Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Microsoft has released a fix for a bug that was causing Windows Server 2022 systems with two or more NUMA nodes to fail at startup. NUMA nodes are commonly used to optimize CPU and memory usage. Microsoft also announced that it is working on a fix for a Windows Server 2025 issue that is causing iSCSI environments to fail to boot.
This blog discusses a simulation of an attack by the Venomous Bear APT group that targeted countries like the USA and Germany from at least 2020. The attackers used a fake Microsoft Windows Time service to install a backdoor that allowed them to exfiltrate files and communicate with a command and control server. The simulation includes stages for installing the backdoor using a .bat file, developing the backdoor DLL, and creating a listener script for receiving commands from the backdoor.
In this blog post, the Google security team describes their security approach, which involves automated threat detection with a focus on minimizing dwell time. Collaboration and building an asset inventory are key strategies to enhance threat detection capabilities. Security engineering is essential, and Google emphasizes writing code for effective threat response.
Lina Khan's FTC banned General Motors from sharing car owners' personal data for five years even if consumers gave consent.
Microsoft has shared a script to revert to an older version of Outlook that was crashing when writing emails.
While passkeys aren't perfect, a coalition of government and private efforts is making them better.
Law firm Wolf Haldenstein suffered a data breach in December 2023 that affected 3.4 million individuals. The breach exposed sensitive information including Social Security numbers, medical data, and employee IDs. The firm enhanced security measures and offered credit monitoring to affected individuals, who were notified in May 2024.
Cybersecurity researchers have uncovered a campaign targeting PHP servers to promote gambling sites in Indonesia using Python-based bots. The attacks involve the deployment of GSocket to exploit web shells on servers running popular platforms like Moodle. Site owners have been advised to update plugins, block rogue domains, and remove suspicious accounts to defend against the malware.
A malicious PyPi package is attempting to squat the official Discord Python library. The malicious package steals Discord auth tokens and relays them to an external server as well as setting up a backdoor on port 6969. The package is reportedly still available and was published by a verified publisher account.
Binary Security has identified three SSRF vulnerabilities in Azure DevOps: an endpoint proxy vulnerability, a DNS rebinding bypass, and a hooks SSRF with CRLF injection.
Sigstore's Rekor provides a signature transparency log and Fulcio provides a certificate transparency which can be used to enhance auditability and discoverability of artifact metadata and code signing. Rekor-monitor can be utilized for checking the consistency of transparency logs or monitoring for compromised accounts. A demo is included in the post.
There is a significant security vulnerability in TPM2-based disk encryption systems where an attacker with brief physical access can bypass disk encryption on machines using systemd-cryptenroll or clevis without a PIN. The vulnerability exists because most TPM2 unlock setups fail to verify the LUKS identity of the decrypted partition, allowing attackers to create a malicious partition that can extract the original encryption key while maintaining the TPM state. This post demonstrates successful attacks on both Fedora and NixOS systems. It recommends either using a TPM PIN or implementing proper PCR 15 verification as mitigation strategies, though it notes that the latter is not easily available on most distributions.
Sponsored
Discover how to make edge computing your competitive edge. Grab a copy of the Gartner Innovation Insight report [10] on integration strategies, edge computing applications, and best practices for edge-driven transformation. SUSE - a premium provider of open source Linux edge solutions - is sharing this must-read briefing for free.
SCALIBR (Software Composition Analysis Library) is an extensible file system scanner used to extract software inventory data (e.g. installed language packages) and detect vulnerabilities. It is a versatile file system scanner that detects vulnerabilities and extracts software inventory data. OSV-SCALIBR combines SCALIBR with OSV-scanner for software inventory extraction and vulnerability scanning. It can be used as a standalone tool, as a library for custom scans, or to analyze container images.
Copycat is a library that helps intercept system calls in a more efficient way on Linux systems 5.9 or higher. It offers faster performance compared to traditional ptrace-based methods by utilizing the SECCOMP Notifier API. Users can set rules for intercepting system calls by defining source and destination mappings either through environment variables or a configuration file.
A repository of credential stealer YARA rules for system information.
President Biden issued a broad cybersecurity executive order in his final days that covers federal network security, software supply chain protection, and AI security measures. Though comprehensive, critics note that the timing, near Trump's presidency, makes implementation uncertain, as many deadlines extend into the new administration.
Raspberry Pi's RP2350 microcontroller was subjected to security testing for a $20,000 prize challenge. Four teams discovered vulnerabilities requiring physical access, including power glitching, laser injection, and antifuse memory extraction techniques. Raspberry Pi openly acknowledged these findings, planning fixes in future versions while maintaining its "security through transparency" approach.
Privacy group noyb has filed GDPR complaints against six Chinese tech companies (TikTok, AliExpress, SHEIN, Temu, WeChat, and Xiaomi) for unlawfully transferring European users' data to China. Given China's surveillance practices, noyb argues these transfers violate EU data protection laws and requests immediate suspension and fines.
AWS has added a new course on securing generative AI workloads to its Skill Builder catalog.
OSV saw significant growth in ecosystem support in 2024, especially with Linux distributions like Ubuntu and Red Hat adopting the OSV Schema.
Amazon discusses how it combines physical and logical security measures to protect attendees and data at events like re:Invent in Las Vegas.
* Learn how ransomware operators work in 2025. * Use risk frameworks and threat intelligence to prioritize patches. * Build a playbook for containment, negotiation, and recovery.
Sponsored
Today's ransomware operations combine phishing, infostealers, and vulnerability exploits [4] to wreak havoc on your defenses.
A new UEFI Secure Boot vulnerability in a Microsoft-signed application could allow for deploying bootkits. The vulnerable application does not use trusted services to load the binaries but instead manually decrypts and loads binaries into memory which could be exploited by an attacker that replaces the expected binary with a malicious one. ESET provides Powershell commands to check for vulnerable systems.
Cannabis retailer Stiiizy confirmed a late 2024 cyberattack affecting four California locations where hackers accessed sensitive customer data including names, IDs, and transaction histories. The ransomware group Everest claimed responsibility, stating they leaked data of 420,000 customers after ransom demands weren't met.
Hackers calling themselves "Belsen Group" leaked data from 15,000 Fortinet firewalls, including configurations, passwords, and IPs. Analysis suggests the data was collected in October 2022 through CVE-2022-40684 exploitation. Though two years old, the leaked configurations could still pose risks as many devices remain online and accessible.
A story of recruiting pentesters with a dedicated sample app, "Mushroom," a web-based recruitment challenge for penetration testers used from 2015-2024. The simple application helped hire 14 pentesters across different seniority levels. Candidates had 72 hours to find vulnerabilities and submit a professional report.
A dive into how Rate Companies is fighting sophisticated AI-driven identity attacks using AI-powered threat modeling. The company implemented a zero-trust framework that focused on identity verification, real-time monitoring, and rapid response protocols. Key strategies include credential monitoring, reducing alert noise, scalable cloud security, and tool consolidation.
Virtual costs can enable cybercriminals to establish a reputable presence while obfuscating their actual operations. This post demonstrates the complex web involved in disentangling a single IP address. The post then discusses some ASNs in the UK with low reputations that are frequently used by cyber criminals due to lax Know Your Customer policies.
Sponsored
This report by Gartner highlights products and services that tackle key SOC challenges in interesting, new, and innovative ways [11]. It includes essential insights from Gartner on how to think about new technologies for the SOC, and highlights the innovation introduced by each listed vendor. Get your free copy from Dropzone AI [11] (a featured Cool Vendor)
Wultra protects against quantum-level attacks, which are expected to crack traditional cryptography and break existing security methods.
ModelScan is an open source tool by Protect AI that scans machine learning models for unsafe code. It supports various model formats like H5, Pickle, and SavedModel. By scanning models, you can protect against Model Serialization Attacks that could compromise your data and credentials.
Dyana is a sandbox environment that can load and profile various types of files like machine learning models, ELFs, Pickle, and JavaScript. It provides detailed insights into GPU memory usage, filesystem interactions, network requests, and security events. Users can easily install Dyana using Python 3.10+ with PIP and leverage its default safeguards and loaders for different file types.
The FTC will require GoDaddy to implement basic security protection such as MFA and HTTPS APIs. The complaint takes aim at GoDaddy's security practices, including failures to use MFA, manage software updates, log security events, segment its network, monitor for threats, and implement file integrity monitoring. The FTC notes that these practices have led to several breaches between 2019 and 2022.
The Clop ransomware gang claims to have breached 59 organizations by exploiting a vulnerability in Cleo's file transfer products discovered in October 2024. While some companies like Covestro confirmed breaches, others like Hertz deny being affected. Clop has threatened to publish stolen data on January 18 unless ransoms are paid.
The implementation deadline for PCI DSS 4.0 is rapidly approaching in March 2025 and many organizations are struggling with the enhanced requirements on non-human identities. This post details the new requirements around credential storage and rotation, least privilege, and monitoring. The post recommends making an inventory of non-human identities, setting timelines and phases for implementation, and utilizing automation where possible.
A table of how security teams at GitLab are using AI for tools and process efficiencies.
Belgian researchers found over 4 million vulnerable internet hosts that can be exploited for spoofing and DDoS attacks.
Microsoft's Threat Intelligence Team reports that State-sponsored Russian hackers are now targeting WhatsApp accounts, shifting away from their usual email tactics.
Sponsored
The information security landscape is constantly changing — which is why it's important to have a scalable and secure strategy that evolves alongside it.
Fortinet is warning customers of an actively exploited vulnerability in FortiOS and FortiProxy. The vulnerability allows remote attackers to gain super admin privileges via maliciously crafted requests to the Node.js websocket module. Fortinet reports that attackers are exploiting this vulnerability to randomly generate admin or local accounts and add them to new or existing SSL VPN groups.
Google Cloud and other independent security researchers discovered 6 new vulnerabilities in rsync, one of which is critical. When two of the vulnerabilities are chained together, attackers can achieve unauthenticated remote code execution on default installations of rsyncd. BleepingComputer detected 660K exposed rsync servers on Shodan but did not verify if they were vulnerable.
Criminals are tricking Google Ads users with fake ads to steal their account credentials. The scheme involves impersonating Google Ads and leading victims to fraudulent login pages. This malicious operation impacts Google's business and affects numerous customers globally.
The article discusses emerging security risks in AI-powered software development, highlighted by OWASP's Top 10 LLM vulnerabilities. Key concerns include prompt injection, supply chain vulnerabilities, sensitive data exposure, and RAG technology risks.
Traditionally, ptrace is used for system call monitoring, modifying, and faking but this mechanism suffers from being very slow as it requires two traps for each system call. The author presents an alternative mechanism that uses seccomp user notify and BPF filters to replace this functionality. The author notes that this technique suffers from time-of-check to time-of-use attacks and should not be used for security-critical decisions.
The author advises against using Session due to security vulnerabilities, such as the removal of forward secrecy and misuse of cryptographic keys. Session's encryption practices are criticized for reducing security measures to a mere show, making it less trustworthy compared to other messaging apps. In summary, the author strongly recommends avoiding Session due to significant security flaws.