The Daily Index — Wednesday, June 5, 2024

GENERAL

TLDR InfoSec

2️⃣ Learn more about Orca's CNAPP

Summary unavailable

orca.security

TLDR InfoSec

3️⃣ Get a live demo

Summary unavailable

orca.security

TLDR InfoSec

MAJOR CYBERATTACK SEES NHS LONDON HOSPITALS DECLARE CRITICAL INCIDENT WITH OPERATIONS CANCELED

Two London hospital trusts were forced to cancel non-emergency operations and blood tests due to a major ransomware cyberattack on Synnovis, the company supplying pathology services to hospitals across six boroughs. The attack affected tens of thousands of NHS patients.

independent.co.uk · 3 min

TLDR InfoSec

ZYXEL ISSUES EMERGENCY PATCH FOR END-OF-LIFE NAS DEVICES

Zyxel Networks has released a patch to address 3 critical vulnerabilities on older NAS devices. The vulnerabilities allowed for remote code execution. However, two flaws that could lead to information disclosure and privilege escalation were not fixed. Zyxel released these patches even though the devices have reached end-of-life as they were of critical severity and proof-of-concept exploits exist.

bleepingcomputer.com · 2 min

TLDR InfoSec

PHISHING WITH CLOUDFLARE WORKERS: TRANSPARENT PHISHING AND HTML SMUGGLING

Netskope Threat Labs is tracking two common phishing techniques that have been observed in phishing campaigns that utilize Cloudflare Workers. Attackers are utilizing Cloudflare Workers to deliver an encoded blob, which is reconstructed on the client to execute HTML smuggling attacks. Attackers are also utilizing Cloudflare Workers for transparent phishing attacks, creating MitM channels where attackers can intercept victims' credentials and MFA while relaying them to a destination server.

netskope.com · 5 min

TLDR InfoSec

SOPHISTICATED RAT TARGETING GULP PROJECTS ON NPM

Summary unavailable

blog.phylum.io · 9 min

TLDR InfoSec

SECURING THE BUILDING BLOCKS: A DEEP DIVE INTO DEPENDENCY SECURITY

Choosing secure dependencies for your project to prevent security risks is important. Delete unused dependencies and vet the trustworthiness of the ones you use. Developers need to regularly scan and update dependencies to address any vulnerabilities.

devsecurely.com · 4 min

TLDR InfoSec

LEAKED GOOGLE DATABASE REVEALS ITS SECRET PRIVACY AND SECURITY FAILURES

404 Media obtained a leak of internal Google privacy cases from 2013-2018. The leak provides insight into how Google manages privacy flags and the volume that it receives. Google has confirmed the authenticity of the leak but stressed that each flag was investigated and resolved.

engadget.com · 2 min

TLDR InfoSec

MICROSOFT HIT WITH EU PRIVACY COMPLAINTS OVER SCHOOLS' USE OF 365 EDUCATION SUITE

A privacy rights non-profit has lodged two complaints against Microsoft with Austria's data protection authority over the use of Microsoft 365 Education by schools. The complaints raise concerns about the lack of transparency and legal basis for processing minors' data, which potentially violates GDPR's stringent requirements for protecting children's data.

techcrunch.com · 4 min

TLDR InfoSec

CROOKS THREATEN TO LEAK 3B PERSONAL RECORDS 'STOLEN FROM BACKGROUND CHECK FIRM'

A criminal gang claimed to have obtained a massive database of 2.9 billion personal records on US, Canadian, and British citizens from a Florida firm handling background checks. The database allegedly contains sensitive information like full names, addresses, social security numbers, and details of relatives. The gang is planning to leak the 277GB of data.

theregister.com · 2 min

TLDR InfoSec

HIGH-RISK ATLASSIAN CONFLUENCE RCE FIXED, POC AVAILABLE (CVE-2024-21683)

CVE-2024-21683 is a remote code execution vulnerability in the Confluence Server and Data Center that allows an authenticated attacker with high privileges to execute malicious Java code.

helpnetsecurity.com · 2 min

TLDR InfoSec

FCC VOTE ON TAP FOR RULES TO SECURE FUNDAMENTAL COMPONENT OF THE INTERNET

The FCC is considering a rule to enhance security for a vital part of the internet known as the Border Gateway Protocol.

cyberscoop.com · 3 min

TLDR InfoSec

DATA FIRM EXECS CONVICTED FOR HELPING FRAUDSTERS TARGET THE ELDERLY

Two former executives of Epsilon Data Management LLC were convicted of selling consumer data to fraudsters for over a decade.

bleepingcomputer.com · 2 min