October 2024

Arc browser launches bug bounty program after fixing RCE bug

Zimbra RCE Vuln Under Attack Needs Immediate Patching

Indiana Man Pleads Guilty to Conspiracies Involving Cyber Intrusion and $37 Million Cryptocurrency Theft

4 Ways to Fight AI-Based Fraud

North Korea's 'Stonefly' APT Swarms US Private Co's. for Profit

NSA Releases 6 Principles of OT Cybersecurity

Recently patched CUPS flaw can be used to amplify DDoS attacks

Thousands of DrayTek Routers at Risk From 14 Vulnerabilities

Dutch police breached by a state actor

White House official says insurance companies must stop funding ransomware payments, but that’s not an official directive

Hezbollah data breach leads the list of the biggest cybersecurity events of the year

MITRE Launches AI Incident Sharing Initiative

MoneyGram: No evidence ransomware is behind recent cyberattack

WordPress LiteSpeed Cache plugin flaw could allow site takeover

CosmicSting (CVE-2024-34102) Vulnerability Under Active Exploitation

China-linked group Salt Typhoon hacked US broadband providers and breached wiretap systems

Comcast and Truist Bank customers caught up in FBCS data breach

Man pleads guilty to stealing $37 million in crypto from 571 victims

MoneyGram confirms hackers stole customer data in cyberattack

ADT discloses second breach in 2 months, hacked via stolen credentials

LEGO's website hacked to push cryptocurrency scam

Patch Tuesday, October 2024 Edition

Ex-Uber CISO Requests a New, 'Fair' Trial

5 CVEs in Microsoft's October Update to Patch Immediately

Internet Archive hacked, data breach impacts 31 million users

CISA says critical Fortinet RCE flaw now exploited in attacks

Introducing Mayhem: ForAllSecure Unveils New Name and Company Focus

Ukraine arrests rogue VPN operator providing access to Runet

Akira and Fog ransomware now exploit critical Veeam RCE flaw

Critical Mozilla Firefox Zero-Day Allows Code Execution

AI Hype Drives Demand For ML SecOps Skills

SOC Teams: Threat Detection Tools Are Stifling Us

Certificate Authority Market Size to Surpass $485M by 2033

Microsoft deprecates PPTP and L2TP VPN protocols in Windows Server

A cyber attack hit Iranian government sites and nuclear facilities

OpenAI confirms threat actors use ChatGPT to write malware

Google warns uBlock Origin and other extensions may be disabled soon

Iranian hackers now exploit Windows flaw to elevate privileges

SECURITY AFFAIRS MALWARE NEWSLETTER – ROUND 15

Serious Adversaries Circle Ivanti CSA Zero-Day Flaws

New FASTCash malware Linux variant helps steal money from ATMs

Pokémon Gaming Company Employee Info Leaked in Hack

North Korea Hackers Get Cash Fast in Linux Cyber Heists

Amazon says 175 million customer now use passkeys to log in

Cybercriminals Are Increasingly Helping Russia and China Target the US and Allies, Microsoft Says

Iranian hackers act as brokers selling critical infrastructure access

Brazil’s Polícia Federal arrested the notorious hacker USDoD

Google: 70% of exploited flaws disclosed in 2023 were zero-days

Microsoft warns it lost some customer's security logs for a month

Russia-linked RomCom group targeted Ukrainian government agencies since late 2023

Fake Google Meet conference errors push infostealing malware

Cisco takes DevHub portal offline after hacker publishes stolen data

MacOS Safari 'HM Surf' Exploit Exposes Camera, Mic, Browser Data

Iran-linked actors target critical infrastructure organizations

U.S. CISA adds Veeam Backup and Replication flaw to its Known Exploited Vulnerabilities catalog

Microsoft creates fake Azure tenants to pull phishers into honeypots

North Korea-linked APT37 exploited IE zero-day in a recent attack

Cyprus Thwarted a Digital Attack Against the Government’s Main Online Portal

Severe flaws in E2EE cloud storage platforms used by millions

Internet Archive breached again through stolen access tokens

Hackers exploit Roundcube webmail flaw to steal email, credentials

Unmanaged Cloud Credentials Pose Risk to Half of Orgs

Cisco Disables DevHub Access After Security Breach

CISA proposes new security requirements to protect govt, personal data

Samsung Zero-Day Vuln Under Active Exploit, Google Warns

Honeywell and Google Cloud to Accelerate Auto Operations With AI Agents for the Industrial Sector

Lazarus Group Exploits Chrome Zero-Day in Latest Campaign

Fortinet Confirms Zero-Day Exploit Targeting FortiManager Systems

Russian Trolls Pose as Reputable Media to Sow US Election Chaos

Apple creates Private Cloud Compute VM to let researchers find bugs

AWS's Predictable Bucket Names Make Accounts Easier to Crack

Henry Schein discloses data breach a year after ransomware attack

LinkedIn Hit With $335M Fine for Data Privacy Violations

Black Basta ransomware poses as IT support on Microsoft Teams to breach networks

Four members of REvil sentenced by Russian court

Italy police arrest four over alleged illegal database access, source says

New Cisco ASA and FTD features block VPN brute-force password attacks

Chinese cyber spies targeted phones used by Trump and Vance

Windows 11 24H2: The hardware and software blocking the new update

In legal first, Japan convicts man of abusing AI to generate ransomware

Fog ransomware targets SonicWall VPNs to breach corporate networks

School ransomware attacks are on the rise. What can districts do?

Sophos-SecureWorks Deal Focuses on Building Advanced MDR, XDR Platform

Texas county says 47,000 had SSNs, medical treatment info leaked during May cyberattack

Recurring Windows Flaw Could Expose User Credentials

International law enforcement operation dismantled RedLine and Meta infostealers

China's 'Evasive Panda' APT Debuts High-End Cloud Hijacking

Summit Pathology Laboratories notified 1.8 million patients of a breach. Less than 48 hours later, they were sued.

White House Outlines AI's Role in National Security

Interbank confirms data breach following failed extortion, data leak

HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation for $90,000

Sophos reveals 5-year battle with Chinese hackers attacking network devices

Facebook Businesses Targeted in Infostealer Phishing Campaign