They’ve begun: Attacks exploiting vulnerability with maximum 10 severity rating
Will attacks be as big as those targeting MOVEit? Maybe not, but they still can be plenty bad. Enlarge (credit: Getty Images) Ransomware hackers have started exploiting one or more recently fixed vulnerabilities that pos.....»»
A Rare Coincidence of La Niña Events Will Weaken Hurricane Season
The oceans have produced a rare coincidence of the Pacific and Atlantic Niñas, which will lessen the severity of the hurricane season—though 2024 still remains a highly active year......»»
City of Columbus sues man after he discloses severity of ransomware attack
Mayor said data was unusable to criminals; researcher proved otherwise. Enlarge (credit: Getty Images) A judge in Ohio has issued a temporary restraining order against a security researcher who presented evidence that a.....»»
Study reveals key strategies to combat urban heat vulnerability
A QUT study analyzing five decades of research and thousands of studies has identified five critical areas needed to tackle urban heat vulnerability (UHV), a growing issue impacting millions in increasingly heat-prone cities......»»
A macro look at the most pressing cybersecurity risks
Forescout’s 2024H1 Threat Review is a new report that reviews the current state of vulnerabilities, threat actors, and ransomware attacks in the first half of 2024 and compares them to H1 2023. “Attackers are looking for any weak point to bre.....»»
Scientists discover how starfish get "legless"
Researchers at Queen Mary University of London have made a discovery about how starfish manage to survive predatory attacks by shedding their own limbs. The team has identified a neurohormone responsible for triggering this remarkable feat of self-pr.....»»
RISCPoint RADAR provides real-time vulnerability detection across multiple attack surfaces
RISCPoint Advisory Group launched RADAR, an all-in-one cybersecurity platform. Combining continuous threat discovery with expert-led Penetration Testing as a Service (PTaaS), RADAR represents a significant leap forward in proactive security and risk.....»»
Third-party risk management is under the spotlight
In the aftermath of the CrowdStrike IT outage, new research has uncovered a critical vulnerability within financial institutions regarding supply chain resilience. The outage has demonstrated the need for greater digital supply chain resilience, part.....»»
Why ransomware attackers target Active Directory
Ransomware attacks have surged 78% year-over-year, affecting various sectors and organizations and significantly impacting supply chains. In this Help, Net Security video, Craig Birch, Technology Evangelist, and Principal Security Engineer at Cayosof.....»»
Unpatchable 0-day in surveillance cam is being exploited to install Mirai
Vulnerability is easy to exploit and allows attackers to remotely execute commands. Enlarge (credit: Getty Images) Malicious hackers are exploiting a critical vulnerability in a widely used security camera to spread Mira.....»»
There’s more good news about the upcoming M4 MacBook Pros
Apple has reportedly begun mass production of new-generation MacBook Pros, giving us yet more reason to expect a launch before the end of the year......»»
AuthenticID enhances Smart ReAuth to combat AI-based attacks and account takeovers
AuthenticID announced the newest release of Smart ReAuth. Smart ReAuth is a reauthentication solution that leverages a selfie to re-confirm an identity. First released in 2021, this enhanced version offers verifications in less than one second, with.....»»
Dragos Platform updates streamline OT threat and vulnerability workflows
Dragos announced the latest release of the Dragos Platform, an OT network visibility and cybersecurity platform. The updates provide industrial and critical infrastructure organizations with even deeper and enriched visibility into all assets in thei.....»»
Critical Fortra FileCatalyst Workflow vulnerability patched (CVE-2024-6633)
Organizations using Fortra’s FileCatalyst Workflow are urged to upgrade their instances, so that attackers can’t access an internal HSQL database by exploiting known static credentials (CVE-2024-6633). “Once logged in to the HSQLDB,.....»»
APT group exploits WPS Office for Windows RCE vulnerability (CVE-2024-7262)
ESET researchers discovered a remote code execution vulnerability in WPS Office for Windows (CVE-2024-7262). APT-C-60, a South Korea-aligned cyberespionage group, was exploiting it to target East Asian countries. When examining the root cause, ESET d.....»»
BlackByte affiliates use new encryptor and new TTPs
BlackByte, the ransomware-as-a-service gang believed to be one of Conti’s splinter groups, has (once again) created a new iteration of its encryptor. “Talos observed some differences in the recent BlackByte attacks. Most notably, encrypte.....»»
iPhone 17 range may increase RAM to 12GB
A further rumor about the 2025 iPhone 17 range claims that it will feature 12GB, compared to the maximum 8GB in the iPhone 15 Pro range.Renders of the iPhone 17 rangeIt's now a safe assumption that future iPhones will feature increased RAM because Ap.....»»
Cybercriminals capitalize on travel industry’s peak season
Cybercriminals are capitalizing on the travel and hospitality industry’s peak season, using increased traffic as cover for their attacks, according to Cequence Security. Researchers investigated the top 10 travel and hospitality sites to identi.....»»
PSA: Watch out for phishing attacks with fake banking app updates
A security researcher has discovered a phishing attack intended to fool iPhone users into installing what is claimed to be an update to their banking app. The attack works despite iOS protections because what is actually being ‘installed’ is a.....»»
Versa Director zero-day exploited to compromise ISPs, MSPs (CVE-2024-39717)
Advanced, persistent attackers have exploited a zero-day vulnerability (CVE-2024-39717) in Versa Director to compromise US-based managed service providers with a custom-made web shell dubbed VersaMem by the researchers. The malware harvests credentia.....»»
Hackers infect ISPs with malware that steals customers’ credentials
Zero-day that was exploited since June to infect ISPs finally gets fixed. Enlarge (credit: Getty Images) Malicious hackers likely working on behalf of the Chinese government have been exploiting a high-severity zero-day.....»»