Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
The House Committee on Homeland Security has demanded transparency from CrowdStrike CEO George Kurtz following major global outages caused by a software defect. The committee seeks detailed explanations of the incident and CrowdStrike's mitigation steps.
Meta faces EU scrutiny over its "pay or consent" model for Facebook and Instagram introduced in November. The Consumer Protection Cooperation Network has given Meta until September 1 to address concerns about potential misleading practices and undue pressure on users.
Amazon can now issue CVEs for Amazon and AWS products.
Google is shutting down the goo.gl link shortener in August 2025. All existing links will redirect to a 404.
Verizon will pay $16 million to settle data breaches at TracFone that exposed customer data and led to unauthorized activities.
Sponsored
Most developer tools let you try before you buy. But in application security, too many vendors force you through endless demo calls and artificial POCs just to see the tool.
Another Cisco critical vulnerability has been disclosed. CVE-2024-20419 allows unauthenticated attackers to change any user's password, including administrators'. This flaw in the password-change process enables access to the web UI or API with compromised user privileges. No workarounds exist. Cisco released a security update and reports no active exploitation.
MNGI Digestive Health is notifying over 765,000 individuals about a data breach from August 2023. The breach, discovered nearly a year later, potentially exposed sensitive personal and health information, including names, Social Security numbers, medical data, and financial details. MNGI is currently working to inform affected individuals through written notifications.
CrowdStrike has shared technical details on the Falcon Update that caused a global outage on July 19. The issue impacted customers using the Falcon sensor for Windows version 7.11 and above between specific times on July 19. CrowdStrike has fixed the error in Channel File 291 and is conducting a root cause analysis to prevent similar incidents in the future.
The AquaSec team scanned over 50k repositories belonging to the top 100 organizations on GitHub for secrets using conventional (git clone) and unconventional methods. Using git clone --mirror fetches a more complete git history that includes PRs and other dangling refs. It led to finding additional secrets on 18% of scanned repositories. The Aqua team also tested a novel approach to scanning cached views from SCMs and found that some additional secrets could be found, though the process is difficult and has a lower chance of success.
The gitRepo volume driver is a deprecated k8s storage driver that allows for reading files into a pod from a remote git repository. This post examines a vulnerability in the gitRepo driver whereby a maliciously crafted git repository could sneak git hooks into a node and execute commands as root. The authors submitted a PR to fix this issue which will be released in version 1.31.
This blog post discusses why the ViewState vulnerability is not used for exploits despite being around for a long time and explains how it can be done on a fully patched Microsoft Exchange 2019 host. It explains how to exploit view state vulnerabilities and the process of resetting compromised machine keys in IIS. It also highlights the risks associated with resetting machine keys and provides steps to regenerate them based on whether they were automatically generated or static.
Command Zero's platform for investigation combines autonomous and user-led methods in a federated data model and leverages automation and advanced Language Learning Models to augment human investigations.
Network inspection library for Node that allows packet crafting and parsing as well as capturing network traffic and sending packets in all formats.
Fragtunnel is a PoC tool for tunneling TCP traffic through IDS/IPS engines and Next Generation Firewalls. It exploits the fact that they allow a limited number of packets before making a decision on whether to allow or deny the traffic.
Operation Jackal III, a global law enforcement effort targeting West African crime groups, resulted in 300 arrests and $3 million in asset seizures. There are 400 additional suspects across 21 countries.
The Shared Responsibility Model is used by cloud providers to describe a split in security responsibilities where cloud providers are responsible for the underlying services and users are responsible for securing their workloads built on those services. Customer breaches could result in negative reputational damage to cloud providers. This forces cloud providers to improve their defaults to be more secure.
This article compares RDP security using TLS-only versus NLA. NLA-secured servers faced significantly more login attempts but also provided more insights into attacker tactics. Geographical origins of attacks differed between NLA and TLS, with certain countries showing preferences for one protocol over the other. While NLA is considered more secure, it may attract more sophisticated attacks. Researchers found NLA honeypots to be more valuable for understanding cybersecurity threats and the human element behind them.
Microsoft says that “less than one percent of all Windows machines” were affected, but it was enough to create problems for retailers, banks, airlines, and many other industries.
Report on the state of education for secure software development that highlights gaps in education, time constraints in training, and AI security as a critical future area for education.
A judge dismissed major SEC charges against SolarWinds and its CISO Timothy Brown regarding cybersecurity practices after a supply chain attack.
Sponsored
These days, DSPM (data security posture management) is a must. But BigID [4] isn't just jumping on the bandwagon – they're leading the pack when it comes to coverage, classification, risk management, and integrations.
Morphisec discovered an unauthenticated, zero-click (for trusted senders) RCE vulnerability in Microsoft Outlook. It has warned that this vulnerability could lead to data breaches, unauthorized access, and other malicious activities if abused. A patch for the vulnerability was included in July's Patch Tuesday patches. The researchers will be presenting more technical details at DEFCON.
Cisco has fixed a critical vulnerability that allows hackers to add root users and crash SEG devices using malicious email attachments. The flaw involves an absolute path traversal weakness in SEG content scanning, enabling attackers to replace files on the system. Cisco advises updating vulnerable appliances to prevent exploitation and contacting its Technical Assistance Center for assistance.
Businesses all over the world, from hospitals to banks and other companies, are reporting IT outages. Microsoft started noting issues on its Service Health page in the early hours of today. Shortly thereafter, outages became widespread. CrowdStrike says that a faulty update is causing crashes in Windows systems - Mac and Linux devices are unaffected. The issue stems from invalidly formatted .sys files causing the top level driver to crash. Recovery will be very difficult.
A bug in the Linux Kernel's eBPF verifier can lead to a system compromise by allowing attackers to manipulate register values. The vulnerability was fixed in July after being reported in June. It requires specific permissions and is not widespread among applications or containers.
Fog Security investigated 51 different AWS resources and found that only 76% of them were encrypted by default, with 22 of those being encrypted with AWS Owned Keys by default. Even when encrypted by default, services that used AWS Owned Keys were shared between AWS accounts and don't typically offer more access controls. AWS Managed Keys are controlled by AWS and typically implicitly grant access to IAM principals in the same account, so they may offer less protection than expected. Fog Security recommends enabling encryption by default where possible and also opting for the use of AWS Customer Managed Keys where possible.
This blog post discusses in detail how to analyze malicious MSI files used for software installation on Windows. MSI installers can hide malicious code within legitimate packages to avoid detection by security tools. Threat actors often use custom actions in MSI files to execute harmful code during installation.
This blog post discusses how automated firmware analysis tools like EMBA enhance security by scanning for vulnerabilities in device firmware. EMBA's open-source approach allows for deep analysis, detection of unknown threats, and customized testing. Leveraging EMBA can significantly improve product security, protect critical devices, and streamline the firmware analysis process.
Sponsored
What defines a “material” cybersecurity incident?
Whispers is an information security analysis tool designed to identify hardcoded secrets in structured text and static code.
Lemma is a Python-based AWS Lambda package and client designed to execute packaged command-line tools in a scalable, remote environment. It makes use of Lambda's response streaming to stream real-time stdout to the client.
Pumbin is an implant generation platform written in Rust that supports the Extism plugin system. It populates implants with randomized data so that each generated implant is unique.
AWS has released a language agnostic local HTTP service that can be installed in compute environments to read and cache secrets from Secrets Manager. TTL, cache size, maximum connections, and HTTP port can be configured in the agent. The agent also includes SSRF protections by default.
A university student created malware to disrupt government websites and made £45,000 from selling it. He targeted a Jobcentre in Braintree, Essex, and was sentenced to 21 months in jail for computer misuse. The malware caused websites to go offline by overwhelming them with internet traffic.
NullBulge is a cybercriminal group that targets AI and gaming entities. This post talks about how NullBulge distributes malware through GitHub and Hugging Face, posing a threat to software supply chains. NullBulge has shifted towards hacktivist motives for financial gain.
With the release of its R560 GPU drivers, NVIDIA is recommending users on newer GPU models to switch to the open-source drivers.
CISA has released a new playbook to help improve security and resilience in critical infrastructure.
WazirX, an Indian cryptocurrency exchange, suffered a security breach resulting in the theft of $230 million in crypto assets.
Sponsored
What defines a “material” cybersecurity incident?
Rite Aid reported a "limited cybersecurity incident" in June. A threat actor impersonated an employee, gaining unauthorized access to company systems. The breach exposed customer information including names, addresses, and IDs. The RansomHub gang claimed responsibility, alleging it obtained 10GB of data affecting 45 million customers.
A large swath of crypto domains are suffering from domain hijacking attacks. These domains were left vulnerable after the forced migration from Google Domains to Squarespace led to MFA being disabled. CoinGecko founder, Bobby Ong, is advising people to avoid interacting with crypto for a few days and wait for the situation to be resolved.
A threat actor leaked 15 million Trello users' email addresses collected via an unsecured API. The leaked data can be used for phishing attacks and doxxing by linking email addresses to individuals. Atlassian confirmed the breach and made changes to secure the Trello REST API.
This post dives into how two fake AWS packages on the NPM JavaScript repository contained hidden code that backdoored developers' computers. The packages, which were downloaded hundreds of times, mimicked a legitimate library but included additional files with concealed malicious code.
Security operations in the cloud are particularly complex as they require operators to have knowledge of security operations as well as cloud security. Cloud attack emulation can be the bridge needed as it allows teams to stress test their infrastructure against attacks. It can be utilized for cloud penetration testing, red/purple teaming, incident response readiness, and security assurance.
AWS Network Firewall is a fully managed service that works as an IDS/IPS to control egress between workloads running in a VPC and the Internet. AWS recommends the use of a domain list to allow specific domains that can be contacted. This post demonstrates that this security measure can be trivially bypassed by spoofing the host name to avoid the block as it doesn't utilize DNS lookups or IP blocking.
Alphabet is in advanced talks to acquire cybersecurity startup Wiz for $23 billion, doubling its last private valuation. If successful, it would value Wiz at 46 times its current ARR.
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
Touch ID CLI (tidcli) provides a utility to open a Touch ID prompt and return an exit code of 0 on success or 1 on failure. This is meant to be used in shell scripts to add Touch ID authentication.