Information

27 Oct

F5 Warns of Critical Remote Code Execution Vulnerability in BIG-IP

Information, News

Security and application delivery solutions provider F5 on Thursday warned customers of a critical-severity vulnerability in its BIG-IP product. Tracked as CVE-2023-46747 (CVSS score of 9.8) and impacting the Traffic Management User Interface of the solution, the vulnerability allows an unauthenticated attacker to execute arbitrary code remotely. “This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. There…

Read More
27 Oct

Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers

Information

ESET Research ESET Research recommends updating Roundcube Webmail to the latest available version as soon as possible Matthieu Faou 25 Oct 2023  •  , 5 min. read ESET Research has been closely tracking the cyberespionage operations of Winter Vivern for more than a year and, during our routine monitoring, we found that the group began exploiting a zero-day XSS vulnerability in the Roundcube Webmail server on October 11th, 2023. This is a different vulnerability than…

Read More
26 Oct

Critical Mirth Connect Vulnerability Could Expose Sensitive Healthcare Data

Information, News

Open source data integration platform Mirth Connect is affected by a remote code execution vulnerability that can be exploited without authentication, cybersecurity firm Horizon3.ai warns. Developed by NextGen HealthCare, Mirth Connect is a cross-platform interface engine that healthcare organizations rely on for information management. Tracked as CVE-2023-43208, the newly disclosed issue is a bypass for a critical-severity RCE flaw (CVE-2023-37679, CVSS score of 9.8) that was disclosed in August 2023 and which was addressed with…

Read More
25 Oct

‘YoroTrooper’ Espionage Group Linked to Kazakhstan

Information, News

The YoroTrooper espionage group likely consists of individuals from Kazakhstan, Cisco’s Talos security researchers report. Active since at least June 2022 and initially detailed in March this year, YoroTrooper has been observed targeting government entities in Azerbaijan, Kyrgyzstan, Tajikistan, and other Commonwealth of Independent States (CIS) countries. According to Cisco’s latest report on the advanced persistent threat (APT) actor, the operations appear to be conducted by individuals from Kazakhstan, based on the use of Kazakh…

Read More
25 Oct

One login to rule them all: Should you sign in with Google or Facebook on other websites?

Information

Digital Security Why use and keep track of a zillion discrete accounts when you can log into so many apps and websites using your Facebook or Google credentials, right? Not so fast. What’s the trade-off? André Lameiras 23 Oct 2023  •  , 6 min. read “Continue with Google” – such a seamless way to sign up for and log into a website or app, especially since you likely are already logged into your Google account.…

Read More
24 Oct

Personal Information Stolen in City of Philadelphia Email Hack

Data Breaches, Information, News

The City of Philadelphia has revealed that the information of certain individuals was stolen in a cyberattack earlier this year. The malicious activity, the city says in an incident notification (PDF) on its website, was initially identified on May 24, and involved its email environment. According to the city, the investigation into the matter has revealed that an unauthorized party had access to certain city email accounts between May 26 and July 28, and that…

Read More
23 Oct

China Crackdown on Cyber Scams in Southeast Asia Nets Thousands but Leaves Networks Intact

Information, News

Zhang Hongliang, a former restaurant manager in central China, took various gigs in and outside China to support his family after losing his job during the COVID-19 pandemic. In March, a job offer to teach Chinese cooking at a restaurant led him into a cyber scam compound in Myanmar, where he was instead ordered to lure Chinese into giving up their savings for fake investment schemes via social media platforms. Zhang is one of tens…

Read More
23 Oct

NJ Man Hired Online to Firebomb, Shoot at Homes Gets 13 Years in Prison

Information, Insights

A 22-year-old New Jersey man has been sentenced to more than 13 years in prison for participating in a firebombing and a shooting at homes in Pennsylvania last year. Patrick McGovern-Allen was the subject of a Sept. 4, 2022 story here about the emergence of “violence-as-a-service” offerings, where random people from the Internet hire themselves out to perform a variety of local, physical attacks, including firebombing a home, “bricking” windows, slashing tires, or performing a…

Read More
22 Oct

Spearphishing targets in Latin America – Week in security with Tony Anscombe

Information

Video ESET’s analysis of cybercrime campaigns in Latin America reveals a notable shift from opportunistic crimeware to more complex threats, including those targeting enterprises and governments 20 Oct 2023 This week, ESET researchers announced the release of a report that looked at more than a dozen publicly documented malicious campaigns targeting Latin America between 2019 and 2023. Over the past few years, there has been a notable rise in both the number and complexity of…

Read More
21 Oct

Strengthening the weakest link: top 3 security awareness topics for your employees

Information

Business Security Knowledge is a powerful weapon that can empower your employees to become the first line of defense against threats Phil Muncaster 19 Oct 2023  •  , 5 min. read It’s Cybersecurity Awareness Month (CSAM) time again this October. This is an awareness-raising initiative that spans both consumer and corporate worlds, although there’s plenty of crossover: every employee is also a consumer, after all. In fact, as we increasingly work from home or our…

Read More