- Security News Headlines
- Posts
- Security News Headlines #122
Security News Headlines #122
Ian Bishop
September 27, 2024
Today's cybersecurity news covers a range of important updates, including newly released patches for critical vulnerabilities, fresh insights on malware tactics, and significant data leaks. We also examine threats targeting the human factor in election security and phishing, highlight a widespread vulnerability in a WordPress plugin, and discuss updates on AI vulnerability research and password management rules. Stay informed to safeguard your systems against evolving cyber risks.
Cisco has released updates to patch vulnerabilities in IOS and IOS XE software. These updates address flaws that could allow attackers to gain control of devices or cause service disruptions. Users are urged to apply these patches immediately to protect their networks from potential exploitation.
CISA and its international partners have released a joint advisory providing guidance on detecting and mitigating active cyber threats. The document emphasizes the importance of implementing strong defensive measures, particularly against ongoing cyber campaigns that target critical infrastructure.
CISA has published five security advisories for Industrial Control Systems (ICS). These advisories address vulnerabilities in commonly used ICS software and hardware, with potential risks including unauthorized access and disruption of industrial processes. Users should review and apply necessary mitigations.
The Jupiter X Core plugin for WordPress has critical vulnerabilities impacting over 90,000 websites. These flaws allow arbitrary file uploads and authentication bypass, putting sites at risk of compromise. Site administrators are strongly advised to update the plugin to the latest version.
A new report from BlackBerry highlights emerging malware tactics used in cyberattacks. The report uncovers techniques such as stealthy fileless malware and advanced evasion strategies. Organizations are encouraged to enhance their detection capabilities to counter these sophisticated threats.
AWS provides detailed guidance on migrating 3DES encryption keys from FIPS-certified to non-FIPS CloudHSM clusters. This tutorial is designed to assist users in maintaining security while managing their cryptographic environments during the migration process.
Wiz researchers have discovered a critical vulnerability in NVIDIA’s AI infrastructure, potentially allowing attackers to exploit the system. The flaw affects AI models used in various industries, posing risks to data integrity and privacy. NVIDIA is expected to release patches soon.
An analysis by GreyNoise reveals that phishing and social engineering remain significant threats to election security. These tactics exploit human vulnerabilities, often leading to data breaches and system compromises. Increased awareness and training are crucial to mitigating these risks.
Sensitive personal data of over 3,000 U.S. Congressional staffers has been leaked on the dark web following a breach. The leaked information could be used for phishing or impersonation attacks, highlighting the importance of stronger cybersecurity protocols within government entities.
Chinese state-sponsored hackers have successfully infiltrated the U.S. internet backbone, gaining access to sensitive communications. This breach raises concerns about national security and highlights the ongoing threat posed by nation-state actors targeting critical infrastructure.
NIST has proposed eliminating outdated password rules, such as requiring frequent changes and overly complex characters, which can weaken security. The new guidelines focus on user-friendly practices that enhance password strength while reducing user fatigue and errors.
A sophisticated Chinese cyber-espionage group, known as Salt Typhoon, has been linked to recent attacks targeting government and defense sectors. The group uses advanced techniques to exfiltrate sensitive data, continuing China's efforts to gather intelligence on global adversaries.
A new NIST report suggests a framework for reporting AI vulnerabilities, addressing growing concerns over AI systems being exploited by attackers. The report underscores the need for transparent reporting mechanisms to prevent AI misuse in critical sectors.
The Necro Trojan has been detected in apps downloaded over 11 million times from official app stores. This malware steals personal information and financial data from infected devices, posing serious threats to users globally. Users should uninstall affected apps immediately.
Mozilla is facing allegations of tracking Firefox users without proper consent. Privacy advocates are raising concerns about the company’s data collection practices, sparking debate over whether user privacy is adequately protected in one of the most popular web browsers.
Cisco Talos researchers have identified a denial-of-service (DoS) vulnerability in Microsoft's Audio Bus driver. This flaw could allow attackers to crash systems or execute remote code, necessitating immediate patches to prevent potential exploitation.
A new Lumma Stealer malware campaign is targeting fans of the League of Legends World Championship through social media ads. The malware steals sensitive information, including credentials and payment data. Fans are advised to avoid suspicious links and ads.
AWS shares best practices for transitioning identity sources within AWS IAM Identity Center. The guide helps users ensure a smooth migration while maintaining security and access controls, crucial for managing identity in large, complex environments.
Reply