Parse notes
Sponsored
These days, DSPM (data security posture management) is a must. But BigID [4] isn't just jumping on the bandwagon – they're leading the pack when it comes to coverage, classification, risk management, and integrations.
Morphisec discovered an unauthenticated, zero-click (for trusted senders) RCE vulnerability in Microsoft Outlook. It has warned that this vulnerability could lead to data breaches, unauthorized access, and other malicious activities if abused. A patch for the vulnerability was included in July's Patch Tuesday patches. The researchers will be presenting more technical details at DEFCON.
Cisco has fixed a critical vulnerability that allows hackers to add root users and crash SEG devices using malicious email attachments. The flaw involves an absolute path traversal weakness in SEG content scanning, enabling attackers to replace files on the system. Cisco advises updating vulnerable appliances to prevent exploitation and contacting its Technical Assistance Center for assistance.
Businesses all over the world, from hospitals to banks and other companies, are reporting IT outages. Microsoft started noting issues on its Service Health page in the early hours of today. Shortly thereafter, outages became widespread. CrowdStrike says that a faulty update is causing crashes in Windows systems - Mac and Linux devices are unaffected. The issue stems from invalidly formatted .sys files causing the top level driver to crash. Recovery will be very difficult.
A bug in the Linux Kernel's eBPF verifier can lead to a system compromise by allowing attackers to manipulate register values. The vulnerability was fixed in July after being reported in June. It requires specific permissions and is not widespread among applications or containers.
Fog Security investigated 51 different AWS resources and found that only 76% of them were encrypted by default, with 22 of those being encrypted with AWS Owned Keys by default. Even when encrypted by default, services that used AWS Owned Keys were shared between AWS accounts and don't typically offer more access controls. AWS Managed Keys are controlled by AWS and typically implicitly grant access to IAM principals in the same account, so they may offer less protection than expected. Fog Security recommends enabling encryption by default where possible and also opting for the use of AWS Customer Managed Keys where possible.
This blog post discusses in detail how to analyze malicious MSI files used for software installation on Windows. MSI installers can hide malicious code within legitimate packages to avoid detection by security tools. Threat actors often use custom actions in MSI files to execute harmful code during installation.
This blog post discusses how automated firmware analysis tools like EMBA enhance security by scanning for vulnerabilities in device firmware. EMBA's open-source approach allows for deep analysis, detection of unknown threats, and customized testing. Leveraging EMBA can significantly improve product security, protect critical devices, and streamline the firmware analysis process.
Sponsored
What defines a “material” cybersecurity incident?
Whispers is an information security analysis tool designed to identify hardcoded secrets in structured text and static code.
Lemma is a Python-based AWS Lambda package and client designed to execute packaged command-line tools in a scalable, remote environment. It makes use of Lambda's response streaming to stream real-time stdout to the client.
Pumbin is an implant generation platform written in Rust that supports the Extism plugin system. It populates implants with randomized data so that each generated implant is unique.
AWS has released a language agnostic local HTTP service that can be installed in compute environments to read and cache secrets from Secrets Manager. TTL, cache size, maximum connections, and HTTP port can be configured in the agent. The agent also includes SSRF protections by default.
A university student created malware to disrupt government websites and made £45,000 from selling it. He targeted a Jobcentre in Braintree, Essex, and was sentenced to 21 months in jail for computer misuse. The malware caused websites to go offline by overwhelming them with internet traffic.
NullBulge is a cybercriminal group that targets AI and gaming entities. This post talks about how NullBulge distributes malware through GitHub and Hugging Face, posing a threat to software supply chains. NullBulge has shifted towards hacktivist motives for financial gain.
With the release of its R560 GPU drivers, NVIDIA is recommending users on newer GPU models to switch to the open-source drivers.
CISA has released a new playbook to help improve security and resilience in critical infrastructure.
WazirX, an Indian cryptocurrency exchange, suffered a security breach resulting in the theft of $230 million in crypto assets.