Rubric
News
Page@news
Reporting on attacks, breaches and security fixes.
Exploited flawsSecurityWeek reports that Citrix is urging immediate patching of a critical NetScaler vulnerability that could lead to remote code execution or denial of service. The flaw affects NetScaler ADC and NetScaler Gateway appliances in specific SAML configurations, as well as Secure Private Access Hybrid deployments. Citrix says it is not aware of unmitigated exploits, but users should update to the fixed versions as soon as possible.
Malware newsMalwarebytes Labs reports that attackers compromised infrastructure behind the .gh, .sl, and .as country-code domain namespaces and used it to obtain unauthorized HTTPS certificates for Google domains and other organizations. Google blocked the certificates in Chrome and worked with certificate authorities to revoke them. Windows users should keep their browser and operating system updated and never bypass certificate warnings.
Browser securityChrome OS has received a Long Term Support Channel update to version 150.0.7871.256. Google says it includes selected security fixes, including issues in Browser, Omnibox, Extensions, WebRTC, GPU, PDF, and other components. Devices in the LTC channel will be updated to this version, so users should install it when it arrives.
Exploited flawsSecurityWeek reports that TP-Link has disclosed five vulnerabilities in its Aginet line of ISP-managed mesh systems, routers and modems. The bugs can let an attacker on the same network take over an affected device, create a super-administrator account, enable SSH access, or recover passwords and Wi-Fi credentials from configuration files. TP-Link says firmware updates are distributed by ISPs, so users should check the device management interface or app for updates and contact their ISP if none are available.
Malware newsThe Hacker News reports that 16 malicious Firefox extensions were found posing as Rabby and OKX Wallet tools to steal cryptocurrency wallet recovery phrases and private keys. The add-ons intercepted those secrets during wallet import flows and sent them to attacker-controlled Cloudflare Workers. Users who installed any of the extensions and entered a real recovery phrase or private key should assume compromise and move their assets from a clean system.
Data breachesSecurityWeek reports that Oracle Health says personal and medical information from its legacy Cerner systems was compromised in a cyberattack. The data may have included names, Social Security numbers, and medical record details such as diagnoses, medicines, test results, images, and care information. People affected should watch for suspicious account activity and follow any notice from Oracle Health or their healthcare provider.
Data breachesSecurityWeek reports that Southern Company is notifying roughly 400,000 customers that an unauthorized third party accessed utility account information through its online customer portal. The exposed data may include names, mailing addresses, phone numbers, email addresses, the last 4 digits of Social Security numbers, and other basic account details. The company says it stopped the activity and is offering affected customers a year of free credit monitoring.
Browser securityGoogle has released Chrome 155 for Windows with 247 security fixes, including four rated critical. Google says the update will roll out over the coming days and weeks, and users can check for it in Chrome by opening the menu, then Help, then About Google Chrome, and relaunching when the download finishes.
Malware newsThe FBI and Secret Service warn that the FortiBleed credential-harvesting campaign is still active and is targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The agencies say attackers are scanning exposed devices, using stolen credentials, and may be passing access on to ransomware groups. Windows users in small offices should make sure their VPN and admin passwords are changed, active sessions are ended, and device logs are checked for suspicious activity.
Exploited flawsHelp Net Security reports that attackers have already started trying to exploit a critical arbitrary file access flaw in Atlassian’s self-managed Data Center products, including Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye. Atlassian urged customers to upgrade to a fixed version as soon as possible. Those who cannot update quickly should remove vulnerable instances from the internet or block external access, and check access logs for signs of compromise.
Data breachesInfosecurity Magazine reports that unauthorized access to Denmark’s Central Register of Persons exposed names, addresses and CPR numbers for about 8.8 million registered people. The government said the access happened through a private Danish company’s legal access to the system. People should watch for unusual account activity, use unique passwords, keep devices updated and be careful if anyone asks for sensitive information by email, phone or other channels.
Malware newsThe Hacker News reports that a malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker’s code as soon as the file is opened, without a macro warning. The attack works only when Java support is enabled. LibreOffice has already fixed the flaw, and Apache OpenOffice users should turn off Java or avoid opening spreadsheets they do not trust.
Loading…
No more articles
Could not load, try again