Tag: update
-
TgToxic Android Malware Updated it’s Features to Steal Login Credentials
The TgToxic Android malware, initially discovered in July 2022, has undergone significant updates, enhancing its ability to steal login credentials and financial data. Originally targeting Southeast Asian users through phishing campaigns and deceptive apps, the malware has now evolved to include advanced features and expanded its geographical scope to Europe and Latin America. Researchers have…
-
Critical deserialization bugs in Adobe, Oracle software actively exploited, warns CISA
Oracle Agile PLM flaw open to N-days: The other vulnerability, fixed in January 2024, is a high severity (CVSS 8.8/10) flaw in the export component of the Oracle’s PLM software, and stems from the improper handling of serialized data. It’s tracked as CVE-2024-20953. Successful exploitation could enable a low-privileged attacker with network access via HTTP…
-
New EU Sanctions Blacklist Russian and North Korean Cyber Operatives
The Council of the European Union took decisive action to impose a new set of sanctions on Russia, with the aim of addressing threat to Ukraine’s sovereignty. The sanctions were codified in Council Implementing Regulation (EU) 2025/389, which represents a new update to the Regulation (EU) No 269/2014. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/council-of-the-european-union-sanction-russia/
-
Zero-Day Bug Pops Up in Parallels Desktop for Mac
A patch bypass for a bug in the popular desktop emulator enables root-level privilege escalation and has no fix in sight. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/zero-day-bug-parallels-desktop-mac
-
How to create an effective incident response plan
Tags: access, advisory, attack, backup, breach, business, ceo, ciso, communications, corporate, cyber, cybersecurity, email, endpoint, exploit, finance, governance, guide, incident, incident response, insurance, law, lessons-learned, malicious, monitoring, network, office, phone, ransomware, risk, security-incident, service, strategy, supply-chain, technology, threat, updateEstablish a comprehensive post-incident communications strategy: Another key element that can make or break an incident response strategy is communications. Without clear communications among the major stakeholders of the business, a company might experience much longer downtimes or the loss of vital processes for extended periods.”How are you going to go about communicating? With whom?…
-
Patch lässt sich umgehen: Root-Lücke in Parallels Desktop gefährdet Mac-Nutzer
Eigentlich gibt es für die Sicherheitslücke längst einen Patch. Effektiv ist dieser aber wohl nicht. Ein Forscher zeigt, wie er sich umgehen lässt. First seen on golem.de Jump to article: www.golem.de/news/patch-laesst-sich-umgehen-root-luecke-in-parallels-desktop-gefaehrdet-mac-nutzer-2502-193685.html
-
European Union calls for more cyber data-sharing with Nato
Updates to the EU’s Cyber Blueprint, establishing best practice for multilateral security incident response in Europe, include calls for more collaboration with Nato member states, as the geopolitical environment becomes ever more fractious First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366619486/European-Union-calls-for-more-cyber-data-sharing-with-Nato
-
Cybersecurity Weekly Update 24 February 2025
Tags: access, ai, apple, attack, cyber, cyberattack, cybersecurity, data, email, encryption, finance, government, office, privacy, regulation, risk, service, theft, updateWelcome to this week’s edition of our cybersecurity news roundup, bringing you the latest developments and insights from the UK and beyond. Home Office Contractor’s Data Collection Sparks Privacy Concerns The Home Office faces scrutiny after revelations that its contractor, Equifax, collected data on British citizens while conducting financial checks on migrants applying for fee…
-
Wireshark 4.4.4 Released Explore the Latest Features!
The Wireshark Foundation has announced the release of Wireshark 4.4.4, the latest iteration of the world’s most widely used network protocol analyzer. This update focuses on enhancing stability, refining protocol dissectors, and addressing critical security vulnerabilities, cementing Wireshark’s position as an indispensable tool for network professionals and researchers. Security and Stability Enhancements The release addresses…
-
Google Introduces Quantum-Safe Digital Signatures in Cloud KMS
Tags: cloud, cryptography, cyber, cybersecurity, encryption, google, service, technology, tool, updateGoogle Cloud has unveiled a critical cybersecurity upgrade:quantum-safe digital signaturesvia its Key Management Service (Cloud KMS), now available in preview. This move aligns with the National Institute of Standards and Technology’s (NIST) 2024 post-quantum cryptography (PQC) standards, offering developers tools to safeguard encryption against future quantum threats. Quantum-Resistant Signatures Enter the Mainstream Google’s latest update…
-
MSP Update: McChord, Fass Debut Slide BCDR at Right of Boom
First seen on scworld.com Jump to article: www.scworld.com/news/msp-update-mcchord-fass-debut-slide-bcdr-at-right-of-boom
-
Security Update: AvePoint Adds AI to Elements Platform for MSPs
First seen on scworld.com Jump to article: www.scworld.com/news/security-update-avepoint-adds-ai-to-elements-platform-for-msps
-
MSSP Market Update: Securiti, Databricks Team Up for AI AppSec
First seen on scworld.com Jump to article: www.scworld.com/news/mssp-market-update-securiti-databricks-team-up-for-ai-appsec
-
ISMG Editors: Is Russia’s Ransomware Purge for Real?
Also: AI Benchmark Hype, Trump’s Cybersecurity Shake-Up, Musk’s Growing Influence. In this week’s update, ISMG editors analyze motives behind Russia’s sudden crackdown on ransomware gangs and discuss whether AI benchmark scores are more hype than reality and whether President Donald Trump’s policies and Elon Musk’s influence pose security risks – or just more political theater.…
-
Citrix addressed NetScaler console privilege escalation flaw
Citrix addressed a high-severity privilege escalation vulnerability impacting NetScaler Console and NetScaler Agent under certain conditions. Citrix released security updates to address a high-severity security vulnerability, tracked as CVE-2024-12284 (CVSS score of 8.8) impacting NetScaler Console (formerly NetScaler ADM) and NetScaler Agent. The vulnerability is an improper privilege management that could allow attackers to escalate privileges…
-
CVE-2024-12284: NetScaler Users Urged to Update Against Critical Flaw
Cloud Software Group released critical security updates to address a high-severity vulnerability in the NetScaler Console and NetScaler Console Agent, identified as CVE-2024-12284. This vulnerability could potentially allow an authenticated malicious actor to execute commands without additional authorization, which could lead to security risks if not addressed promptly. First seen on thecyberexpress.com Jump to article:…
-
Ghost ransomware crew continues to haunt IT depts with scarily bad infosec
FBI and CISA issue reminder – deep sigh – about the importance of patching and backups First seen on theregister.com Jump to article: www.theregister.com/2025/02/20/fbi_beware_of_ghost_ransomware/
-
Cyberangriff auf Kliniken in Australien
19 February 2025: Important update about a cyber incident First seen on genea.com.au Jump to article: www.genea.com.au/pages/important-update-about-a-cyber-incident-MCI2XUN2KJWRFXNMZI2ZZ3QVD2JA
-
Windows Disk Cleanup Tool Exploit Allows SYSTEM Privilege Escalation
Microsoft has urgently addressed a high-severity privilege escalation vulnerability (CVE-2025-21420) in the Windows Disk Cleanup Utility (cleanmgr.exe) during its February 2025 Patch Tuesday updates. The flaw, scoring 7.8 on the CVSS scale, enabled attackers to execute malicious code with SYSTEM privileges through DLL sideloading techniques. Technical Mechanism of the Exploit The vulnerability leverages cleanmgr.exe’s privileged…
-
Citrix Releases Security Fix for NetScaler Console Privilege Escalation Vulnerability
Citrix has released security updates for a high-severity security flaw impacting NetScaler Console (formerly NetScaler ADM) and NetScaler Agent that could lead to privilege escalation under certain conditions.The vulnerability, tracked as CVE-2024-12284, has been given a CVSS v4 score of 8.8 out of a maximum of 10.0It has been described as a case of improper…
-
Microsoft Patches Actively Exploited Power Pages Privilege Escalation Vulnerability
Microsoft has released security updates to address two Critical-rated flaws impacting Bing and Power Pages, including one that has come under active exploitation in the wild.The vulnerabilities are listed below -CVE-2025-21355 (CVSS score: 8.6) – Microsoft Bing Remote Code Execution VulnerabilityCVE-2025-24989 (CVSS score: 8.2) – Microsoft Power Pages Elevation of Privilege Vulnerability” First seen on…
-
Neue Bedrohungsakteure: FakeAngriffe zum Malware-Upload
First seen on datensicherheit.de Jump to article: www.datensicherheit.de/neu-bedrohungsakteure-fake-update-angriffe-malware-upload
-
Military Health Firm Pays $11.2M to Settle Cyber Fraud Case
DOJ Says Contractor Falsely Claimed to Meet Critical Cyber Requirements. A military health benefits administrator has agreed to pay $11.2 million to settle allegations that the company falsely certified compliance with cybersecurity requirements – including patch management – for three years in a contract with the U.S. Department of Defense. First seen on govinfosecurity.com Jump…
-
Patch Now: CISA Warns of Palo Alto Flaw Exploited in the Wild
The authentication bypass vulnerability in the OS for the company’s firewall devices is under increasing attack and being chained with other bugs, making it imperative for organizations to mitigate the issue ASAP. First seen on darkreading.com Jump to article: www.darkreading.com/remote-workforce/patch-now-cisa-researchers-warn-palo-alto-flaw-exploited-wild
-
MSSP Market Update: Keeper Security Updates PAM Solution
First seen on scworld.com Jump to article: www.scworld.com/news/mssp-market-update-keepersecurity-updates-pam-solution
-
Novel FrigidStealer macOS malware spread via bogus browser updates
First seen on scworld.com Jump to article: www.scworld.com/brief/novel-frigidstealer-macos-malware-spread-via-bogus-browser-updates
-
SonicWall authentication flaw under threat of active exploitation
Weeks after the company released a patch, researchers warn the CVE is being targeted by threat actors. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/vulnerability-sonicwall-firewalls-exploitation/740345/
-
Russian cyberespionage groups target Signal users with fake group invites
QR codes provide a means of phishing Signal users: These features now work by scanning QR codes that contain the cryptographic information needed to exchange keys between different devices in a group or to authorize a new device to an account. The QR codes are actually representations of special links that the Signal application knows…
-
New FrigidStealer infostealer infects Macs via fake browser updates
The FakeUpdate malware campaigns are increasingly becoming muddled, with two additional cybercrime groups tracked as TA2726 and TA2727, running campaigns that push a new macOS infostealer malware called FrigidStealer. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-frigidstealer-infostealer-infects-macs-via-fake-browser-updates/