FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

Ransomware Survey 2022 – like the Curate’s Egg, “good in parts”

By Paul Ducklin
You might not like the headline statistics in this year's ransomware report... but that makes it even more important to take a look!

QNAP warns of new bugs in its Network Attached Storage devices

By Paul Ducklin
Here's what you need to know - plus some sensible advice for all the devices on your home or small biz network!

nas-1200

Critical cryptographic Java security blunder patched – update now!

By Paul Ducklin
Either know the private key and use it scrupulously in your digital signature calculation.... or just send a bunch of zeros instead.

Beanstalk cryptocurrency heist: scammer votes himself all the money

By Paul Ducklin
Voting safeguards based on commuity collateral don't work if one person can use a momentary loan to "become" 75% of the community.

Yet another Chrome zero-day emergency update – patch now!

By Paul Ducklin
The third emergency Chrome 0-day in three months - the first one was exploited by North Korea, so you might as well get this one ASAP.

Hospital robot system gets five critical security holes patched

By Paul Ducklin
Fortunately, we're not talking about a robot revolution, or about hospital AI run amuck. But these bugs could lead to ransomware, or worse...

Popular Ruby Asciidoc toolkit patched against critical vuln – get the update now!

By Paul Ducklin
A rogue line-continuation character can trick the code into validating just the second half of the line, but executing all of it.

ruby-1200

Firefox 99 is out – no major bugs, but update anyway!

By Paul Ducklin
Firefox's four-weekly updates just dropped - here's what you need to know.

Google’s monthly Android updates patch numerous “get root” holes

By Paul Ducklin
Get the update now... if it's available for your phone. Here's how to check.

android-1200

Apple pushes out two emergency 0-day updates – get ’em now!

By Paul Ducklin
More Apple zero-days - mobile devices, laptops and desktops affected. Update now!

apple-1200

Google Chrome patches mysterious new zero-day bug – update now

By Paul Ducklin
CVE-2022-1096 - another mystery in-the-wild 0-day in Chrome... check your version now!

Serious Security: DEADBOLT – the ransomware that goes straight for your backups

By Paul Ducklin
Some tips on how to keep your network safe - even (or perhaps especially!) if you think you're safe already.

Apple patches 87 security holes – from iPhones and Macs to Windows

By Paul Ducklin
Lots of fixes, with data leakage flaws and code execution bugs patched on iPhones, Macs and even Windows.

apple-1200

“Dirty Pipe” Linux kernel bug lets anyone write to any file

By Paul Ducklin
Even read-only files can be written to, leading to a dangerously general purpose elevation-of-privilege attack.

pipe-1200

Adafruit suffers GitHub data breach – don’t let this happen to you

By Paul Ducklin
Training data stashed in GitHub by mistake... unfortunately, it was *real* data

Firefox patches two actively exploited 0-day holes: update now!

By Paul Ducklin
Firefox just published a double-zero-day patch - "remote code execution" combined with "sandbox escape". Update now!

WordPress backup plugin maker Updraft says “You should update”…

By Paul Ducklin
A straight-talking bug report written in plain English by an actual expert - there's a teachable moment in this cybersecurity story!

French speakers blasted by sextortion scams with no text or links

By Paul Ducklin
You'd spot this one a mile away... but what about your friends or family?

Irony alert! PHP fixes security flaw in input validation code

By Paul Ducklin
What's wrong with this sequence? 1. Step into the road 2. Check if it's safe 3. Keep on walki...

VMware fixes holes that could allow virtual machine escapes

By Paul Ducklin
Hats off to VMware for not using weasel words: "When should you act?" Immediately...

Google announces zero-day in Chrome browser – update now!

By Paul Ducklin
Zero-day buses: none for a while, then three at once. Here's Google joining Apple and Adobe in "zero-day week"

Adobe fixes zero-day exploit in e-commerce code: update now!

By Paul Ducklin
There's a remote code execution hole in Adobe e-commerce products - and cybercrooks are already exploiting it.

Apple zero-day drama for Macs, iPhones and iPads – patch now!

By Paul Ducklin
Sudden update! Zero-day browser hole! Drive-by malware danger! Patch Apple laptops and phones now...

apple-1200

Self-styled “Crocodile of Wall Street” arrested with husband over Bitcoin megaheist

By Naked Security writer
The cops say they've recovered 80% of a $72 million cryptocoin heist... but the recovered funds alone are now worth over $4 billion!

At last! Office macros from the internet to be blocked by default

By Paul Ducklin
It's been a long time coming, and we're not there yet, but at least Microsoft Office will be a bit safer against macro malware...

Microsoft blocks web installation of its own App Installer files

By Paul Ducklin
It's a big deal when a vendor decides to block one of its own "features" for security reasons. Here's why we think it's a good idea.

Elementor WordPress plugin has a gaping security hole – update now

By Paul Ducklin
We shouldn't need to say, "Check your inputs!" these days, but we're saying it anyway.

Linux kernel patches “performance can be harmful” bug in video driver

By Paul Ducklin
This bug is fiendishly hard to exploit - but if you patch, it won't be there to exploit at all.

Coronavirus SMS scam offers home PCR testing devices – don’t fall for it!

By Paul Ducklin
Free home PCR devices would be technological marvels, and really useful, too. But there aren't any...

Happy Data Privacy Day – and we really do mean “happy” :-)

By Paul Ducklin
We give you some simple digital lifesytle tips that cost nothing.

Apple fixes Safari data leak (and patches a zero-day!) – update now

By Paul Ducklin
That infamous "supercookie" bug in Safari has now been fixed. Oh, and there was a zero-day kernel hole as well.

apple-1200

“PwnKit” security bug gets you root on most Linux distros – what to do

By Paul Ducklin
An elevation of privilege bug that could let a "mostly harmless" user give themselves a instant root shell

Tax scam emails are alive and well as US tax season starts

By Paul Ducklin
If in doubt, don't give it out! (And don't forget that no reply is often a good reply.)

Cryptocoin broker Crypto.com says 2FA bypass led to $35m theft

By Paul Ducklin
The company has put out a brief security report that summarises the 'what', but not yet the 'how' or 'why'.

Serious Security: Apple Safari leaks private data via database API – what you need to know

By Paul Ducklin
There's a tiny data leakage bug in the WebKit browser engine... but it could act as a "supercookie" identifier for your browsing

Wormable Windows HTTP hole – what you need to know

By Paul Ducklin
One bug in the January 2022 Patch Tuesday list is getting lots of attention: "HTTP Protocol Stack Remote Code Execution Vulnerability".

Home routers with NetUSB support could have critical kernel hole

By Paul Ducklin
Got a router that supports USB access across the network? You might need a kernel update...

Log4Shell-like security hole found in popular Java SQL database engine H2

By Paul Ducklin
"It's Log4Shell, Jim, but not as we know it." How to find and fix a JNDI-based vuln in the H2 Database Engine.

FTC threatens “legal action” over unpatched Log4j and other vulns

By Paul Ducklin
Remember the Equifax breach? Remember the $700m penalty? In case you'd forgotten, here's the FTC to refresh your memory!

❌