Parse notes
Sponsored
Network penetration testing is the BEST way to evaluate security risks and effectively close security gaps before the bad guys have the opportunity to exploit them. But not all solutions will work for all businesses.
to learn about the penetration testing process, types of pentesting,
2️⃣ Schedule a free demo of vPenTest [4], a SaaS platform that fully replicates manual network penetration testing.
The Jetpack WordPress plugin has released a fix for a critical vulnerability that was discovered during an internal audit. The vulnerability allowed logged-in users to view forms that were submitted by other users. Automattic has released updates for 101 impacted versions of Jetpack and recommends updating immediately.
Gryphon Healthcare is notifying nearly 400K individuals that their data was breached due to an unnamed third party. Potentially compromised information includes names, dates of birth, addresses, Social Security numbers, dates of service, diagnoses, health insurance information, medical treatment and record numbers, providers, and prescriptions. Gryphon is not aware of any misuse of this information.
Globe Life has reported a data breach affecting its AIL subsidiary. A hacker stole sensitive customer information, including names, addresses, and sometimes Social Security numbers and health data. While 5,000 individuals are confirmed affected, the total impact could be much larger.
Many security teams jump to security monitoring before implementing basic security hygiene. This post introduces a collection of security monitoring antipatterns. These antipatterns include focusing on data collection without implementing effective detection and response strategies, relying on custom-built solutions instead of off-the-shelf tooling, prioritizing shiny new tools over established practices, and expecting one tool to be sufficient for all needs.
Ransomware attacks on AWS using cross-account KMS keys can be blocked by AWS if the key is owned by them. The new AWS KMS External Key Store feature allows for secure communication with on-premises HSMs for encryption. Simulating ransomware attacks on AWS can help to develop understanding of vulnerabilities and improve security measures.
macOS may not properly enforce the quarantine attribute, potentially allowing a bypass of the Gatekeeper security mechanism. Gatekeeper is designed to ensure only trusted software runs on systems by validating applications before execution. To reduce the risk of malicious Gatekeeper bypasses, developers should enforce the attribute on all files their applications handle.
Sponsored
AI is constantly changing the cybersecurity landscape, so you'll want to keep your teams ready. Our security skills guide [12] reveals the key components of successful security upskilling, the root causes of this skills shortage, and how you can close cybersecurity skills gaps across teams [13].
Passbook is a paid app that allows users to create an Apple Wallet pass from any QR code.
CloudWatch Log Redirector is a CLI tool that allows for redirecting log output to AWS CloudWatch.
prel(iminary) is an application that temporarily assigns Google Cloud IAM Roles. It includes an approval process.
A group of researchers have published a paper detailing a new attack using commercial D-wave quantum annealing systems. The attack targets Substitution-Permutation Network structured algorithms, which are at the heart of the AES encryption standards. The report was limited to targeting a 22-bit key though, which is much smaller than those commonly used.
Hybrid work has increased printer, unmanaged devices, and network security risks. A study showed that 67% of organizations experienced printer-related incidents in 2024. This article discusses recently disclosed print-related vulnerabilities.
Hong Kong police arrested 27 people involved in a $46 million AI-powered romance scam. The operation used face-swapping technology to create fake attractive personas for online dating, tricking victims into fraudulent cryptocurrency investments.
The CISA and FBI have released a guidance on software security bad practices and are seeking public feedback.
The US charged two Sudanese brothers with running the Anonymous Sudan cybercrime group, which is known for launching DDoS attacks worldwide.
An Alabama man was arrested for hacking the SEC's account to fake approval of Bitcoin ETFs.