Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
⚡ Weekly Recap: Fortinet Exploit, Chrome 0-Day, BadIIS Malware, Record DDoS, SaaS Breach & More
This week saw a lot of new cyber trouble. Hackers hit Fortinet and Chrome with new 0-day bugs. They also broke into supply chains and SaaS tools. Many hid insi…
Malicious Pull Request Targets 6,000+ Developers via Vulnerable Ethcode VS Code Extension
Cybersecurity researchers have flagged a supply chain attack targeting a Microsoft Visual Studio Code (VS Code) extension called Ethcode that has been installe…
Malicious Go Package Exploits Module Mirror Caching for Persistent Remote Access
Cybersecurity researchers have called attention to a software supply chain attack targeting the Go ecosystem that involves a malicious package capable of grant…
Malicious NPM Packages Target Roblox Users with Data-Stealing Malware
A new campaign has targeted the npm package repository with malicious JavaScript libraries that are designed to infect Roblox users with open-source stealer ma…
Security Flaws in Popular ML Toolkits Enable Server Hijacks, Privilege Escalation
Cybersecurity researchers have uncovered nearly two dozen security flaws spanning 15 different machine learning (ML) related open-source projects.These compris…
New Attack Technique 'Sleepy Pickle' Targets Machine Learning Models
The security risks posed by the Pickle format have once again come to the fore with the discovery of a new "hybrid machine learning (ML) model exploitation tec…
JAVS Courtroom Recording Software Backdoored - Deploys RustDoor Malware
Malicious actors have backdoored the installer associated with courtroom video recording software developed by Justice AV Solutions (JAVS) to deliver malware t…
Malicious Code in XZ Utils for Linux Systems Enables Remote Code Execution
The malicious code inserted into the open-source library XZ Utils, a widely used package present in major Linux distributions, is also capable of facilitating …
Over 100 Malicious AI/ML Models Found on Hugging Face Platform
As many as 100 malicious artificial intelligence (AI)/machine learning (ML) models have been discovered in the Hugging Face platform.These include instances wh…
Hands-on Review: Myrror Security Code-Aware and Attack-Aware SCA
IntroductionThe modern software supply chain represents an ever-evolving threat landscape, with each package added to the manifest introducing new attack vecto…
Mageia 2024-0031: gnutls security update
The updated packages fix security vulnerabilities: A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with di…
Warning: New Malware Emerges in Attacks Exploiting Ivanti VPN Vulnerabilities
Google-owned Mandiant said it identified new malware employed by a China-nexus espionage threat actor known as UNC5221 and other threat groups during post-expl…
MavenGate Attack Could Let Hackers Hijack Java and Android via Abandoned Libraries
Several public and popular libraries abandoned but still used in Java and Android applications have been found susceptible to a new software supply chain attac…
Bad.Build Flaw in Google Cloud Build Raises Concerns of Privilege Escalation
Cybersecurity researchers have uncovered a privilege escalation vulnerability in Google Cloud that could enable malicious actors tamper with application images…
Alert: Million of GitHub Repositories Likely Vulnerable to RepoJacking Attack
Millions of software repositories on GitHub are likely vulnerable to an attack called RepoJacking, a new study has revealed.This includes repositories from org…
Trojanized Windows 10 Installer Used in Cyberattacks Against Ukrainian Government Entities
Government entities in Ukraine have been breached as part of a new campaign that leveraged trojanized versions of Windows 10 installer files to conduct post-ex…
Hackers Exploit Cloud Video Platform To Target Real Estate Websites
Researchers have discovered a severe supply-chain attack that plants web skimmers on real-estate websites via…Hackers Exploit Cloud Video Platform To Target Re…
Latest Firefox 95 Includes RLBox Sandboxing to Protect Browser from Malicious Code
Mozilla is beginning to roll out Firefox 95 with a new sandboxing technology called RLBox that prevents untrusted code and other security vulnerabilities from …
New 'Trojan Source' Technique Lets Hackers Hide Vulnerabilities in Source Code
A novel class of vulnerabilities could be leveraged by threat actors to inject visually deceptive malware in a way that's semantically permissible but alters t…
A New Critical SolarWinds Zero-Day Vulnerability Under Active Attack
SolarWinds, the Texas-based company that became the epicenter of aÂmassive supply chain attackÂlate last year, has issued patches to contain a remote code exec…
Kaseya Releases Patches for Flaws Exploited in Widespread Ransomware Attack
Florida-based software vendor Kaseya on SundayÂrolled out urgent updates to address critical security vulnerabilities in its Virtual System Administrator (VSA)…
Cybersecurity Webinar ' SolarWinds Sunburst: The Big Picture
The SolarWinds Sunburst attack has been in the headlines since it was first discovered in December 2020.ÂAs the so-called layers of the onion are peeled back, …
Why CII best practices gold badges are importa
''A CII Best Practices badge, especially a gold badge, shows that an OSS project has implemented a large number of good practices to keep the project sustainab…
Mageia 2020-0018: jss security upda
Updated jss packages fix security vulnerability: A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS CryptoManager, where it implicitly…