🚨 CISA KEV 1[−]
30 Sep KEVCISA Adds Four Known Exploited Vulnerabilities to CatalogCISA has added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog , based on evidence of active exploitation. CVE-2023-25280 D-Link DIR-820 Router OS Command Injection Vulnerability CVE-2020-15415 DrayTek Multiple Vigor Routers OS Command In…CISA.GOV
🐛 COMMON VULNERABILITIES AND EXPOSURES 3[−]
30 SepUnpatched SQLi Flaw in TI WooCommerce Wishlist Threatens 100,000+ SitesA critical security flaw, CVE-2024-43917, with a CVSS score of 9. 3, has been found in the popular WordPress plugin TI WooCommerce Wishlist, putting over 100,000 sites at risk of SQL injection attacks.SECURITYONLINE.INFO
30 SepCritical WatchGuard Vulnerabilities Discovered: CVE-2024-6592 and CVE-2024-6593Two critical vulnerabilities, CVE-2024-6592 and CVE-2024-6593, have been found in WatchGuard’s Authentication Gateway and Single Sign-On Client software by cybersecurity firm RedTeam Pentesting GmbH.SECURITYONLINE.INFO
30 SepIranian Cyber Actors’ Brute Force and Credential Access Activity Compromises Critical Infrastructure OrganizationsSummary The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), the Communications Security Establishment Canada (CSE), the Australian Federal Police (AFP), and Australian Signals Directorate's Au…CISA.GOV
⚠️ VULNERABILITY DISCLOSURE 16[−]
30 SepTor browser, Tails OS merge to offer users improved security and privacyCISOs of organizations with staff (including cybersecurity threat researchers) who have to meet high privacy standards when connecting to the internet have a new option with the merger of the Tor Project and the Tails portable operating system (OS). The two providers said Thursda…CSOONLINE.COM
30 SepIsraeli Army Hacked Beirut Airport to Threaten CiviliansThe Israeli army reportedly hacked into the control tower of Beirut’s Rafic Hariri International Airport. The incident involved issuing threats against an Iranian civilian aircraft attempting to land, according to official sources cited by Anadolu Agency. Lebanese Response to Isr…GBHACKERS.COM
30 SepNIST issues new password guidelines: Cyber Security Today for Monday, September 30, 2024New NIST Password Guidelines, Octo2 Trojan & ChatGPT Vulnerabilities | Cybersecurity Today Join Jim Love in today's episode of Cybersecurity Today as he discusses the latest password security guidelines from NIST focusing on length and usability, the emergence of the Octo2 Trojan…CYBERSECURITYTODAY.LIBSYN.COM
30 SepMeta Fined €91 Million for Storing Millions of Facebook and Instagram Passwords in PlaintextThe Irish Data Protection Commission (DPC) has fined Meta €91 million ($101.56 million) as part of a probe into a security lapse in March 2019, when the company disclosed that it had mistakenly stored users' passwords in plaintext in its systems. The investigation, launched by th…THEHACKERNEWS.COM
30 SepSecurity spending signals major role change for CISOs and their teamsEnterprises are increasingly spending more on security software and services than they are on staff, a radical shift in security budgeting that will transform the role of the CISO at many organizations, as well as the roles of remaining in-house staff. Gartner predicts a 15% grow…CSOONLINE.COM
30 SepCyber resilience becoming extremely difficult amid Gen AI upgradesWith rapid advancements in Artificial Intelligence (AI) pushing boundaries and the regulatory environment in constant flux, achieving cyber resilience is becoming more difficult for enterprises. A PwC survey that sought to understand the state of global digital trust found only t…CSOONLINE.COM
30 SepAI and the 2024 US ElectionsFor years now, AI has undermined the public’s ability to trust what it sees, hears, and reads. The Republican National Committee released a provocative ad offering an “AI-generated look into the country’s possible future if Joe Biden is re-elected,” showin…SCHNEIER.COM
30 SepCritical Flaws in Tank Gauge Systems Expose Gas Stations to Remote AttacksCritical security vulnerabilities have been disclosed in six different Automatic Tank Gauge (ATG) systems from five manufacturers that could expose them to remote attacks. "These vulnerabilities pose significant real-world risks, as they could be exploited by malicious actors to …THEHACKERNEWS.COM
30 SepTHN Cybersecurity Recap: Last Week's Top Threats and Trends (September 23-29)Hold onto your hats, folks, because the cybersecurity world is anything but quiet! Last week, we dodged a bullet when we discovered vulnerabilities in CUPS that could've opened the door to remote attacks. Google's switch to Rust is paying off big time, slashing memory-related vul…THEHACKERNEWS.COM
30 SepCISOs to grapple with a thicket of emerging regulations after Newsom vetoes California’s AI billFollowing a tense period of uncertainty, California Governor Gavin Newsom has vetoed a landmark bill, SB-1047 , the Safe and Secure Innovation for Frontier Artificial Intelligence Models Act. Passed by the state’s legislature on August 28, 2024, it was considered the world’s most…CSOONLINE.COM
30 SepNorth Korean Hackers Attempted To Steal Sensitive Military DataDiehl Defence anti-aircraft missiles from Baden-Württemberg are successfully intercepting Russian attacks on Kyiv, according to Mayor Vitali Klitschko. The German-supplied technology has achieved a 100% hit rate in defending the Ukrainian capital. The German government plans to i…GBHACKERS.COM
30 SepVPN providers don’t protect your privacy online. Here’s what can.You probably don't need a VPN. Instead, these free and open-source tools, and other services, can help protect your privacy online. © 2024 TechCrunch. All rights reserved. For personal use only.TECHCRUNCH.COM
30 SepNews alert: INE earns accolades based on strong curriculum reviews from business leadersCary, NC, Sept. 27, 2024, CyberNewswire — INE , a global leader in networking and cybersecurity training and certifications, is proud to announce they have earned 14 awards in G2’s Fall 2024 Report , including “Fastest Implementation” and “Most Implementable,” … (more…LASTWATCHDOG.COM
30 SepCISA’s VDP Platform 2023 Annual Report Showcases SuccessToday, the Cybersecurity and Infrastructure Security Agency (CISA) released its Vulnerability Disclosure Policy (VDP) Platform 2023 Annual Report , highlighting the service’s remarkable success in 2023, its second full year of operation. Throughout 2023, CISA focused on advo…CISA.GOV
30 SepThe Number of Ransomware Attacks Around the World Increased by 73% in 2023The number of ransomware attacks around the world increased by 73% in 2023, according to a new report by the Institute for Security and Technology’s Ransomware Task Force (RTF). These attacks opportunistically target organizations across all industries, but the hardest-hit sector…KNOWBE4.COM
📢 SECURITY ADVISORIES 6[−]
30 SepNIST Proposes Barring Some of the Most Nonsensical Password RulesNIST is seeking public feedback on the draft guidelines, which can be submitted via email until October 7. The goal is to promote sensible password practices that enhance security without burdening users or compromising their online identity.ARSTECHNICA.COM
30 SepYour KnowBe4 Compliance Plus Fresh Content Updates from September 2024Check out the September updates in Compliance Plus so you can stay on top of featured compliance training content.KNOWBE4.COM
30 SepRobert Herjavec on Managed Services, Identity and CEO Change"Shark Tank" Star on Decision to Leave Cyderes CEO Post and Future of Cybersecurity Robert Herjavec, outgoing CEO of Cyderes, details why he stepped down and how cybersecurity has evolved over his tenure. From identity management to the compliance role, Herjavec explains how mana…DATABREACHTODAY.CO.UK
30 SepJPCERT shares Windows Event Log tips to detect ransomware attacksJapan's Computer Emergency Response Center (JPCERT/CC) has shared tips on detecting different ransomware gang's attacks based on entries in Windows Event Logs, providing timely detection of ongoing attacks before they spread too far into a network. [...]BLEEPINGCOMPUTER.COM
30 SepAI Pulse: What's new in AI regulations?Fall is in the air and frameworks for mitigating AI risk are dropping like leaves onto policymakers’ desks. From California’s SB 1047 bill and NIST’s model-testing deal with OpenAI and Anthropic to REAIM’s blueprint for military AI governance, AI regulation is proving to be a hot…TRENDMICRO.COM
🔥 INCIDENT REPORTING 20[−]
30 SepIsrael army hacked the communication network of the Beirut Airport control towersubmitted by kid to cybersecurity 1 points | 0 comments https://securityaffairs.com/169080/cyber-warfare-2/idf-hacked-beirut-airport-control-tower.htmlSH.ITJUST.WORKS
30 SepDCRat Targets Users with HTML SmugglingA new HTML smuggling campaign is targeting Russian-speaking users, distributing DCRat malware. This marks the first time the malware has been deployed using this method, unlike common delivery methods like compromised sites or phishing emails.NETSKOPE.COM
30 SepUnraveling Sparkling Pisces’s Tool Set: KLogEXE and FPSpyKLogEXE is a C++ keylogger while FPSpy is a backdoor designed to collect system information and exfiltrate data from compromised devices. Both malware strains are primarily being distributed through spear-phishing emails.UNIT42.PALOALTONETWORKS.COM
30 SepStorm-0501 Expands Ransomware Attacks to Hybrid Cloud EnvironmentsMicrosoft has detected Storm-0501 using Cobalt Strike for lateral movement across networks and deploying Embargo ransomware on victim organizations in hybrid cloud setups.MICROSOFT.COM
30 SepA Hacker's Era: Why Microsoft 365 Protection Reigns SupremeImagine a sophisticated cyberattack cripples your organization’s most critical productivity and collaboration tool — the platform you rely on for daily operations. In the blink of an eye, hackers encrypt your emails, files, and crucial business data stored in Microsoft 365, holdi…THEHACKERNEWS.COM
30 SepAccounting Firm WMDDH Discloses Data Breach Impacting 127,000The personal information of over 127,000 individuals was stolen in a July 2023 data breach at Wright, Moore, DeHart, Dupuis & Hutchinson (WMDDH). The post Accounting Firm WMDDH Discloses Data Breach Impacting 127,000 appeared first on SecurityWeek .SECURITYWEEK.COM
30 SepMicrosoft: Cloud Environments of US Organizations Targeted in Ransomware AttacksA threat actor has been compromising the hybrid cloud environments of US organizations in multiple sectors. The post Microsoft: Cloud Environments of US Organizations Targeted in Ransomware Attacks appeared first on SecurityWeek .SECURITYWEEK.COM
30 SepMedia giant AFP hit by cyberattack impacting news delivery servicesGlobal news agency AFP (Agence France-Presse) is warning that it suffered a cyberattack on Friday, which impacted IT systems and content delivery services for its partners. [...]BLEEPINGCOMPUTER.COM
30 SepHawaii Health Center Discloses Data Breach After Ransomware AttackCommunity Clinic of Maui says a LockBit ransomware attack from earlier this year has resulted in a data breach impacting over 120,000 people. The post Hawaii Health Center Discloses Data Breach After Ransomware Attack appeared first on SecurityWeek .SECURITYWEEK.COM
30 SepDCRAt Attacking Users Via HTML Smuggling To Steal Login CredentialsIn a new campaign that is aimed at users who speak Russian, the modular remote access tool (RAT) known as DCRat has been utilized. Delivered through HTML smuggling, a technique not previously seen with DCRat, the malware leverages its typical RAT capabilities to execute she…GBHACKERS.COM
30 SepPatelco Credit Union Data Breach Impacts Over 1 Million PeoplePatelco Credit Union has informed authorities that data on more than 1 million individuals was stolen in a ransomware attack this summer. The post Patelco Credit Union Data Breach Impacts Over 1 Million People appeared first on SecurityWeek .SECURITYWEEK.COM
30 SepCentral Tickets - 722,860 breached accountsIn September 2024, data from the ticketing service Central Tickets was publicly posted to a hacking forum . The data suggests the breach occurred several months earlier and exposed 723k unique email addresses alongside names, phone numbers, IP addresses, purchases and passwords s…HAVEIBEENPWNED.COM
30 SepMedia giant AFP hit by cyberattack impacting news delivery servicessubmitted by kid to cybersecurity 1 points | 0 comments https://www.bleepingcomputer.com/news/security/media-giant-afp-hit-by-cyberattack-impacting-news-delivery-services/SH.ITJUST.WORKS
30 SepNorth Korea Hackers Linked to Breach of German Missile ManufacturerThe targeting of Diehl Defence is significant because the company specializes in the production of missiles and ammunition. The post North Korea Hackers Linked to Breach of German Missile Manufacturer appeared first on SecurityWeek .SECURITYWEEK.COM
30 SepT-Mobile pays $31.5 million FCC settlement over 4 data breachesThe Federal Communications Commission (FCC) announced a $31.5 million settlement with T-Mobile over multiple data breaches that compromised the personal information of millions of U.S. consumers. [...]BLEEPINGCOMPUTER.COM
30 SepTexas Hospital Diverting Ambulances in Wake of AttackNearby College's Health Sciences Center Is Also Experiencing an IT Outage University Medical Center, a Lubbock, Texas-based public health system that includes a level-one trauma center and a children's hospital, is diverting ambulances and working to restore an IT outage affectin…DATABREACHTODAY.CO.UK
30 SepCrooked Cops, Stolen Laptops & the Ghost of UGNaziA California man accused of failing to pay taxes on tens of millions of dollars allegedly earned from cybercrime also paid local police officers hundreds of thousands of dollars to help him extort, intimidate and silence rivals and former business partners, a new indictment charg…KREBSONSECURITY.COM
30 SepHacker charged for breaching 5 companies for insider tradingThe U.S. Securities and Exchange Commission (SEC) charged Robert B. Westbrook, a U.K. citizen, with hacking into the computer systems of five U.S. public companies to access confidential earnings information and conduct insider trading. [...]BLEEPINGCOMPUTER.COM
30 SepHow Overreliance on EDR Is Failing Healthcare ProvidersHealthcare Providers Must Revisit Endpoint Security to Mitigate Cyberthreats Healthcare organizations have faced 21% of all cyberattacks since 2023, as cybercriminals use stolen data and operational disruptions to pressure providers into paying a ransom. Experts advise healthcare…DATABREACHTODAY.CO.UK
🕵️ THREAT INTELLIGENCE 16[−]
30 SepISC Stormcast For Monday, September 30th, 2024 https://isc.sans.edu/podcastdetail/9158, (Mon, Sep 30th)(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.ISC.SANS.EDU
30 SepCalifornia Governor Vetoes Bill to Create First-in-Nation AI Safety MeasuresGavin Newsom vetoed a landmark bill SB 1047 aimed at establishing first-in-the-nation safety measures for large artificial intelligence models. The post California Governor Vetoes Bill to Create First-in-Nation AI Safety Measures appeared first on SecurityWeek .SECURITYWEEK.COM
30 SepHacktivist Groups Operating Together! Connection Ober TTPs UncoveredCybersecurity experts have uncovered a significant connection between hacktivist groups BlackJack and Twelve through overlapping tactics, techniques, and procedures (TTPs). This discovery illuminates the sophisticated methods employed by these groups and raises questions about th…GBHACKERS.COM
30 SepBritish National Arrested, Charged for Hacking US CompaniesUK national Robert Westbrook was charged in the US for executing a hack-to-trade scheme against five public companies. The post British National Arrested, Charged for Hacking US Companies appeared first on SecurityWeek .SECURITYWEEK.COM
30 SepUS Charges 3 Iranians Over Presidential Campaign HackingThe US has announced charges, sanctions and a $10 million reward for Iranian hackers accused of targeting elections. The post US Charges 3 Iranians Over Presidential Campaign Hacking appeared first on SecurityWeek .SECURITYWEEK.COM
30 SepWorldcoin: Fighting Deepfakes and Bots With Global Permissionless Blockchain IdentityThat dream of a decentralized privacy-retaining identity system able to combat AI-driven bots and deepfakes may not be as elusive as feared – courtesy of Tools for Humanity (TfH) and Worldcoin. The post Worldcoin: Fighting Deepfakes and Bots With Global Permissionless Blockchain …SECURITYWEEK.COM
30 SepNigeria Hackers Sentenced for Selling Financial Information on Dark WebSimon Kaura, a Nigerian national deported from the United Kingdom, was sentenced in a U.S. federal court for his involvement in a global conspiracy to sell stolen financial information on the dark web. The sentencing marks a crucial victory in the fight against cybercrime, sheddi…GBHACKERS.COM
30 SepCloudflare WAF bypass for XSSsubmitted by kid to cybersecurity 1 points | 0 comments https://waf-bypass.com/2024/09/29/waf-bypass-by-xsspayloads-16/SH.ITJUST.WORKS
30 SepMentorship Monday - Discussions for career and learning!submitted by shellsharks to cybersecurity 2 points | 0 comments Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? …INFOSEC.PUB
30 SepGorillaBot Emerged As King For DDoS Attacks With 300,000+ CommandsThe newly emerged Gorilla Botnet has exhibited unprecedented activity, launching over 300,000 DDoS attacks against targets in over 100 countries between September 4 and 27. The botnet, a modified version of Mirai, supports multiple CPU architectures and employs advanced technique…GBHACKERS.COM
30 SepGorillaBot Emerged As King For DDoS Attacks With 300,000+ Commandssubmitted by kid to cybersecurity 1 points | 0 comments https://gbhackers.com/gorillabot-king-ddos-attacks/SH.ITJUST.WORKS
30 SepTool update: mac-robber.py and le-hex-to-ip.py, (Mon, Sep 30th)One of the problems I&#;x26;#;39;ve had since I originally wrote mac-robber.py [ 1 ][ 2 ][ 3 ] seven years ago is that because of the underlying os.stat python library we couldn&#;x26;#;39;t get…ISC.SANS.EDU
30 SepRussian Hackers Increase Attacks on Ukraine's Energy SectorAttackers Embrace Dating Sites and Encrypted Messaging Apps for Social Engineering Russian military and intelligence hacking teams continue to refine their Ukrainian targeting, lately shifting to online attacks designed to support and help Moscow's military operations succeed, in…DATABREACHTODAY.CO.UK
30 SepGone in 30 Seconds: Kia Hack UnveiledKia Website Vulnerabilities Allowed Remote Car Control Now patched vulnerabilities in online services from carmaker Kia allowed attackers to remotely control vehicle functions using only a license plate number, putting millions of cars at risk. The flaws were present in the South…DATABREACHTODAY.CO.UK
30 SepHow to Attain Zero Trust - Rob Allen - BSW #366The zero-trust security model has been billed as an ultra-safe defense against emerging, unrecognized and well-known threats. Unlike perimeter security, it doesn't assume people inside an organization are automatically safe. Instead, it requires every user and device -- inside an…YOUTUBE.COM
30 SepUnderfunding and Leadership Gaps, as AI Replaces CEO and Senate Eyes Healthcare - BSW #366In the leadership and communications segment, Underfunding And Leadership Gaps Weaken Cybersecurity Defenses, A Self-Care Checklist for Leaders, Senate bill eyes minimum cybersecurity standards for health care industry, and more! Visit https://www.securityweekly.com/bsw for all t…YOUTUBE.COM
🌐 CYBER THREAT LANDSCAPE 2[−]
30 SepWatering Hole Attack on Kurdish Sites Distributing Malicious APKs and SpywareA watering hole attack targeted Kurdish websites, distributing malicious APKs and spyware, compromising 25 sites for over a year. French cybersecurity firm Sekoia uncovered the campaign called SilentSelfie, delivering various info-stealers.THEHACKERNEWS.COM
30 SepMDR in Action: Preventing The More_eggs Backdoor From HatchingTrend Micro MDR (Managed Detection and Response) team promptly mitigated a more_eggs infection. Using Vision One, MDR illustrated how Custom Filters/Models and Security Playbook can be used to automate the response to more_eggs and similar threats.TRENDMICRO.COM
📡 INFOSEC NEWS 19[−]
30 SepIndustry Moves for the week of September 30, 2024 - SecurityWeekExplore industry moves and significant changes in the industry for the week of September 30, 2024. Stay updated with the latest industry trends and shifts.SECURITYWEEK.COM
30 SepFirst Mobile Crypto Drainer Found on Google PlayThe malicious app, called WalletConnect, amassed over 10,000 downloads and stole around $70,000 in cryptocurrency from Android users before being removed from the Google Play Store.INFOSECURITY-MAGAZINE.COM
30 SepWindows 11 KB5043145 update causes reboot loops, blue screensMicrosoft warns that some Windows 11 systems enter reboot loops or might freeze with blue screens after installing the September 2024 KB5043145 preview update. [...]BLEEPINGCOMPUTER.COM
30 SepSession Hijacking 2.0 — The Latest Way That Attackers are Bypassing MFAAttackers are increasingly turning to session hijacking to get around widespread MFA adoption. The data supports this, as: 147,000 token replay attacks were detected by Microsoft in 2023, a 111% increase year-over-year (Microsoft). Attacks on session cookies now happen in t…THEHACKERNEWS.COM
30 SepCloud Threats Have Execs The Most Freaked Out Because They're Not PreparedPACKETSTORMSECURITY.COM
30 SepBritish man used genealogy websites to fuel alleged hacking and insider trading schemeA London-based man is facing extradition to the United States after allegedly masterminding a scheme to hack public companies prior to their earnings announcements and use the secrets he uncovered to make millions of dollars on the stock market. Read more in my article on the Hot…BITDEFENDER.COM
30 SepVerizon outage: iPhones, Android devices stuck in SOS modeA widespread Verizon outage is causing iPhones and Android devices to enter SOS mode, preventing them from making mobile calls unless they use WiFi calling. [...]BLEEPINGCOMPUTER.COM
30 SepWe are skeptical of VPN providers, and you should be, tooYou cannot and and should not trust either free or paid-for VPN providers. Here's why. © 2024 TechCrunch. All rights reserved. For personal use only.TECHCRUNCH.COM
30 SepThink you need a VPN? Start here.Not everyone actually needs to use a VPN. This simple guide will help you decide if you need a VPN for your situation. © 2024 TechCrunch. All rights reserved. For personal use only.TECHCRUNCH.COM
30 SepHow to make your own encrypted VPN server in 15 minutesThe best encrypted VPN is one that you have set up and secured yourself. Here's how to get started. © 2024 TechCrunch. All rights reserved. For personal use only.TECHCRUNCH.COM
30 SepMan charged for selling forged license keys for network switchesThe U.S. government has indicted a co-owner of a Minnesota IT company for his participation in an international conspiracy to sell forged license keys for networking devices. [...]BLEEPINGCOMPUTER.COM
30 SepThe power of the platform: Sophos is uniquely recognized in the G2 Fall 2024 ReportsSophos continues to be the only vendor named a Leader in Endpoint, Firewall, MDR, XDR and EDR in the latest reports from G2SOPHOS.COM
30 SepMicrosoft Defender adds detection of unsecure Wi-Fi networksMicrosoft Defender now automatically detects and notifies users with a Microsoft 365 Personal or Family subscription when they're connected to unsecured Wi-Fi networks. [...]BLEEPINGCOMPUTER.COM
30 SepMicrosoft overhauls security for publishing Edge extensionsMicrosoft has introduced an updated version of the "Publish API for Edge extension developers" that increases the security for developer accounts and the updating of browser extensions. [...]BLEEPINGCOMPUTER.COM
30 SepThe Playstation Network is suffering a global outageThe PlayStation Network is suffering a global outage, with subscribers confirming that they can no longer play online games or access the company's website. [...]BLEEPINGCOMPUTER.COM
30 SepThe Playstation Network is down in a global outageThe PlayStation Network is suffering a global outage, with subscribers confirming that they can no longer play online games or access the company's website. [...]BLEEPINGCOMPUTER.COM