Risk of security incidents due to supply chain increases
The risk that companies are faced with a cyber incident due to a relationship with a supplier or "fourth party" in the supply chain is increasing. This according to SecurityScorecard and The Cyentia Institute in a joint study.
The survey found that 98 percent of companies surveyed have a relatio... Read more
‘Tens of thousands of QNAP devices still waiting to be patched’
The devices have an SQL injection vulnerability that can easily be exploited remotely.
"Tens of thousands" of QNAP network-attached storage (NAS) devices are at risk, still waiting to be patched against a critical security flaw, according to a report in BleepingComputer.
The vulnerability is ... Read more
Massive leak of Yandex code reveals 1922 search ranking factors
The Russian tech giant was quick to assure everyone that they had not been hacked.
This week Ars Technica reported that 44.7GB of source code files leaked source code have revealed the underpinnings of Russian tech giant Yandex's many apps and services. The files had been stolen by a former empl... Read more
KeePass disputes discovery of a vulnerability that allows password theft
The KeePass team, which created the popular open-source password management software, is disputing a recent discovery of a vulnerability in their software. According to the vulerability report it's possible to steal passwords by exploiting it.
KeePass helps users store their passwords in a loca... Read more
Horizon3 discovers new exploit VMware vRealize Log Insight
Security researchers from security testing organization Horizon3 have discovered a new exploit for VMware vRealize Log Insight appliances. This exploit combines a number of previously found and patched vulnerabilities into a new exploit that can remotely execute code as root.
Security specialist... Read more
CISA is renewing its warning about attacks leveraging RMM tools
The US Cybersecurity and Infrastructure Security Agency (CISA) is sounding the alarm about a significant threat that's been brewing for a while now - the malicious use of remote management tools.
Last fall, a massive cyberattack campaign used legitimate remote management software, which was quit... Read more
15-year-old Python bug puts 350,000 open-source projects at risk
Researchers at Trellix said they have patched nearly 62,000 open-source projects susceptible to a 15-year-old path traversal vulnerability in the Python ecosystem.
The bug, tracked under CVE-2007-4559, was discovered by Trellix's team in Python’s tarfile module late last year. It was first rep... Read more
Microsoft “strongly urges” admins to update their Exchange Servers
Unpatched servers make a tantalizing target for hackers, according to Microsoft.
This week Microsoft urged customers to keep their on-premises Exchange servers patched by applying the latest supported Cumulative Update (CU) to have them always ready to deploy an emergency security update.
Th... Read more
‘FBI and Europol take down ransomware group Hive’
Hive's infrastructure is down. Europol claims the ransomware group was tackled by a partnership of Dutch, German and US authorities.
"The FBI seized this site as part of a coordinated law enforcement action", reads the banner referred to by Hive's website since Thursday. The statement is signed ... Read more
‘Dutch hacker steals personal data of millions of Austrian citizens’
The Amsterdam Prosecutor's Office disclosed that a 25-year-old Dutch man was arrested in late November on suspicion of stealing personal data from tens of millions of people worldwide, including most of Austria's population.
The data was allegedly offered for sale. The cybercriminal landed on t... Read more