Parse notes
A large-scale malware campaign called Sign1 has infected over 39,000 WordPress sites in the last six months. The attackers injected malicious JavaScript that redirected visitors to harmful websites. The malware uses dynamic URLs and only runs if visitors do not come from popular websites to avoid detection.
A new DoS attack relies on a vulnerability in the UDP protocol that allows for IP spoofing. If an attacker launches an attack against a vulnerable server with the spoofed IP of another vulnerable server, the servers will continuously respond with errors to each other until all resources are exhausted. It is estimated that 300,000 servers are vulnerable to this attack.
In light of a Reddit user reporting that installing a KDE Plasma theme wiped all of their files, KDE has issued a warning to vet themes before installing them. This is because themes can be uploaded by anyone and by the nature of how they change the behavior of KDE, they must execute arbitrary code. KDE has promised to make its security warnings more clear and, resources permitting, begin to vet themes.
This blog post discusses Remote Code Execution (RCE) in the context of cloud environments, specifically focusing on AWS. It explains the steps attackers can use to exploit RCE vulnerabilities in the cloud with blurbs about how Uptycs can help, but the advice and insights should be common enough to be applicable to other tools too.
This article covers the technical details on how Passkeys work under the hood and how to use this technology for your organization as a replacement for passwords. Passkeys offer advantages like synchronization to multiple devices. Their implementation and security measures vary among services. The shift in threat models from hardware security keys to passkeys requires careful consideration based on user requirements.
Google has released three new Golang libraries built to be secure by default. SafeText is used for processing YAML templates and templating shell commands. SafeOpen is designed to protect against path traversal attacks when opening files. SafeArchive is meant to protect against attacks related to dealing with archive files.
The Doyensec team developed PoIEx to aid in its code audit efforts. Points of Intersection are areas in application code that interact with IaC infrastructure. PoIEx creates a graph of IaC infrastructure and allows for jumping to application code that references it using semgrep rules.
weAudit is a VS Code extension that aids teams of code reviewers. It allows reviewers to add bookmarks with findings or notes to code as well as mark files as reviewed. weAudit tracks bookmarks and notes in shareable files to enable collaboration and allow for the creation of GitHub issues.
Microsoft is set to shut down access to over fifty cloud services for Russian organizations by the end of March in compliance with EU sanctions. The decision was influenced by EU Council Regulation 2023/2873, which prohibits supplying certain software, including cloud solutions, to entities in Russia.
Russian hackers linked to Russia's Foreign Intelligence Service (SVR) have been using the WINELOADER malware to target German political parties through phishing emails with logos from the Christian Democratic Union (CDU).
German authorities have shut down the Nemesis Market, an online marketplace dealing in drugs, cybercrime services, and fraudulently obtained credit card data.
A group of security researchers discovered a technique called Unsaflok that allows hackers to open Saflok-brand RFID-based keycard locks in hotel rooms worldwide.
The UK's National Cyber Security Centre has released a set of guidelines for public and private sector leaders to navigate cyber security incidents effectively.