Store and dedicated websites
September 13, 2023
Getting off the hook: 10 steps to take after clicking on a phishing link
Phishing emails are a weapon of choice for criminals intent on stealing people’s personal data and planting malware on their devices. The healing process does not end with antivirus scanning.
September 13, 2023
ESET Research Podcast: Unmasking MoustachedBouncer
Listen as ESET’s Director of Threat Research Jean-Ian Boutin unravels the tactics, techniques and procedures of MoustachedBouncer, an APT group taking aim at foreign embassies in Belarus
September 13, 2023
How a Telegram bot helps scammers target victims – Week in security with Tony Anscombe
ESET researchers uncover a Telegram bot that enables even less tech-savvy scammers to defraud people out of their money
September 13, 2023
BadBazaar espionage tool targets Android users via trojanized Signal and Telegram apps
ESET researchers have discovered active campaigns linked to the China-aligned APT group known as GREF, distributing espionage code that has previously targeted Uyghurs
September 13, 2023
What you need to know about iCloud Private Relay
If you want to try to enter the world of VPNs with a small dip, then iCloud Private Relay is your friend — but is it a true VPN service? The devil is in the details.
September 13, 2023
Recovering from a supply-chain attack: What are the lessons to learn from the 3CX hack?
The campaign started with a trojanized version of unsupported financial software
September 13, 2023
Scarabs colon-izing vulnerable servers
Analysis of Spacecolon, a toolset used to deploy Scarab ransomware on vulnerable servers, and its operators, CosmicBeetle
September 13, 2023
Evacuation of 30,000 hackers – Week in security with Tony Anscombe
DEF CON, the annual hacker convention in Las Vegas, was interrupted on Saturday evening when authorities evacuated the event’s venue due to a bomb threat
September 13, 2023
DEF CON 31: US DoD urges hackers to go and hack ‘AI’
The limits of current AI need to be tested before we can rely on their output
September 13, 2023
DEF CON 31: Robot vacuums may be doing more than they claim
When it comes to privacy, it remains complicated and near impossible for a consumer to make an informed decision.
September 13, 2023
20k security folks in the desert – Week in security with Tony Anscombe
Unsurprisingly, artificial intelligence took the center stage at this year’s edition of Black Hat, one of the world’s largest gatherings of cybersecurity professionals
September 13, 2023
Black Hat 2023: How AI changes the monetization of search
Search engines, AI, and monetization in the new era
September 13, 2023
Black Hat 2023: Hacking the police (at least their radios)
Hiding behind a black box and hoping no one will hack it has been routinely proven to be unwise and less secure.
September 13, 2023
A Bard’s Tale – how fake AI bots try to install malware
The AI race is on! It’s easy to lose track of the latest developments and possibilities, and yet everyone wants to see firsthand what the hype is about. Heydays for cybercriminals!
September 13, 2023
Black Hat 2023: ‘Teenage’ AI not enough for cyberthreat intelligence
Current LLMs are just not mature enough for high-level tasks
September 13, 2023
Black Hat 2023: AI gets big defender prize money
Black Hat is big on AI this year, and for a good reason
September 13, 2023
Black Hat 2023: Cyberwar fire-and-forget-me-not
What happens to cyberweapons after a cyberwar?
September 13, 2023
Mass-spreading campaign targeting Zimbra users
ESET researchers have observed a new phishing campaign targeting users of the Zimbra Collaboration email server.
September 13, 2023
Telekopye: Hunting Mammoths using Telegram bot
Analysis of Telegram bot that helps cybercriminals scam people on online marketplaces
September 13, 2023
Check cybersecurity pre-invest – Week in security with Tony Anscombe
When you invest in a company, do you check its cybersecurity? The U.S. Securities and Exchange Commission has adopted new cybersecurity rules.
September 13, 2023
MoustachedBouncer: Espionage against foreign diplomats in Belarus
Long-term espionage against diplomats, leveraging email-based C&C protocols, C++ modular backdoors, and adversary-in-the-middle (AitM) attacks… Sounds like the infamous Turla? Think again!
September 13, 2023
Time is money, and online game scammers have lots of it
Gamers and cybersecurity professionals have something in common – the ever-terrible presence of hacking, scams, and data theft – but how and why would anyone want to target gamers?
September 13, 2023
Is backdoor access oppressive? – Week in security with Tony Anscombe
Bills granting access to end-to-end encrypted systems, opportunity for cybercriminals, abuse by authority, human rights, and tech companies leaving the UK?
September 13, 2023
The grand theft of Jake Moore’s voice: The concept of a virtual kidnap
With powerful AI, it doesn’t take much to fake a person virtually, and while there are some limitations, voice-cloning can have some dangerous consequences.
September 13, 2023
Fingerprints all over: Can browser fingerprinting increase website security?
Browser fingerprinting is supposedly a more privacy-conscious tracking method, replacing personal information with more general data. But is it a valid promise?
September 13, 2023
Quantum computing: Will it break crypto security within a few years?
Current cryptographic security methods watch out – quantum computing is coming for your lunch.
September 13, 2023
Gathering dust and data: How robotic vacuums can spy on you
Mitigate the risk of data leaks with a careful review of the product and the proper settings.
September 13, 2023
Dear all, What are some common subject lines in phishing emails?
Scammers exploit current ongoing events, account notifications, corporate communication, and a sense of urgency.
September 13, 2023
Capita class action: 2,000 folks affected by data theft sign up
September 13, 2023
Red Hat OpenShift Container Platform release 4.11.49 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.11.
September 13, 2023
Ransomware attack hits Sri Lanka government, causing data loss
September 13, 2023
RedCloth could be made to crash if it received specially crafted input.
September 13, 2023
New mozilla-firefox packages are available for Slackware 15.0 and -current to fix a security issue.
September 13, 2023
Rebase to 0.5.2 to fix CVE-2023-22652 and CVE-2023-30079
September 13, 2023
China caught – again – with its malware in another nation’s power grid
September 12, 2023
It was discovered that there was a potential Man In the Middle (MITM) vulnerability in e2guardian, a web content filtering engine. Validation of SSL certificates was missing in e2guardian’s own MITM
September 12, 2023
Grab those updates: Microsoft flings out fixes for already-exploited bugs
September 12, 2023
security update
September 12, 2023
.NET could be made to crash if it received a specially crafted request.
September 12, 2023
OpenSSL 1.1.1 reaches end of life for all but the well-heeled
September 12, 2023
Google’s Chrome gets caught with its WebP down, offers hasty patch-up
September 12, 2023
An update that fixes four vulnerabilities is now available.
September 12, 2023
DISA STIG for Red Hat OpenShift is now available
September 12, 2023
Learn about Confidential Computing Attestation
September 12, 2023
The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:
September 12, 2023
The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:
September 12, 2023
The following updated rpms for Oracle Linux 7 have been uploaded to the Unbreakable Linux Network:
September 12, 2023
The following updated rpms for Oracle Linux 7 have been uploaded to the Unbreakable Linux Network:
September 12, 2023
The following updated rpms for Oracle Linux 7 have been uploaded to the Unbreakable Linux Network:
September 12, 2023
Save the Children hit by ransomware, 7TB stolen
September 11, 2023
security update
September 11, 2023
security update
September 11, 2023
Huge DDoS attack against US financial institution thwarted
September 11, 2023
Malice in the mail
September 11, 2023
An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function. (CVE-2020-36023) An issue was discovered in freedesktop poppler version 20.12.1, allows
September 11, 2023
Extension script @substitutions@ within quoting allow SQL injection. (CVE-2023-39417) MERGE fails to enforce UPDATE or SELECT row security policies. (CVE-2023-39418)
September 11, 2023
Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix). (CVE-2023-36664) A buffer overflow flaw was found in base/gdevdevn.c:1973 in
September 11, 2023
A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=”.?../../../../../../../../../../etc/passwd” in an xi:include element. (CVE-2023-38633)
September 11, 2023
Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. (CVE-2023-40477) References: – https://bugs.mageia.org/show_bug.cgi?id=32205
September 11, 2023
A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition […]
September 11, 2023
Google warns infoseccers: Beware of North Korean spies sliding into your DMs
September 11, 2023
security update
September 10, 2023
Security fix for CVE-2023-37464
September 10, 2023
– patchlevel 1872 —- The newest upstream commit Security fixes for CVE-2023-4733, CVE-2023-4752, CVE-2023-4750
September 10, 2023
Release notes for xrdp v0.9.23 (2023/08/31) General announcements – Running xrdp and xrdp-sesman on separate hosts is still supported by this release, but is now deprecated. This is not secure. A future v1.0 release will replace the TCP socket used between these processes with a Unix Domain Socket, and then cross-host running will not be […]
September 10, 2023
Security fix for CVE-2023-37464
September 10, 2023
Release notes for xrdp v0.9.23 (2023/08/31) General announcements – Running xrdp and xrdp-sesman on separate hosts is still supported by this release, but is now deprecated. This is not secure. A future v1.0 release will replace the TCP socket used between these processes with a Unix Domain Socket, and then cross-host running will not be […]
September 10, 2023
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.
September 9, 2023
The container bci/php was updated. The following patches have been included in this update:
September 9, 2023
The container bci/php-fpm was updated. The following patches have been included in this update:
September 9, 2023
The container bci/php-apache was updated. The following patches have been included in this update:
September 9, 2023
Security fix for CVE-2022-45061
September 9, 2023
New version 4.0.8. Includes fixes for CVE-2023-2906, CVE-2023-4511, CVE-2023-4512, CVE-2023-4513.
September 9, 2023
Security fix for CVE-2022-45061
September 9, 2023
security update
September 8, 2023
Safe delivery
September 8, 2023
An update is now available for Red Hat OpenShift GitOps 1.9. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
September 8, 2023
Apple races to patch the latest zero-day iPhone exploit
September 8, 2023
Vulnerabilities were found in libssh2, a client-side C library implementing the SSH2 protocol, which could lead to denial of service or remote information disclosure.
September 8, 2023
It was discovered that there was a potential denial of service vulnerability in Django, a popular Python-based web development framework.
September 8, 2023
Several security issues were fixed in GRUB2.
September 8, 2023
It was discovered that there was a potential Denial of Service (DoS) vulnerability in memcached, a high-performance in-memory object caching system.
September 7, 2023
Update to prevent invalid fragment values from leading to a buffer overrun
September 7, 2023
US, UK sanction more Russians linked to Trickbot
September 7, 2023