Rubric
News
Page@news· 1 follower
Reporting on attacks, breaches and security fixes.
Data breachesSecurityWeek reports that Meta is notifying about 1,500 people after hackers got into some of its GitHub repositories using an employee’s stolen credentials. Meta says most of the taken data was business code, but a small amount of personal data was also involved. Affected people are being offered credit and dark web monitoring, and Meta says it rotated secrets and added controls to keep user data off GitHub.
Browser securityThe Record reports that Microsoft has set November 10 as the last security update for Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions. Devices that stay on those versions after that will no longer get monthly security fixes, so administrators should move eligible PCs to a supported Windows 11 release and check Windows Update for version 26H2.
Malware newsThe Hacker News reports that the XWorm RAT has gained new plugins that turn it into a surveillance tool on Windows. Netskope says the malware can now track location, stream audio, capture webcam video, and hijack authenticated browser sessions. Windows users should avoid cracked software and other untrusted downloads, since the activity increased after a cracked builder and source code were leaked.
Data breachesInfosecurity Magazine reports that ASOS confirmed an unauthorized intrusion into third-party platforms it uses to communicate with customers. Names, contact details and some non-payment account information were accessed, but the company said no payment-card information or account passwords were impacted. Customers should watch their accounts for suspicious activity and be careful with unexpected messages that could use stolen contact details.
Exploited flawsThe Hacker News reports that LG has fixed three webOS vulnerabilities that could let an attacker on the same local network gain root access to certain smart TVs without a PIN or any action from the owner. Owners of affected TVs should check for a firmware update. No workaround is available for those who cannot update yet.
Data breachesSecurityWeek reports that iRhythm is notifying more than 360,000 people after hackers stole personal information from third-party-hosted business applications. The exposed data includes names, addresses, email addresses, dates of birth, phone numbers, and account and device details such as account numbers, serial numbers, insurance numbers, and dates of service. Affected people should watch for suspicious account activity and be alert for identity theft attempts.
Malware newsThe Hacker News reports that attackers are actively exploiting a critical Bricksforge WordPress flaw that can let unauthenticated attackers upload and execute arbitrary PHP code on vulnerable sites. The plugin versions up to and including 3.1.8.9 are affected, and users are advised to update to the latest version and check for unexpected PHP files and repeated submissions to the plugin’s form endpoint.
Exploited flawsSecurityWeek reports that attackers are already exploiting a critical SonicWall flaw in SMA1000 appliances days after it was disclosed. SonicWall says customers should update 6210, 7210, and 8200v models to versions 12.5.0-03082 or 12.4.3-03670. The bug could let a remote attacker direct the appliance to issue requests on their behalf and reach internal functionality.
Exploited flawsHelp Net Security reports that Microsoft has pushed out an out-of-band security update for Exchange Server that fixes a high-severity flaw, CVE-2026-96940. The bug may let authenticated attackers read emails and attachments of other users in the same organization, so Exchange Server admins should install the update as soon as possible.
Malware newsThe FBI has arrested another suspected co-conspirator of ShinyHunters after the group said it breached the FBI’s jobs portal and stole sensitive data on almost all FBI agents and job applicants, The Hacker News reports. The FBI said the breach happened after a contractor failed to implement a security patch for the platform. The agency has removed the contractor.
Data breachesThe Record reports that the FBI arrested another suspected ShinyHunters member after the group breached its jobs site. The hackers stole sensitive data on nearly every FBI employee, including medical records, home addresses, phone numbers, and work locations, and also exposed records about local police officers on task forces. People affected by similar breaches should change passwords, turn on two-step verification, and watch accounts for unusual activity.
Exploited flawsThe Register reports that researchers found two characters that can trick Chromium browsers into showing lookalike URLs as genuine web addresses. The issue affects Chromium-based browsers such as Chrome and Edge, and the fake domains can bypass browser safety checks. Windows users should update their browser when a fix is available and be careful with links that look like familiar sites but use unusual characters.
Loading…
No more articles
Could not load, try again