Hot stuff

“0.0.0.0-Day” vulnerability affects Chrome, Safari and Firefox

0-day, Chrome, Don't miss, Firefox, Hot stuff, Linux, macOS, News, Oligo Security, Safari, vulnerability /

“0.0.0.0-Day” vulnerability affects Chrome, Safari and Firefox 2024-08-09 at 13:01 By Zeljka Zorz A “0.0.0.0-Day” vulnerability affecting Chrome, Safari and Firefox can be – and has been – exploited by attackers to gain access to services on internal networks, Oligo Security researchers have revealed. The vulnerability stems from how those popular browsers handle network requests […]

“0.0.0.0-Day” vulnerability affects Chrome, Safari and Firefox Read More »

NIS2: A catalyst for cybersecurity innovation or just another box-ticking exercise?

Compliance, cybersecurity, Don't miss, Expert analysis, Expert corner, Hot stuff, Innovation, News, opinion, Palo Alto Networks, regulation, security standard, threat detection /

NIS2: A catalyst for cybersecurity innovation or just another box-ticking exercise? 2024-08-09 at 08:02 By Help Net Security The Network and Information Security (NIS) 2 Directive is possibly one of the most significant pieces of cybersecurity regulation to ever hit Europe. The 27 EU Member States have until 17 October 2024 to adopt and publish […]

NIS2: A catalyst for cybersecurity innovation or just another box-ticking exercise? Read More »

“Perfect” Windows downgrade attack turns fixed vulnerabilities into zero-days

0-day, attack, Don't miss, Hot stuff, News, research, SafeBreach, vulnerability, Windows, Windows Server /

“Perfect” Windows downgrade attack turns fixed vulnerabilities into zero-days 2024-08-08 at 13:01 By Zeljka Zorz A researcher has developed a downgrade attack that can make Windows machines covertly, persistently and irreversibly vulnerable, even if they were fully patched before that. A downgrade attack exploiting the Windows Update process The direction of SafeBreach researcher Alon Leviev’s […]

“Perfect” Windows downgrade attack turns fixed vulnerabilities into zero-days Read More »

SSHamble: Open-source security testing of SSH services

Don't miss, GitHub, Hot stuff, News, open source, software, SSH /

SSHamble: Open-source security testing of SSH services 2024-08-08 at 09:33 By Help Net Security runZero published new research on Secure Shell (SSH) exposures and unveiled a corresponding open-source tool, SSHamble. This tool helps security teams validate SSH implementations by testing for uncommon but dangerous misconfigurations and software bugs. Discovered weaknesses During their presentation at Black […]

SSHamble: Open-source security testing of SSH services Read More »

Traceeshark: Open-source plugin for Wireshark

Aqua Security, cybersecurity, Don't miss, Hot stuff, network, News, software, Wireshark /

Traceeshark: Open-source plugin for Wireshark 2024-08-08 at 08:01 By Mirko Zorz Traceeshark is a plugin for Wireshark that enables security practitioners to quickly investigate security incidents. It enhances the capabilities of Aqua Tracee, an open-source runtime security and forensics tool, and allows users to analyze kernel-level event and behavioral detection alongside network traffic. With Traceeshark, […]

Traceeshark: Open-source plugin for Wireshark Read More »

How network segmentation can strengthen visibility in OT networks

communication, cybersecurity, DirectDefense, Don't miss, Expert analysis, Expert corner, firewall, Hot stuff, network, News, opinion, Risk Management, strategy, vulnerability management /

How network segmentation can strengthen visibility in OT networks 2024-08-08 at 07:31 By Help Net Security What role does the firewall play in the protection of operational technology (OT) networks and systems? Many would say that it’s the defensive mechanism to protect that environment from IT and the outside world. For the operators responsible for […]

How network segmentation can strengthen visibility in OT networks Read More »

AI security 2024: Key insights for staying ahead of threats

Artificial Intelligence, cybersecurity, Don't miss, Features, generative AI, Hot stuff, News, opinion, regulation, Risk Management, Robust Intelligence /

AI security 2024: Key insights for staying ahead of threats 2024-08-08 at 07:01 By Mirko Zorz In this Help Net Security interview, Kojin Oshiba, co-founder of Robust Intelligence, discusses his journey from academic research to addressing AI security challenges in the industry. Oshiba highlights vulnerabilities in technology systems and the proactive measures needed to mitigate […]

AI security 2024: Key insights for staying ahead of threats Read More »

Securing against GenAI weaponization

CISO, cybersecurity, Don't miss, generative AI, Hot stuff, News, Opaque, strategy, tips, Video /

Securing against GenAI weaponization 2024-08-08 at 06:31 By Help Net Security In this Help Net Security video, Aaron Fulkerson, CEO of Opaque, discusses how the weaponization of generative AI (GenAI) has made existing data privacy practices (like masking, anonymization, tokenization, etc.) obsolete. Fulkerson provides recommendations for companies to realize they must proactively plan to mitigate […]

Securing against GenAI weaponization Read More »

CrowdStrike engages external experts, details causes of massive outage

CrowdStrike, Don't miss, EFF, Endpoint Security, Hot stuff, Microsoft, News, product testing, security review /

CrowdStrike engages external experts, details causes of massive outage 2024-08-07 at 16:01 By Zeljka Zorz CrowdStrike has published a technical root cause analysis of what went wrong when a content update pushed to its Falcon sensors borked over 8.5 million Windows machines around the world on July 19, and has confirmed that it has hired […]

CrowdStrike engages external experts, details causes of massive outage Read More »

Roundcube flaws allow easy email account compromise (CVE-2024-42009, CVE-2024-42008)

CVE, Don't miss, email security, Hot stuff, News, Roundcube, security update, SonarSource, vulnerability /

Roundcube flaws allow easy email account compromise (CVE-2024-42009, CVE-2024-42008) 2024-08-07 at 12:01 By Zeljka Zorz Two cross-site scripting vulnerabilities (CVE-2024-42009, CVE-2024-42008) affecting Roundcube could be exploited by attackers to steal users’ emails and contacts, email password, and send emails from their account. About the vulnerabilities Roundcube is an open-source webmail software solution popular with European […]

Roundcube flaws allow easy email account compromise (CVE-2024-42009, CVE-2024-42008) Read More »

OpenWrt dominates, but vulnerabilities persist in OT/IoT router firmware

Don't miss, Finite State, Forescout, hardware, Hot stuff, Internet of Things, News, patching, report, router, survey, vulnerability assessment /

OpenWrt dominates, but vulnerabilities persist in OT/IoT router firmware 2024-08-07 at 09:16 By Help Net Security Forescout has published a new report examining the current state of the software supply chain in OT/IoT routers. The study uncovered that OT and IoT cellular routers and those used in small offices and homes contain outdated software components […]

OpenWrt dominates, but vulnerabilities persist in OT/IoT router firmware Read More »

Sports venues must vet their vendors to maintain security

cyberattacks, cybersecurity, DDoS, Don't miss, Expert analysis, Expert corner, Hot stuff, News, opinion, strategy, supply chain, Verizon /

Sports venues must vet their vendors to maintain security 2024-08-07 at 07:31 By Help Net Security Sporting events generate a lot of consumer activity, from hotels and restaurants to retail. Large sporting events are held together by webs of connectivity that include vendors, sponsors, employees, and consumers. These networks connect ticketing, merchandising, venue access, live […]

Sports venues must vet their vendors to maintain security Read More »

RustScan: Open-source port scanner

Docker, Don't miss, GitHub, Hot stuff, News, open source, penetration testing, scanning, software /

RustScan: Open-source port scanner 2024-08-07 at 07:01 By Help Net Security RustScan is an open-source port scanner designed for speed and versatility. It combines a sleek interface with the power to adapt and improve over time. With RustScan’s Adaptive Learning, the tool continually optimizes its performance, making it the most efficient port scanner available. Discover […]

RustScan: Open-source port scanner Read More »

Breaking down FCC’s proposal to strengthen BGP security

BGP, cybersecurity, Don't miss, Features, Hot stuff, ISP, Kentik, network, News, opinion, Risk Management, security standard /

Breaking down FCC’s proposal to strengthen BGP security 2024-08-07 at 06:31 By Mirko Zorz In this Help Net Security interview, Doug Madory, Director of Internet Analysis at Kentik, discusses the FCC’s proposal requiring major U.S. ISPs to implement RPKI Route Origin Validation (ROV), and addresses concerns about the impact on smaller ISPs and the global […]

Breaking down FCC’s proposal to strengthen BGP security Read More »

Ransomware gang targets IT workers with new RAT maquerading as IP scanner

Don't miss, enterprise, Hot stuff, News, Quorum Cyber, Ransomware, Remote Access Trojan /

Ransomware gang targets IT workers with new RAT maquerading as IP scanner 2024-08-06 at 16:31 By Zeljka Zorz Ransomware-as-a-service outfit Hunters International is wielding a new remote access trojan (RAT). “The malware, named SharpRhino due to its use of the C# programming language, is delivered through a typosquatting domain impersonating the legitimate tool Angry IP […]

Ransomware gang targets IT workers with new RAT maquerading as IP scanner Read More »

ITSM concerns when integrating new AI services

Artificial Intelligence, cybersecurity, Don't miss, Expert analysis, Expert corner, Hot stuff, InvGate, ITSM, LLMs, News, opinion /

ITSM concerns when integrating new AI services 2024-08-06 at 07:31 By Help Net Security Let’s talk about a couple of recent horror stories. Late last year, a Chevrolet dealership deployed a chatbot powered by a large language model (LLM) on their homepage. This LLM, trained with detailed specifications of Chevrolet vehicles, was intended to respond […]

ITSM concerns when integrating new AI services Read More »

Scaling data security solutions: What you need to know

Bedrock Security, Compliance, cybersecurity, data, Data Protection, Don't miss, Features, framework, Hot stuff, News, opinion /

Scaling data security solutions: What you need to know 2024-08-06 at 07:01 By Mirko Zorz In this Help Net Security interview, Bruno Kurtic, President and CEO at Bedrock Security, discusses the role of data visibility in enhancing cybersecurity. He explains that effective data visibility involves discovering, classifying, and contextualizing data, which helps organizations understand and […]

Scaling data security solutions: What you need to know Read More »

Whitepaper: Tools to tackle the multicloud environment

Don't miss, Hot stuff, ISC2, News, Whitepapers and webinars /

Whitepaper: Tools to tackle the multicloud environment 2024-08-06 at 05:46 By Help Net Security Implementing multicloud solutions is becoming increasingly paramount for organizations seeking to drive their business forward in the coming years. As a result, the role of cloud security is evolving. Cloud providers often use different security models with varying responsibilities and compliance […]

Whitepaper: Tools to tackle the multicloud environment Read More »

Critical Apache OFBiz pre-auth RCE flaw fixed, update ASAP! (CVE-2024-38856)

Apache OFBiz, CVE, Don't miss, enterprise, Hot stuff, News, open source, SonicWall, vulnerability /

Critical Apache OFBiz pre-auth RCE flaw fixed, update ASAP! (CVE-2024-38856) 2024-08-05 at 16:47 By Zeljka Zorz CVE-2024-38856, an incorrect authorization vulnerability affecting all but the latest version of Apache OFBiz, may be exploited by remote, unauthenticated attackers to execute arbitrary code on vulnerable systems. About CVE-2024-38856 Apache OFBiz is an open-source framework for enterprise resource […]

Critical Apache OFBiz pre-auth RCE flaw fixed, update ASAP! (CVE-2024-38856) Read More »

Chinese hackers compromised an ISP to deliver malicious software updates

APT, cyber espionage, DNS, Don't miss, ESET, Hot stuff, ISP, Malware, News, supply chain compromise, Symantec, Volexity /

Chinese hackers compromised an ISP to deliver malicious software updates 2024-08-05 at 13:46 By Zeljka Zorz APT StormBamboo compromised a undisclosed internet service provider (ISP) to poison DNS queries and thus deliver malware to target organizations, Volexity researchers have shared. Malware delivery via automatic software updates StormBamboo (aka Evasive Panda, aka StormCloud), a Chinese-speaking threat […]

Chinese hackers compromised an ISP to deliver malicious software updates Read More »

Scroll to Top