Port 22

~ 1 Jun 2023 ~

Jetpack WordPress Plug-in API Bug Triggers Mass Updates

How Do I Reduce Security Tool Sprawl in My Environment?

Sustained 'Red Deer' Phishing Attacks Impersonate Israel Post, Drop RATs

Google Drive Deficiency Allows Attackers to Exfiltrate Workspace Data Without a Trace

Where SBOMs Stand Today

Novel PyPI Malware Uses Compiled Python Bytecode to Evade Detection

The downside of frenemies

Ask Fitis, the Bear: Real Crooks Sign Their Malware

Evasive QBot Malware Leverages Short-lived Residential IPs for Dynamic Attacks

Biometric Bypass: BrutePrint Makes Short Work of Fingerprint Security

New Zero-Click Hack Targets iOS Users with Stealthy Root-Privilege Malware

Unmasking XE Group: Experts Reveal Identity of Suspected Cybercrime Kingpin

SolarWinds Transforms Brand to Signify Ongoing Evolution, Portfolio Expansion, and Customer Empowerment

Top macOS Malware Threats Proliferate: Here Are 6 to Watch

Dark Reading Launches Inaugural CISO Advisory Board

Operation Triangulation: iOS devices targeted with previously unknown malware

Malicious PyPI Packages Using Compiled Python Code to Bypass Detection

HID Global SAFE

Advantech WebAccess/SCADA

How Wazuh Improves IT Hygiene for Cyber Security Resilience

On the Catastrophic Risk of AI

All eyes on APIs: Top 3 API security risks and how to mitigate them

Improved BlackCat Ransomware Strikes with Lightning Speed and Stealthy Tactics

N. Korean ScarCruft Hackers Exploit LNK Files to Spread RokRAT

Amazon Ring, Alexa accused of every nightmare IoT security fail you can imagine

Ukraine war blurs lines between cyber-crims and state-sponsored attackers

Active Mirai Botnet Variant Exploiting Zyxel Devices for DDoS Attacks

Urgent WordPress Update Fixes Critical Flaw in Jetpack Plugin on Million of Sites

Dark Pink cyber-spies add info stealers to their arsenal, notch up more victims

Women in Cybersecurity (WiCyS) Joins Forces with SANS Security Awareness

~ 31 May 2023 ~

Feds, you'll need a warrant for that cellphone border search

Meet Charlotte, CrowdStrike's New Generative AI Assistant

Yet Another Toyota Cloud Data Breach Jeopardizes Thousands of Customers

Can Cloud Services Encourage Better Login Security? Netflix's Accidental Model

MacOS 'Migraine' Bug: Big Headache for Device System Integrity

Ways to Help Cybersecurity's Essential Workers Avoid Burnout

What Apple's RSRs Reveal About Mac Patch Management

Barracuda Email Security Gateways bitten by data thieves

Criminals spent 10 days in US dental insurer's systems extracting data of 9 million

Investment May Be Down, but Cybersecurity Remains a Hot Sector

Apple's iOS 16.5 Fixes 3 Security Bugs Already Used in Attacks

Checkmarx Announces GenAI-powered AppSec Platform, Empowering Developers and AppSec Teams to Find and Fix Vulnerabilities Faster

New eID Scheme Gives EU Citizens Easy Access to Public Services Online

XDR meets IAM: Comprehensive identity threat detection and response with Microsoft

Cybercriminals Targeting Apache NiFi Instances for Cryptocurrency Mining

Mirai Variant Opens Tenda, Zyxel Gear to RCE, DDoS

Chinese Hacking of US Critical Infrastructure

Focus Security Efforts on Choke Points, Not Visibility

XFS bug in Linux kernel 6.3.3 coincides with SGI code comeback

Critical Firmware Backdoor in Gigabyte Systems Exposes ~7 Million Devices

When the popular safeguarding tool is anything but

Salesforce 'Ghost Sites' Expose Sensitive Corporate Data

Millions of Gigabyte Motherboards Were Sold With a Firmware Backdoor

Beware of Ghost Sites: Silent Threat Lurking in Your Salesforce Communities

Microsoft Details Critical Apple macOS Vulnerability Allowing SIP Protection Bypass

6 Steps to Effective Threat Hunting: Safeguard Critical Assets and Fight Cybercrime

5 free OSINT tools for social media

Thinking straight in the SoC: How AI erases cognitive bias

Dark Pink APT Group Leverages TelePowerBot and KamiKakaBot in Sophisticated Attacks

RomCom RAT Using Deceptive Web of Rogue Software Sites for Covert Attacks

Alert: Hackers Exploit Barracuda Email Security Gateway 0-Day Flaw for 7 Months

Spotlight on 2023 Dan Kaminsky Fellow: Dr. Gus Andrews

Discord Admins Hacked by Malicious Bookmarks

~ 30 May 2023 ~

1. This crypto-coin is called Jimbo. 2. $8m was stolen from its devs in flash loan attack

90+ orgs tell Slack to stop slacking when it comes to full encryption

Human-Assisted CAPTCHA-Cracking Services Supercharge Shopper Bots

421M Spyware Apps Downloaded Through Google Play

Pegasus-pusher NSO gets new owner keen on the commercial spyware biz

Undetected Attacks Against Middle East Targets Conducted Since 2020

9M Dental Patients Affected by LockBit Attack on MCNA

New macOS vulnerability, Migraine, could bypass System Integrity Protection

Pentagon Leaks Emphasize the Need for a Trusted Workforce

Hackers Win $105,000 for Reporting Critical Security Flaws in Sonos One Speakers

CAPTCHA-Breaking Services with Human Solvers Helping Cybercriminals Defeat Security

Advantech WebAccess/SCADA

Implementing Risk-Based Vulnerability Discovery and Remediation

Brute-Forcing a Fingerprint Reader

Tricks of the trade: How a cybercrime ring operated a multilevel fraud scheme

Sneaky DogeRAT Trojan Poses as Popular Apps, Targets Indian Android Users

~ 29 May 2023 ~

New BrutePrint Attack Lets Attackers Unlock Smartphones with Fingerprint Brute-Force

Top Cyberattacks Revealed in New Threat Intelligence Report

AceCryptor: Cybercriminals' Powerful Weapon, Detected in 240K+ Attacks

3 Challenges in Building a Continuous Threat Exposure Management (CTEM) Program and How to Beat Them

New GobRAT Remote Access Trojan Targeting Linux Routers in Japan

Don't Click That ZIP File! Phishers Weaponizing .ZIP Domains to Trick Victims

New York county still dealing with ransomware eight months after attack

PyPI Implements Mandatory Two-Factor Authentication for Project Owners

~ 28 May 2023 ~

padre Padding Oracle Attack Exploiter Tool

~ 27 May 2023 ~

Netflixs Password-Sharing Crackdown Has Hit the US

New Stealthy Bandit Stealer Targeting Web Browsers and Cryptocurrency Wallets

Critical OAuth Vulnerability in Expo Framework Allows Account Hijacking

Alien versus Predator? No, this Android spyware works together

~ 26 May 2023 ~

Friday Squid Blogging: Online Cephalopod Course

US govt pushes spyware to other countries? Senator Wyden would like a word

2 Lenses for Examining the Safety of Open Source Software

130K+ Patients' Social Security Numbers Leaked in UHS of Delaware Data Breach

Tesla Whistleblower Leaks 100GB of Data, Revealing Safety Complaints

Travel-Themed Phishing, BEC Campaigns Get Smarter as Summer Season Arrives

Phishing Domains Tanked After Meta Sued Freenom

Severe Flaw in Google Cloud's Cloud SQL Service Exposed Confidential Data