Don’t miss

Critical Fortra FileCatalyst Workflow vulnerability patched (CVE-2024-6633)

credentials, Don't miss, Dynatrace, enterprise, file-sharing, Fortra, Hot stuff, News, SQL injection, Tenable, vulnerability /

Critical Fortra FileCatalyst Workflow vulnerability patched (CVE-2024-6633) 2024-08-28 at 12:02 By Zeljka Zorz Organizations using Fortra’s FileCatalyst Workflow are urged to upgrade their instances, so that attackers can’t access an internal HSQL database by exploiting known static credentials (CVE-2024-6633). “Once logged in to the HSQLDB, the attacker can perform malicious operations in the database. For […]

Critical Fortra FileCatalyst Workflow vulnerability patched (CVE-2024-6633) Read More »

Cryptomator: Open-source cloud storage encryption

Cloud, cloud security, Don't miss, Encryption, Hot stuff, News, open source, Privacy, software /

Cryptomator: Open-source cloud storage encryption 2024-08-28 at 07:31 By Mirko Zorz Cryptomator offers open-source, client-side encryption of your files in the cloud. It’s available for Windows, Linux, macOS and iOS. Cryptomator works with Dropbox, Google Drive, OneDrive, MEGA, pCloud, ownCloud, Nextcloud, and any other cloud storage service that synchronizes with a local directory. Key features

Cryptomator: Open-source cloud storage encryption Read More »

Cybersecurity jobs available right now: August 28, 2024

cybersecurity jobs, Don't miss, Hot stuff, News /

Cybersecurity jobs available right now: August 28, 2024 2024-08-28 at 07:01 By Mirko Zorz Business Information Security Officer Toyota North America | USA | On-site – View job details Acting as an Information Security ambassador to the business, this role works with technology, data, risk, business, and the larger TFS Information Security team to provide

Cybersecurity jobs available right now: August 28, 2024 Read More »

Versa Director zero-day exploited to compromise ISPs, MSPs (CVE-2024-39717)

0-day, APT, Don't miss, Hot stuff, ISP, Lumen, Malware, misconfiguration, MSP, News, USA, Versa Networks, web shell /

Versa Director zero-day exploited to compromise ISPs, MSPs (CVE-2024-39717) 2024-08-27 at 19:01 By Zeljka Zorz Advanced, persistent attackers have exploited a zero-day vulnerability (CVE-2024-39717) in Versa Director to compromise US-based managed service providers with a custom-made web shell dubbed VersaMem by the researchers. The malware harvests credentials enabling the attackers to access the providers’ downstream

Versa Director zero-day exploited to compromise ISPs, MSPs (CVE-2024-39717) Read More »

How to prioritize data privacy in core customer-facing systems

cybersecurity, data, Don't miss, Expert analysis, Expert corner, Hot stuff, MetaRouter, News, opinion, Privacy, strategy /

How to prioritize data privacy in core customer-facing systems 2024-08-27 at 07:45 By Help Net Security Evolving global data privacy regulations are keeping marketers on their toes. In April 2024, the American Privacy Rights Act (APRA) was introduced in the Senate. The proposed bill would create a federal consumer privacy framework akin to the GDPR,

How to prioritize data privacy in core customer-facing systems Read More »

Behind the scenes of Serious Cryptography

books, cybersecurity, Don't miss, Encryption, Features, Hot stuff, how-to, News, No Starch Press, opinion, tips /

Behind the scenes of Serious Cryptography 2024-08-27 at 07:45 By Mirko Zorz In this Help Net Security interview, Jean-Philippe Aumasson, discusses the writing and research process for Serious Cryptography, his latest book. With a career steeped in research and practical cryptography, Aumasson offers a rare glimpse into the efforts required to distill complex concepts into

Behind the scenes of Serious Cryptography Read More »

SonicWall patches critical flaw affecting its firewalls (CVE-2024-40766)

access control, CVE, Don't miss, firewall, Hot stuff, News, security update, SonicWall, vulnerability /

SonicWall patches critical flaw affecting its firewalls (CVE-2024-40766) 2024-08-26 at 21:32 By Zeljka Zorz SonicWall has patched a critical vulnerability (CVE-2024-40766) in its next-gen firewalls that could allow remote attackers unauthorized access to resources and, in specific conditions, to crash the appliances. About CVE-2024-40766 CVE-2024-40766 is an improper access control vulnerability in the “SonicWall SonicOS

SonicWall patches critical flaw affecting its firewalls (CVE-2024-40766) Read More »

Two strategies to protect your business from the next large-scale tech failure

cybersecurity, Don't miss, Expert analysis, Expert corner, Hot stuff, InkBridge Networks, News, opinion, software, strategy /

Two strategies to protect your business from the next large-scale tech failure 2024-08-26 at 06:47 By Help Net Security The CrowdStrike event in July clearly demonstrated the risks of allowing a software vendor deep access to network infrastructure. It also raised concerns about the concentration of digital services in the hands of a few companies.

Two strategies to protect your business from the next large-scale tech failure Read More »

Nuclei: Open-source vulnerability scanner

Don't miss, GitHub, Hot stuff, News, open source, penetration testing, scanning, software, vulnerability assessment /

Nuclei: Open-source vulnerability scanner 2024-08-26 at 06:31 By Help Net Security Nuclei is a fast and customizable open-source vulnerability scanner powered by YAML-based templates. With its flexible templating system, Nuclei can be adapted to perform various security checks. It can send requests to multiple targets using customizable templates, ensuring zero false positives and enabling rapid

Nuclei: Open-source vulnerability scanner Read More »

Rebrand, regroup, ransomware, repeat

cybercrime, Don't miss, HackerOne, Hot stuff, News, Ransomware, Video /

Rebrand, regroup, ransomware, repeat 2024-08-26 at 06:01 By Help Net Security Changes witnessed over the last few years have led to larger ransomware groups breaking into smaller units, posing more considerable challenges for law enforcement. Ransomware actors are evading arrest more easily and adapting methods with innovative technologies. In this Help Net Security video, Shobhit

Rebrand, regroup, ransomware, repeat Read More »

Another critical SolarWinds Web Help Desk bug fixed (CVE-2024-28987)

CVE, Don't miss, enterprise, Hot stuff, MSP, News, SMBs, SolarWinds, vulnerability /

Another critical SolarWinds Web Help Desk bug fixed (CVE-2024-28987) 2024-08-23 at 13:31 By Zeljka Zorz A week after SolarWinds released a fix for a critical code-injection-to-RCE vulnerability (CVE-2024-28986) in Web Help Desk (WHD), another patch for another critical flaw (CVE-2024-28987) in the company’s IT help desk solution has been pushed out. CVE-2024-28987 CVE-2024-28987 stems from

Another critical SolarWinds Web Help Desk bug fixed (CVE-2024-28987) Read More »

Vulnerability prioritization is only the beginning

cybersecurity, Don't miss, Expert analysis, Expert corner, Gutsy, Hot stuff, News, opinion, strategy, vulnerability management /

Vulnerability prioritization is only the beginning 2024-08-23 at 07:30 By Help Net Security To date, most technology solutions focused on vulnerability management have focused on the prioritization of risks. That usually took the shape of some risk-ranking structure displayed in a table with links out to the CVEs and other advisory or threat intelligence information.

Vulnerability prioritization is only the beginning Read More »

The changing dynamics of ransomware as law enforcement strikes

cybercrime, Don't miss, News, Ransomware, report, survey, WithSecure /

The changing dynamics of ransomware as law enforcement strikes 2024-08-23 at 06:31 By Help Net Security After peaking in late 2023, the ransomware industry is beginning to stabilize in productivity, with notable developments in ransomware targets, and industry dynamics, according to WithSecure. Sectors impacted by ransomware (Source: WithSecure) While ransomware productivity has shown signs of

The changing dynamics of ransomware as law enforcement strikes Read More »

Critical GitHub Enterprise Server auth bypass flaw fixed (CVE-2024-6800)

CVE, Don't miss, enterprise, GitHub, Hot stuff, News, security update, software development, vulnerability /

Critical GitHub Enterprise Server auth bypass flaw fixed (CVE-2024-6800) 2024-08-22 at 15:31 By Zeljka Zorz A critical vulnerability (CVE-2024-6800) affecting all currently supported versions of GitHub Enterprise Server (GHES) may allow attackers to gain unrestricted access to the instance’s contents. The issue, reported via the GitHub Bug Bounty program, has been addressed and administrators are

Critical GitHub Enterprise Server auth bypass flaw fixed (CVE-2024-6800) Read More »

New Chrome zero-day actively exploited, patch quickly! (CVE-2024-7971)

0-day, Chrome, CVE, Don't miss, Google, Hot stuff, Microsoft, Microsoft Edge, News /

New Chrome zero-day actively exploited, patch quickly! (CVE-2024-7971) 2024-08-22 at 12:01 By Zeljka Zorz A new Chrome zero-day vulnerability (CVE-2024-7971) exploited by attackers in the wild has been fixed by Google. About CVE-2024-7971 CVE-2024-7971 is a high-severity vulnerability caused by a type confusion weakness in V8, the open-source JavaScript and WebAssembly engine developed by Google

New Chrome zero-day actively exploited, patch quickly! (CVE-2024-7971) Read More »

Android malware uses NFC to steal money at ATMs

Android, Banks, cybercrime, Don't miss, EU, Europe, Hot stuff, Malware, News, scams /

Android malware uses NFC to steal money at ATMs 2024-08-22 at 12:01 By Help Net Security ESET researchers uncovered NGate malware, which can relay data from victims’ payment cards via a malicious app installed on their Android devices to the attacker’s rooted Android phone. Attack overview (Source: ESET) Unauthorized ATM withdrawals The campaign’s primary goal

Android malware uses NFC to steal money at ATMs Read More »

A survival guide for data privacy in the age of federal inaction

cybersecurity, Data Protection, Don't miss, Expert analysis, Expert corner, Hot stuff, News, opinion, Osano, Privacy, regulation, strategy /

A survival guide for data privacy in the age of federal inaction 2024-08-22 at 07:31 By Help Net Security Things change fast in the world of data privacy. Just earlier this year, the question I was being asked most frequently was, “How similar will the proposed federal privacy law (APRA) be to the EU’s GDPR?”

A survival guide for data privacy in the age of federal inaction Read More »

Most ransomware attacks occur between 1 a.m. and 5 a.m.

attacks, CISO, cyberattacks, cybercrime, Don't miss, Malwarebytes, News, Ransomware, report, survey /

Most ransomware attacks occur between 1 a.m. and 5 a.m. 2024-08-22 at 07:02 By Help Net Security There’s been an alarming increase in ransomware attacks over the past year, alongside significant shifts in the tactics and strategies employed by cybercriminals that underscore the necessity for organizations to implement around-the-clock monitoring and investigation of suspicious behaviors,

Most ransomware attacks occur between 1 a.m. and 5 a.m. Read More »

PostgreSQL databases under attack

Aqua Security, brute-force, Cloud, cryptojacking, Don't miss, Hot stuff, Linux, Malware, News, PostgreSQL, tips /

PostgreSQL databases under attack 2024-08-21 at 16:16 By Zeljka Zorz Poorly protected PostgreSQL databases running on Linux machines are being compromised by cryptojacking attackers. The attack – observed by Aqua Security researchers on a honeypot system – starts with the threat actors brute-forcing access credentials. Once access is achieved, the threat actor: Creates a new

PostgreSQL databases under attack Read More »

Microchip Technology manufacturing facilities impacted by cyberattack

cyberattack, disruption, Don't miss, Hot stuff, Microchip Technology, News, Semiconductors, USA /

Microchip Technology manufacturing facilities impacted by cyberattack 2024-08-21 at 12:46 By Zeljka Zorz American semiconductor manufacturer Microchip Technology Incorporated has had some of its business operations disrupted by a cyberattack. “As a result of the incident, certain of the Company’s manufacturing facilities are operating at less than normal levels, and the Company’s ability to fulfill

Microchip Technology manufacturing facilities impacted by cyberattack Read More »

Scroll to Top