Security news that informs and inspires

All Articles

1740 articles:

Decipher Podcast: Chester Wisniewski and Peter Mackenzie

Peter Mackenzie, director of incident response at Sophos, and Chester Wisniewski, principal research scientist at Sophos, talk about why more ransomware attackers are clustering onto vulnerable networks - sometimes simultaneously.

Podcast

Apple, Google Fix Zero Days Under Active Attack

Apple and Google have released fixes for iOS and macOS, and Chrome, respectively, to address bugs that have been exploited in the wild.

Apple, Google

CISA Warns of Ongoing Exploitation Against Zimbra Flaws

Attackers are eyeing known vulnerabilities in the Zimbra collaboration suite to target government and private sector organizations.

Vulnerability, Cisa

RubyGems Requires MFA for Popular Projects

RubyGems is now requiring projects with more than 180 million downloads to use MFA, and may extend the requirement to other projects.

China

Microsoft Disables Accounts Abused By Russian Threat Actor

Microsoft observed the threat actor, which it tracks as Seaborgium, targeting over 30 organizations since 2022 started.

Microsoft

FTC Moves to Address Pervasive Commercial Surveillance

The FTC may consider rules to address the abuses of commercial surveillance by ad tech companies and platform providers.

Privacy, Ftc

Zero Day Initiative Changes Disclosure Policy For Faulty Patches

The Zero Day Initiative cited a decrease in patch quality that is leading to many issued fixes being faulty or incomplete.

Zdi, Patch

Decipher Podcast: Source Code 8/12

Welcome back to Source Code, Decipher’s weekly news wrap podcast with input from our sources.

Podcast, Source Code

For Bug Bounties, ‘Knowing is Less Than Half the Battle’

Bug bounty programs can be invaluable, but without the proper resources in place, they will fail hard.

Black Hat, Bug Bounty

Long Before Colonial Pipeline, Red Flags Foreshadowed Hack

“There’s a lack of imagination or… anticipation about the next move that hackers will make," warned investigative journalist Kim Zetter during Black Hat this week.

Colonial Pipeline, Black Hat

Krebs: ‘We’ve Over-Fetishized the APT Threat’

Former CISA director Chris Krebs said at Black Hat that the community may have focused too much on APT groups in recent years.

Black Hat, Government

After Log4j, Efforts to ‘Uplift’ Open Source Ecosystem Continue

At Black Hat USA this week, Cyber Safety Review Board members tasked with looking at key lessons learned from Log4j talked about continued security issues facing the open source community.

Log4j

Microsoft Fixes Known, Exploited Flaw in Windows Diagnostic Tool

The flaw was first reported to Microsoft in 2019, but at the time it said it did not consider the issue to be a vulnerability.

Microsoft, Windows

Exploit Available for Critical VMware Bug CVE-2022-31656

A researchers has released a proof-of-concept exploit for CVE-2022-31656, a critical authentication bypass in VMware ONE Access.

Vmware

How Three Ransomware Groups Targeted One Vulnerable Network

Researchers warn of an uptick in multiple ransomware groups targeting the same vulnerable networks, as seen in a recent attack that involved Hive, LockBit and BlackCat/ALPHV affiliates.

Ransomware