Tag: update
-
iOS 19: Diese iPhones könnten in Apples Update-Plänen auf der Strecke bleiben
First seen on t3n.de Jump to article: t3n.de/news/ios-19-diese-iphones-koennten-in-apples-update-plaenen-auf-der-strecke-bleibwn-1680943/
-
Week in review: Probing activity on Palo Alto Networks GlobalProtect portals, Patch Tuesday forecast
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Attackers are probing Palo Alto Networks GlobalProtect portals Cybersecurity … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/04/06/week-in-review-probing-activity-on-palo-alto-networks-globalprotect-portals-patch-tuesday-forecast/
-
CISA Urges Patching For ‘Critical’ Ivanti VPN Flaw Exploited In Attacks
Exploitation of a critical-severity Ivanti Connect Secure vulnerability prompted CISA to issue an advisory Friday, urging organizations to implement patches to fix the issue. First seen on crn.com Jump to article: www.crn.com/news/security/2025/cisa-urges-patching-for-critical-ivanti-vpn-flaw-exploited-in-attacks
-
ISMG Editors: Who Will Shore Up Trump’s Federal Cyber Cuts?
Also: 23andMe’s Privacy Meltdown, Investors’ $500M AI Bet on ReliaQuest. In this week’s update, ISMG editors discussed the Trump administration’s cybersecurity funding cuts and potential impact on state and local ransomware defense. 23andMe’s bankruptcy and the FTC’s stance on genetic data privacy, ReliaQuest’s $500 million raise and what it means for AI-led SecOps. First seen…
-
Ivanti warns customers of new critical flaw exploited in the wild
Remediation: Organizations are urged to immediately update their Ivanti Connect Secure appliances to version 22.7R2.6 released in February or later to address CVE-2025-22457. Customers should also use the external version of the Integrity Checker Tool and look for web server crashes.”If your ICT result shows signs of compromise, you should perform a factory reset on…
-
Call Records of Millions Exposed by Verizon App Vulnerability
A patch has been released for a serious information disclosure vulnerability affecting a Verizon call filtering application. The post Call Records of Millions Exposed by Verizon App Vulnerability appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/call-records-of-millions-exposed-by-verizon-app-vulnerability/
-
Big hole in big data: Critical deserialization bug in Apache Parquet allows RCE
No known exploits yet: Neither Endor Labs nor NIST’s NVD entry reported any exploit attempts using CVE-2025-30065 as of publication of this article. Apache silently pushed a fix with the release of 1.15.1 on March 16, 2025, with a GitHub redirect to changes made in the update.Endor Labs advised prompt patching of the vulnerability, which…
-
Frida Penetration Testing Toolkit Updated with Advanced Threat Monitoring APIs
In a significant update to the popular dynamic instrumentation toolkit Frida, developers have introduced powerful new APIs for advanced threat monitoring and software analysis. These enhancements, released on April 4, 2025, offer security researchers and penetration testers unprecedented capabilities in tracking thread activity, module loading, and performance profiling. Thread Observation Made Easy One of the…
-
April 2025 Patch Tuesday forecast: More AI security introduced by Microsoft
Microsoft is continuing to build on their AI cybersecurity strategy and this month announced the introduction of new agents in Microsoft Security Copilot. They are introducing … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/04/04/april-2025-patch-tuesday-forecast/
-
$500,000 stolen in Australian super fund data breach
Super industry’s peak body says majority of hacking attempts stopped but money lost by a small number of customers<ul><li><a href=”https://www.theguardian.com/australia-news/live/2025/apr/04/australia-election-2025-live-peter-dutton-anthony-albanese-labor-coalition-poll-tariffs-trump-interest-rates-rba-ntwnfb”>Election 2025 live updates: Australia federal election campaign</li><li>Get our <a href=”https://www.theguardian.com/email-newsletters?CMP=cvau_sfl”>afternoon election email, <a href=”https://app.adjust.com/w4u7jx3″>free app or <a href=”https://www.theguardian.com/australia-news/series/full-story?CMP=cvau_sfl”>daily news podcast</li></ul>Hackers have targeted Australian superannuation funds this week, with a small number of customers losing a…
-
HSCC Urges White House to Shift Gears on Health Cyber Regs
The Health Sector Coordinating Council is urging the Trump administration to drop work on a proposed HIPAA security rule update and instead engage in a collaborative dialogue with healthcare sector leaders to create alternative cyber requirements, said Greg Garcia, executive director of HSCC. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/interviews/hscc-urges-white-house-to-shift-gears-on-health-cyber-regs-i-5472
-
China-linked group UNC5221 exploited Ivanti Connect Secure zero-day since mid-March
Tags: china, exploit, flaw, group, ivanti, remote-code-execution, threat, update, vulnerability, zero-dayIvanti addressed a critical remote code execution flaw in Connect Secure, which has been exploited since at least mid-March 2025. Ivanti released security updates to address a critical Connect Secure remote code execution vulnerability tracked as CVE-2025-22457. The vulnerability has been exploited by a China-linked threat actor since at least mid-March 2025. Ivanti did not disclose…
-
Ivanti patches Connect Secure zero-day exploited since mid-March
Tags: china, espionage, exploit, ivanti, malware, remote-code-execution, update, vulnerability, zero-dayIvanti has released security updates to patch a critical Connect Secure remote code execution vulnerability exploited by a China-linked espionage actor to deploy malware since at least mid-March 2025. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ivanti-patches-connect-secure-zero-day-exploited-since-mid-march/
-
Google Quick Share Bug Bypasses Allow Zero-Click File Transfer
Google addresses patch bypasses for CVE-2024-38272 and CVE-2024-38271, part of the previously announced QuickShell silent RCE attack chain against Windows users. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/google-quick-share-bug-bypasses-zero-click-file-transfer
-
iOS 19: Diese iPhones könnten das Update nicht mehr bekommen
First seen on t3n.de Jump to article: t3n.de/news/ios-19-diese-iphones-koennten-das-update-nicht-mehr-bekommen-1680943/
-
An Update on QuickShell: Sharing Is Caring about an RCE Attack Chain on Quick Share
See how a SafeBreach Labs researcher discovered a bypass for a fix to a critical vulnerability they previously reported in Google’s Quick Share data transfer utility. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/04/an-update-on-quickshell-sharing-is-caring-about-an-rce-attack-chain-on-quick-share/
-
Google Released Second Fix for Quick Share Flaws After Patch Bypass
Google’s patches for Quick Share for Windows vulnerabilities leading to remote code execution were incomplete and could be easily bypassed. The post Google Released Second Fix for Quick Share Flaws After Patch Bypass appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/google-released-second-fix-for-quick-share-flaws-after-patch-bypass/
-
Still Using an Older Version of iOS or iPadOS? Update Now to Patch These Critical Security Vulnerabilities
Apple has also fixed vulnerabilities in iPadOS 17.7.6, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5, as well as its recently released iOS 18.4. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-apple-security-fixes-ios-15-16/
-
3 Ways the UK Government Plans to Tighten Cyber Security Rules with New Bill
Tags: attack, country, cyber, government, infrastructure, ransomware, regulation, resilience, service, updateAmid a sharp spike in ransomware attacks disrupting essential services and critical infrastructure, the U.K. government has set out the scope of its upcoming Cyber Security and Resilience Bill for the first time. It aims to patch the holes in the country’s existing cyber regulations and protect critical infrastructure from ransomware and other attack types.…
-
Microsoft adds hotpatching support to Windows 11 Enterprise
Microsoft has announced that hotpatch updates are now available for business customers using Windows 11 Enterprise 24H2 on x64 (AMD/Intel) systems, starting today. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-adds-hotpatching-support-to-windows-11-enterprise/
-
Unhealthy Cybersecurity Postures
Updates from Enzoic’s Threat Research Team In the last Enzoic research update, we briefly discussed the travails of the healthcare industry and their challenges in establishing a successful cybersecurity posture in the face of a salivating cadre of identity thieves and ransomware operators. In the intervening few weeks, more analyses have been published, including the……
-
Microsoft’s AI tool catches critical GRUB2, U-boot bootloader flaws
Tags: access, ai, control, cybersecurity, exploit, firmware, flaw, Hardware, microsoft, mitigation, monitoring, risk, soc, supply-chain, tool, update, vulnerability, vulnerability-management, zero-dayAI-powered discovery changes the cybersecurity landscape: Microsoft’s Security Copilot tool significantly accelerated the vulnerability identification process, with a particular focus on filesystem implementations due to their high vulnerability potential.”Using Security Copilot, we were able to identify potential security issues in bootloader functionalities, focusing on filesystems due to their high vulnerability potential,” the blog stated. “This…
-
Canon Printer Drivers Flaw Could Let Hackers Run Malicious Code
A critical vulnerability (CVE-2025-1268) in Canon printer drivers allows remote code execution. See which drivers are affected, how to patch them. First seen on hackread.com Jump to article: hackread.com/canon-printer-drivers-flaw-hackers-run-malicious-code/
-
Google fixes GCP flaw that could expose sensitive container images
run.services.update and iam.serviceAccounts.actAspermissions they could modify a Cloud Run service and deploy a new revision.”In doing so, they could specify (through malicious code injection) any private container image stored in a victim’s registries, Matan added.According to a Tenable statement to CSO, an attacker could use this vulnerability for data theft or espionage in a real-world…
-
Cisco warns of CSLU backdoor admin account used in attacks
Cisco warns admins to patch a critical Cisco Smart Licensing Utility (CSLU) vulnerability, which exposes a built-in backdoor admin account now used in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisco-warns-of-cslu-backdoor-admin-account-used-in-attacks/
-
Apple Backports Zero-Day Patches to Older Devices in Latest Security Update
Apple has released a series of critical security updates to address vulnerabilities that were actively exploited as zero-day threats. These updates include backported patches for older versions of iOS, iPadOS, macOS, and watchOS, aiming to secure devices that may still be running outdated software. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/apple-backports-zero-day-patches/
-
Kritikpunkte und Statement von Claudia Plattner – BSI und Google wollen sichere Cloud-Lösungen entwickeln
First seen on security-insider.de Jump to article: www.security-insider.de/bsi-google-zusammenarbeit-sichere-cloud-loesungen-datensouveraenitaet-a-b473f5000d4b6fc8d01bb56146bdcd9c/
-
Apple backported fixes for three actively exploited flaws to older devices
Apple backports three critical vulnerabilities actively exploited in attacks against older iOS and macOS models. Apple has backported fixes for three actively exploited vulnerabilities to older devices and OS versions. The three vulnerabilities are: Apple released the following updates: that are available for the following devices: Follow me on Twitter:@securityaffairsandFacebookandMastodon PierluigiPaganini (SecurityAffairs hacking, newsletter) First seen on…