FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

Firefox 101 is out, this time with no 0-day scares (but update anyway!)

By Paul Ducklin
After an intriguing month of Firefox releases, here's one with a bit less drama, probably to the collective relief of Mozilla's coders.

Mysterious “Follina” zero-day hole in Office – here’s what to do!

By Paul Ducklin
News has emerged of a "feature" in Office that has been abused as a zero-day bug to run evil code. Turning off macros doesn't help!

Poisoned Python and PHP packages purloin passwords for AWS access

By Paul Ducklin
More supply chain trouble - this time with clear examples so you can learn how to spot this stuff yourself.

Microsoft patches the Patch Tuesday patch that broke authentication

By Paul Ducklin
Remember the good old days when security patches rarely needed patches? Because security patches themlelves were rare enough anyway?

US Government says: Patch VMware right now, or get off our network

By Paul Ducklin
Find and patch. Right now. If you can't patch, get it off the network. Right now! Oh, and show us what you did to comply.

Pwn2Own hacking schedule released – Windows and Linux are top targets

By Paul Ducklin
What's better? Disclose early, patch fast? Or dig deep, disclose in full, patch more slowly?

Apple patches zero-day kernel hole and much more – update now!

By Paul Ducklin
You'll find fixes for numerous kernel-level code execution holes, including an 0-day vulnerability in many (though not all) versions.

Serious Security: Learning from curl’s latest bug update

By Paul Ducklin
Learn how to write plain-speaking and purposeful security advisories from one of the most widely-used open source tools in the world.

RubyGems supply chain rip-and-replace bug fixed – check your logs!

By Paul Ducklin
Imagine if you could assume the identity of, say, Franklin Delano Roosevelt simply by showing up and calling yourself "Frank".

ruby-1200

You didn’t leave enough space between ROSE and AND, and AND and CROWN

By Paul Ducklin
What weird Google Docs bug connects the words THEREFORE, AND, SECONDLY, WHY, BUT and BESIDES?

Android monthly updates are out – critical bugs found in critical places!

By Paul Ducklin
Android May 2022 updates are out - with some critical fixes in some critical places. Learn more...

Firefox hits 100*, fixes bugs… but no new zero-days this month

By Paul Ducklin
Despite concerns that some websites might break when Chromium and then Firefox reached version 100, the web still seems to be intact.

QNAP warns of new bugs in its Network Attached Storage devices

By Paul Ducklin
Here's what you need to know - plus some sensible advice for all the devices on your home or small biz network!

nas-1200

Critical cryptographic Java security blunder patched – update now!

By Paul Ducklin
Either know the private key and use it scrupulously in your digital signature calculation.... or just send a bunch of zeros instead.

Beanstalk cryptocurrency heist: scammer votes himself all the money

By Paul Ducklin
Voting safeguards based on commuity collateral don't work if one person can use a momentary loan to "become" 75% of the community.

Yet another Chrome zero-day emergency update – patch now!

By Paul Ducklin
The third emergency Chrome 0-day in three months - the first one was exploited by North Korea, so you might as well get this one ASAP.

Hospital robot system gets five critical security holes patched

By Paul Ducklin
Fortunately, we're not talking about a robot revolution, or about hospital AI run amuck. But these bugs could lead to ransomware, or worse...

Popular Ruby Asciidoc toolkit patched against critical vuln – get the update now!

By Paul Ducklin
A rogue line-continuation character can trick the code into validating just the second half of the line, but executing all of it.

ruby-1200

Firefox 99 is out – no major bugs, but update anyway!

By Paul Ducklin
Firefox's four-weekly updates just dropped - here's what you need to know.

Google’s monthly Android updates patch numerous “get root” holes

By Paul Ducklin
Get the update now... if it's available for your phone. Here's how to check.

android-1200

Apple pushes out two emergency 0-day updates – get ’em now!

By Paul Ducklin
More Apple zero-days - mobile devices, laptops and desktops affected. Update now!

apple-1200

Serious Security: DEADBOLT – the ransomware that goes straight for your backups

By Paul Ducklin
Some tips on how to keep your network safe - even (or perhaps especially!) if you think you're safe already.

Apple patches 87 security holes – from iPhones and Macs to Windows

By Paul Ducklin
Lots of fixes, with data leakage flaws and code execution bugs patched on iPhones, Macs and even Windows.

apple-1200

“Dirty Pipe” Linux kernel bug lets anyone write to any file

By Paul Ducklin
Even read-only files can be written to, leading to a dangerously general purpose elevation-of-privilege attack.

pipe-1200

Firefox patches two actively exploited 0-day holes: update now!

By Paul Ducklin
Firefox just published a double-zero-day patch - "remote code execution" combined with "sandbox escape". Update now!

WordPress backup plugin maker Updraft says “You should update”…

By Paul Ducklin
A straight-talking bug report written in plain English by an actual expert - there's a teachable moment in this cybersecurity story!

Irony alert! PHP fixes security flaw in input validation code

By Paul Ducklin
What's wrong with this sequence? 1. Step into the road 2. Check if it's safe 3. Keep on walki...

VMware fixes holes that could allow virtual machine escapes

By Paul Ducklin
Hats off to VMware for not using weasel words: "When should you act?" Immediately...

Google announces zero-day in Chrome browser – update now!

By Paul Ducklin
Zero-day buses: none for a while, then three at once. Here's Google joining Apple and Adobe in "zero-day week"

Adobe fixes zero-day exploit in e-commerce code: update now!

By Paul Ducklin
There's a remote code execution hole in Adobe e-commerce products - and cybercrooks are already exploiting it.

Apple zero-day drama for Macs, iPhones and iPads – patch now!

By Paul Ducklin
Sudden update! Zero-day browser hole! Drive-by malware danger! Patch Apple laptops and phones now...

apple-1200

Microsoft blocks web installation of its own App Installer files

By Paul Ducklin
It's a big deal when a vendor decides to block one of its own "features" for security reasons. Here's why we think it's a good idea.

Elementor WordPress plugin has a gaping security hole – update now

By Paul Ducklin
We shouldn't need to say, "Check your inputs!" these days, but we're saying it anyway.

Linux kernel patches “performance can be harmful” bug in video driver

By Paul Ducklin
This bug is fiendishly hard to exploit - but if you patch, it won't be there to exploit at all.

Apple fixes Safari data leak (and patches a zero-day!) – update now

By Paul Ducklin
That infamous "supercookie" bug in Safari has now been fixed. Oh, and there was a zero-day kernel hole as well.

apple-1200

“PwnKit” security bug gets you root on most Linux distros – what to do

By Paul Ducklin
An elevation of privilege bug that could let a "mostly harmless" user give themselves a instant root shell

Cryptocoin broker Crypto.com says 2FA bypass led to $35m theft

By Paul Ducklin
The company has put out a brief security report that summarises the 'what', but not yet the 'how' or 'why'.

Wormable Windows HTTP hole – what you need to know

By Paul Ducklin
One bug in the January 2022 Patch Tuesday list is getting lots of attention: "HTTP Protocol Stack Remote Code Execution Vulnerability".

Home routers with NetUSB support could have critical kernel hole

By Paul Ducklin
Got a router that supports USB access across the network? You might need a kernel update...

Log4Shell-like security hole found in popular Java SQL database engine H2

By Paul Ducklin
"It's Log4Shell, Jim, but not as we know it." How to find and fix a JNDI-based vuln in the H2 Database Engine.

FTC threatens “legal action” over unpatched Log4j and other vulns

By Paul Ducklin
Remember the Equifax breach? Remember the $700m penalty? In case you'd forgotten, here's the FTC to refresh your memory!

Log4Shell vulnerability Number Four: “Much ado about something”

By Paul Ducklin
It's a Log4j bug, and you ought to patch it. But we don't think it's a critical crisis like the last one.

❌