Menu

Latest articles

Senate renews warrantless collection of web histories
Hackers compromise Supercomputers across Europe with cryptominers
The ProLock ransomware doesn’t tell you one important thing about decrypting your files
Edison Mail bug exposed iPhone users’ email accounts to complete strangers
Shiny new Azure login attracts shiny new phishing attacks
Kali Linux 2020.2 Released, Download Now!!!>
The US Senate just voted to let the FBI access your browser history without a warrant>

An update that solves four vulnerabilities and has one errata is now available.

An update that fixes one vulnerability is now available.

An update that solves 7 vulnerabilities and has one errata is now available.

An update that fixes one vulnerability is now available.

An update that solves one vulnerability and has one errata is now available.

An update that fixes three vulnerabilities is now available.

I know what you leased last summer: Asset database leak hits Capita, Rolls-Royce, Tesco (every little helps, eh?)
A real loch mess: Navy larks sunk by a truculent torpedo
Dutch spies helped Britain’s GCHQ break Argentine crypto during Falklands War
New Report: Severe Flaws in Cyberoam’s Firewall and VPN Technology Left At Least 86,000 Networks Vulnerable to Exploit>
Know The Enemy: Upgrade Your Threat Detection Strategy with Honeynets>

8u252 update

Update to latest upstream 8.8.8

Are you ready, kids? I said, are you ready? Whoooooo has another update for you to see? Google Chromium! For browsing and tweeting (but not FTP) Google Chromium! If improved security be something you wish Google Chromium! Then run dnf while you flop like a fish! Google Chromium! Google Chromium! Google Chromium! Google Chromium! Ahem. […]

Update to 4.9.0

REvil hackers leaks email conversation on Trump amid ransom demand

Update to latest upstream 8.8.8

Are you ready, kids? I said, are you ready? Whoooooo has another update for you to see? Google Chromium! For browsing and tweeting (but not FTP) Google Chromium! If improved security be something you wish Google Chromium! Then run dnf while you flop like a fish! Google Chromium! Google Chromium! Google Chromium! Google Chromium! Ahem. […]

Authorities bust hacker group planning to hit hospitals with ransomware
Flaws in cyber security firm’s firewall & VPN tech exposed 100k+ devices

It was discovered that exim4, a mail transport agent, suffers from a authentication bypass vulnerability in the spa authentication driver. The spa authentication driver is not enabled by default.

Cybercrime marketplace MagBo selling access to 43,000 hacked websites

OpenConnect, a VPN software, had a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to get_cert_name in gnutls.c.

Version update + security fix

security update

security update

Version update + security fix

Update to OpenEXR-2.4.1, see https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1 for details.

Update to OpenEXR-2.4.1, see https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1 for details.

Hoaxcalls Botnet Exploits Symantec Secure Web Gateways
Mandrake Android malware stealing Facebook, crypto data since 2016
News Wrap: Ransomware Extortion Tactics, Contact-Tracing App Security Worries
Zero-day attacks are potent cyber threats that require serious response
Mikroceen: Spying backdoor leveraged in high‑profile networks in Central Asia

ESET researchers dissect a backdoor deployed in attacks against multiple government agencies and major organizations operating in two critical infrastructure sectors in Asia The post Mikroceen: Spying backdoor leveraged in high‑profile networks in Central Asia appeared first on WeLiveSecurity

Pay $42m or Trump’s ‘dirty laundry’ goes online – REvil ransomware hackers
Cyber attack against UK power grid middleman Elexon sparks in-house IT recovery efforts
RATicate Group Hits Industrial Firms With Revolving Payloads
An outbreak of Coronavirus trojans and scams
You can’t have it both ways: Anti-coronavirus masks may thwart our creepy face-recog cameras, London cops admit

Updated libreswan packages fix security vulnerability: An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan. An unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange

Updated suricata packages fix security vulnerabilities: The suricata package has been updated to version 4.1.8, which fixes security issues and other bugs. See the upstream announcements for details.

Updated jbig2dec packages fix security vulnerability: jbig2_image_compose in jbig2_image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow (CVE-2020-12268).

The updated packages fix security vulnerabilities including: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled

Updated netkit-telnetd packages fix security vulnerability: A vulnerability was found where incorrect bounds checks in the telnet server’s (telnetd) handling of short writes and urgent data, could lead to information disclosure and corruption of heap data. An unauthenticated

8 best dark web search engines for 2020
Paying Ransomware Crooks Doubles Clean-up Costs, Report
How scammers abuse Google Search’s open redirect feature
Security flaws mitigated by compiler optimizations

An update that fixes one vulnerability is now available.

Top 10 most exploited vulnerabilities list released by FBI, DHS CISA
Microsoft joins encrypted DNS club with Windows 10 option
Vint Cerf suggests GDPR could hurt coronavirus vaccine development
Brit defense contractor hacked, up to 100,000 past and present employees’ details siphoned off – report
Innovative Spy Trojan Targets European Diplomatic Targets

security update

TikTok Violated Children’s Privacy Law, FTC Complaint Says
Stolen database trading site WeLeakData hacked; data leaked
Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks

ESET researchers uncover several instances of malware that uses various attack vectors to target systems isolated by an air gap The post Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks appeared first on WeLiveSecurity

PrintDemon – patch this ancient Windows printer bug!
Microsoft Adds DNS-Over-HTTPS Support for Windows 10 Insiders
The most-targeted security vulnerabilities – despite patches having been available for years

An update that solves two vulnerabilities and has four fixes is now available.

An update that fixes one vulnerability is now available.

Utah Says No to Apple/Google COVID-19 Tracing; Debuts Startup App
New malware Ramsay can steal data from air-gapped computers
Woman stalked by sandwich server via her COVID-19 contact tracing info
BEC Gang Exploits G Suite, Long Domain Names in Cyberattacks
Login with Facebook Bug Earns $20K Bounty
Multi-part Android spyware lurked on Google Play Store for 4 years, posing as a bunch of legit-looking apps
Google Firebase misconfiguration exposes data of 20k+ Android users
Understanding the DTLS all-zero ClientHello.random vulnerability

An update that solves 35 vulnerabilities and has 21 fixes is now available.

‘iOS security is f**ked’ says exploit broker Zerodium: Prices crash for taking a bite out of Apple’s core tech
Update now! Windows gets another bumper patch update

NOTE: This DLA was intially sent on 2020-04-14 but for reasons unknown failed to reach the mailing list. It is being re-sent now to ensure that it appears in the mailing list archive. No new version of

An update that fixes one vulnerability is now available.

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which

There’s Norway you’re going to believe this: Government investment fund conned out of $10m in cyber-attack
US-CERT lists the 10 most-exploited security bugs and, yeah, it’s mostly Microsoft holes people forgot to patch
Aussie money-manager MyBudget goes down for five days

security update

Smashing Security #178: Office pranks, meat dresses, and robocop dogs
Now there’s nothing stopping the PATRIOT Act allowing the FBI to slurp web-browsing histories without a warrant
Senator Wyden demands deep probe into spyware after hacking toolkit offered to American cops by NSO Group
Texas Courts Won’t Pay Up in Ransomware Attack
Leaked NHS Docs Reveal Roadmap, Concerns Around Contact-Tracing App
Stop tracking me, Google: Austrian citizen files GDPR legal complaint over Android Advertising ID
WannaCryptor remains a global threat three years on

WannaCryptor is still alive and kicking, so much so that it sits atop the list of the most commonly detected ransomware families The post WannaCryptor remains a global threat three years on appeared first on WeLiveSecurity

Lukas Stefanko: How we fought off a DDoS attack from a mobile botnet

Hot on the heels of his research into an attack that attempted to take down ESET’s website, Lukas Stefanko sheds more light on threats posed by mobile botnets The post Lukas Stefanko: How we fought off a DDoS attack from a mobile botnet appeared first on WeLiveSecurity

Beware the DHL delivery message email – it could be a package scam
Ramsay Malware Targets Air-Gapped Networks
Healthcare Giant Magellan Struck with Ransomware, Data Breach
Danger zone! Brit research supercomputer ARCHER’s login nodes exploited in cyber-attack, admins reset passwords and SSH keys