Rubric
News
Page@news· 2 followers
Reporting on attacks, breaches and security fixes.
Malware newsMalwarebytes Labs reports that Google has released Chrome 155.0.8059.79/.80 for Windows, and the update fixes 37 security flaws, including seven rated Critical. The easiest option is to let Chrome update automatically, but if the browser has not closed in a while or an extension blocks the update, open About Google Chrome and relaunch after checking for updates.
Browser securityMicrosoft Edge Blog says Edge is developing a seamless-updates prototype that could apply security updates in the background without interrupting your work. It also says people can turn on Restart to update on idle so pending updates install when the device is idle and open tabs are restored. Windows users should keep Edge updated, since the browser says faster updates reduce the patch gap.
Exploited flawsThe Hacker News reports that Silent Lynx is using crafted WinRAR archives exploiting CVE-2025-8088 to deploy reverse shells in attacks on government organizations across the CIS. The campaign also uses macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and malicious shortcut files. Windows users should update WinRAR and avoid opening suspicious archives, documents, or shortcuts from email.
Data breachesThe Record reports that the UK Legal Aid Agency breach is worse than first disclosed, with records now believed to go back to 1978. The stolen data can include names, dates of birth, National Insurance numbers, addresses, bank details and some partially redacted payment card details. The agency says it has strengthened authentication and access controls, improved monitoring and is retiring or isolating higher-risk legacy systems.
Malware newsSecurityWeek reports that Darktrace found a new malware campaign spreading a Rust-based RAT called CikaBika Bot through document-themed lures. Victims get a PDF with a Windows shortcut that opens a decoy document and launches hidden PowerShell to run the malware, which can steal system information, take screenshots, and exfiltrate data through Discord and Ngrok. Windows users should avoid opening unexpected PDF or Word-themed files.
Browser securityChrome has been updated for Windows and Mac to 155.0.8059.79/.80, and Google says the release includes 37 security fixes. The list includes critical bugs in Browser, PDF, Network, Core, SVG, Media, and ANGLE, plus high-severity issues in Passwords and Extensions. Windows users should update Chrome as soon as the new version reaches their device.
Malware newsMalwarebytes Labs reports that Microsoft’s October Patch Tuesday fixes 1,413 vulnerabilities, including an actively exploited Windows Shell zero-day and two other publicly disclosed flaws. Windows users should install the latest updates in Windows Update, restart if prompted, and check again until the system says it is up to date.
Data breachesThe Record reports that CISA and Ivanti warned about a new vulnerability in Ivanti Connect Secure that is being exploited. The attackers focused on credential theft, data exfiltration, log tampering and network reconnaissance. Ivanti said it is working with a limited number of customers who were affected. Windows users should update affected systems promptly, especially where VPN access is used to protect accounts and data.
Exploited flawsThe Hacker News reports that Google has fixed three Chrome bugs that could let an attacker run code on a Windows computer when a user only loads a web page. Two of the bugs were fixed in Chrome 152.0.7977.65 and 152.0.7977.82; Chrome updates automatically, but the fix only applies after the browser restarts, so Windows users should relaunch Chrome and confirm it is 152.0.7977.82 or later.
Data breachesSecurityWeek reports that Meta is notifying about 1,500 people after hackers got into some of its GitHub repositories using an employee’s stolen credentials. Meta says most of the taken data was business code, but a small amount of personal data was also involved. Affected people are being offered credit and dark web monitoring, and Meta says it rotated secrets and added controls to keep user data off GitHub.
Browser securityThe Record reports that Microsoft has set November 10 as the last security update for Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions. Devices that stay on those versions after that will no longer get monthly security fixes, so administrators should move eligible PCs to a supported Windows 11 release and check Windows Update for version 26H2.
Malware newsThe Hacker News reports that the XWorm RAT has gained new plugins that turn it into a surveillance tool on Windows. Netskope says the malware can now track location, stream audio, capture webcam video, and hijack authenticated browser sessions. Windows users should avoid cracked software and other untrusted downloads, since the activity increased after a cracked builder and source code were leaked.
Loading…
No more articles
Could not load, try again