‘Tens of thousands of QNAP devices still waiting to be patched’
The devices have an SQL injection vulnerability that can easily be exploited remotely.
"Tens of thousands" of QNAP network-attached storage (NAS) devices are at risk, still waiting to be patched against a critical security flaw, according to a report in BleepingComputer.
The vulnerability is ... Read more
Massive leak of Yandex code reveals 1922 search ranking factors
The Russian tech giant was quick to assure everyone that they had not been hacked.
This week Ars Technica reported that 44.7GB of source code files leaked source code have revealed the underpinnings of Russian tech giant Yandex's many apps and services. The files had been stolen by a former empl... Read more
KeePass disputes discovery of a vulnerability that allows password theft
The KeePass team, which created the popular open-source password management software, is disputing a recent discovery of a vulnerability in their software. According to the vulerability report it's possible to steal passwords by exploiting it.
KeePass helps users store their passwords in a loca... Read more
Horizon3 discovers new exploit VMware vRealize Log Insight
Security researchers from security testing organization Horizon3 have discovered a new exploit for VMware vRealize Log Insight appliances. This exploit combines a number of previously found and patched vulnerabilities into a new exploit that can remotely execute code as root.
Security specialist... Read more
CISA is renewing its warning about attacks leveraging RMM tools
The US Cybersecurity and Infrastructure Security Agency (CISA) is sounding the alarm about a significant threat that's been brewing for a while now - the malicious use of remote management tools.
Last fall, a massive cyberattack campaign used legitimate remote management software, which was quit... Read more
15-year-old Python bug puts 350,000 open-source projects at risk
Researchers at Trellix said they have patched nearly 62,000 open-source projects susceptible to a 15-year-old path traversal vulnerability in the Python ecosystem.
The bug, tracked under CVE-2007-4559, was discovered by Trellix's team in Python’s tarfile module late last year. It was first rep... Read more
Microsoft “strongly urges” admins to update their Exchange Servers
Unpatched servers make a tantalizing target for hackers, according to Microsoft.
This week Microsoft urged customers to keep their on-premises Exchange servers patched by applying the latest supported Cumulative Update (CU) to have them always ready to deploy an emergency security update.
Th... Read more
‘FBI and Europol take down ransomware group Hive’
Hive's infrastructure is down. Europol claims the ransomware group was tackled by a partnership of Dutch, German and US authorities.
"The FBI seized this site as part of a coordinated law enforcement action", reads the banner referred to by Hive's website since Thursday. The statement is signed ... Read more
‘Dutch hacker steals personal data of millions of Austrian citizens’
The Amsterdam Prosecutor's Office disclosed that a 25-year-old Dutch man was arrested in late November on suspicion of stealing personal data from tens of millions of people worldwide, including most of Austria's population.
The data was allegedly offered for sale. The cybercriminal landed on t... Read more
ServiceNow invests $25 million in Snyk
ServiceNow announced a strategic investment in Snyk. The startup focuses on helping developers detect and fix code vulnerabilities. The Wall Street Journal reported that the investment is worth $25 million.
ServiceNow's investment isn't just about the money. The company also built an integration... Read more