Automated Cybercampaign Creates Masses of Bogus Software Building Blocks
An automated attack within the NuGet open source ecosystem for .NET developers has resulted in a flood of malicious packages containing links to phishing campaigns.
That's according to a joint...
CSAF Is the Future of Vulnerability Management
Today, nearly every party that issues security advisories uses its own format and structure. Plus, most security advisories are only human-readable, not machine-readable.System administrators have to read each advisory,...
Microsoft-Signed Malicious Drivers Usher In EDR-Killers, Ransomware
Malicious drivers certified by Microsoft's Windows Hardware Developer Program have been used to juice post-exploitation efforts by cybercriminals, Redmond warned this week — including being used as part of...
Wiz debuts PEACH tenant isolation framework for cloud applications
Cloud security vendor Wiz has announced PEACH, a tenant isolation framework for cloud applications designed to evaluate security posture and outline areas of improvement. The firm stated that the...
Microsoft Squashes Zero-Day, Actively Exploited Bugs in Dec. Update
Microsoft has released fixes for 48 new vulnerabilities across its products, including one that attackers are actively exploiting and another that has been publicly disclosed but is not under...
Prevent Secret Leaks: Find and Secure Secrets Across Your Repositories and Pipelines
Developers use secrets to enable their applications to securely communicate with other services. Hardcoding credentials (like usernames and passwords) simplifies development and saves time. Unfortunately, version control systems (VCS)...
Hackers Score Nearly $1M at Device-Focused Pwn2Own Contest
Security researchers and hackers demonstrated 63 zero-day vulnerabilities in popular devices at the latest Pwn2Own, exploiting printers from Canon, HP, and Lexmark, and routers and network-attached storage device from...
Security Flaw in Atlassian Products Affecting Multiple Companies
BENGALURU, December 13, 2022 — Researchers at CloudSEK observed that for Atlassian products - Jira, Confluence, and BitBucket, cookies are not invalidated, even if the password is changed, with...
Hackers copied Mango Markets attacker’s methods to exploit Lodestar — CertiK
Blockchain security company CertiK has shared a post-mortem analysis of the $5.8 million Lodestar Finance exploit that occurred on Dec. 10:5. The hacker burned a little over 3 million...
Metaparasites & the Dark Web: Scammers Turn on Their Own
Cybercriminals are often seen as parasites, feeding off a wide swath of victims of every size and stripe. But as it turns out, they've become targets in their own...
