FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

Firefox 101 is out, this time with no 0-day scares (but update anyway!)

By Paul Ducklin
After an intriguing month of Firefox releases, here's one with a bit less drama, probably to the collective relief of Mozilla's coders.

Mysterious “Follina” zero-day hole in Office – here’s what to do!

By Paul Ducklin
News has emerged of a "feature" in Office that has been abused as a zero-day bug to run evil code. Turning off macros doesn't help!

Beware the Smish! Home delivery scams with a professional feel…

By Paul Ducklin
Home delivery scams are getting leaner, and meaner, and more likely to "look about right". Here's an example to show you what we mean...

Who’s watching your webcam? The Screencastify Chrome extension story…

By Paul Ducklin
When you really need to make exceptions in cybersecurity, specify them as explicitly as you can.

Poisoned Python and PHP packages purloin passwords for AWS access

By Paul Ducklin
More supply chain trouble - this time with clear examples so you can learn how to spot this stuff yourself.

Clearview AI face-matching service fined a lot less than expected

By Paul Ducklin
The fine has finally gone through... but it's less than 45% of what was originally proposed.

eleceye-1200

Microsoft patches the Patch Tuesday patch that broke authentication

By Paul Ducklin
Remember the good old days when security patches rarely needed patches? Because security patches themlelves were rare enough anyway?

US Government says: Patch VMware right now, or get off our network

By Paul Ducklin
Find and patch. Right now. If you can't patch, get it off the network. Right now! Oh, and show us what you did to comply.

Pwn2Own hacking schedule released – Windows and Linux are top targets

By Paul Ducklin
What's better? Disclose early, patch fast? Or dig deep, disclose in full, patch more slowly?

Apple patches zero-day kernel hole and much more – update now!

By Paul Ducklin
You'll find fixes for numerous kernel-level code execution holes, including an 0-day vulnerability in many (though not all) versions.

Firefox out-of-band update to 100.0.1 – just in time for Pwn2Own?

By Paul Ducklin
A new point-release of Firefox. Not unusual, but the timing of this one is interesting, with Pwn2Own coming up in a few days.

He sold cracked passwords for a living – now he’s serving 4 years in prison

By Paul Ducklin
Crooks don't need a password for every user on your network to break in and wreak havoc. One could be enough...

S3 Ep82: Bugs, bugs, bugs (and Colonial Pipeline again) [Podcast]

By Paul Ducklin
Latest episode - lots to learn - plain English - fun with a serious side - listen now!

Serious Security: Learning from curl’s latest bug update

By Paul Ducklin
Learn how to write plain-speaking and purposeful security advisories from one of the most widely-used open source tools in the world.

Colonial Pipeline facing $1,000,000 fine for poor recovery plans

By Paul Ducklin
How good is your cybersecurity? Are you making the same mistakes as lots of other people? Here's some real-life advice...

RubyGems supply chain rip-and-replace bug fixed – check your logs!

By Paul Ducklin
Imagine if you could assume the identity of, say, Franklin Delano Roosevelt simply by showing up and calling yourself "Frank".

ruby-1200

You didn’t leave enough space between ROSE and AND, and AND and CROWN

By Paul Ducklin
What weird Google Docs bug connects the words THEREFORE, AND, SECONDLY, WHY, BUT and BESIDES?

World Password Day – the 1960s just called and gave you your passwords back

By Paul Ducklin
Yes, passwords are going away. No, it won't happen tomorrow. So it's still worth knowing the basics of picking proper passwords.

Android monthly updates are out – critical bugs found in critical places!

By Paul Ducklin
Android May 2022 updates are out - with some critical fixes in some critical places. Learn more...

Firefox hits 100*, fixes bugs… but no new zero-days this month

By Paul Ducklin
Despite concerns that some websites might break when Chromium and then Firefox reached version 100, the web still seems to be intact.

GitHub issues final report on supply-chain source code intrusions

By Paul Ducklin
Learn how to find out which apps you've given access rights to, and how to revoke those rights immediately in an emergency.

Ransomware Survey 2022 – like the Curate’s Egg, “good in parts”

By Paul Ducklin
You might not like the headline statistics in this year's ransomware report... but that makes it even more important to take a look!

Phishing goes KISS: Don’t let plain and simple messages catch you out!

By Paul Ducklin
Sometimes we receive phishing tricks that we grudgingly have to admit are better than average, just because they're uncomplicated.

QNAP warns of new bugs in its Network Attached Storage devices

By Paul Ducklin
Here's what you need to know - plus some sensible advice for all the devices on your home or small biz network!

nas-1200

Critical cryptographic Java security blunder patched – update now!

By Paul Ducklin
Either know the private key and use it scrupulously in your digital signature calculation.... or just send a bunch of zeros instead.

Beanstalk cryptocurrency heist: scammer votes himself all the money

By Paul Ducklin
Voting safeguards based on commuity collateral don't work if one person can use a momentary loan to "become" 75% of the community.

Yet another Chrome zero-day emergency update – patch now!

By Paul Ducklin
The third emergency Chrome 0-day in three months - the first one was exploited by North Korea, so you might as well get this one ASAP.

US cryptocurrency coder gets 5 years for North Korea sanctions busting

By Naked Security writer
Cryptocurrency expert didn't take "No" for an answer when the US authorities said he couldn't pursue cryptocoin opps in North Korea.

Hospital robot system gets five critical security holes patched

By Paul Ducklin
Fortunately, we're not talking about a robot revolution, or about hospital AI run amuck. But these bugs could lead to ransomware, or worse...

OpenSSH goes Post-Quantum, switches to qubit-busting crypto by default

By Paul Ducklin
Useful quantum computers might not actually be possible. But what if they are? And what if they arrive, say, tomorrow?

cat-1200

Popular Ruby Asciidoc toolkit patched against critical vuln – get the update now!

By Paul Ducklin
A rogue line-continuation character can trick the code into validating just the second half of the line, but executing all of it.

ruby-1200

Serious Security: Darkweb drugs market Hydra taken offline by German police

By Paul Ducklin
Why are Tor sites hard to locate and therefore difficult to take down? We explain in plain English...

Firefox 99 is out – no major bugs, but update anyway!

By Paul Ducklin
Firefox's four-weekly updates just dropped - here's what you need to know.

Google’s monthly Android updates patch numerous “get root” holes

By Paul Ducklin
Get the update now... if it's available for your phone. Here's how to check.

android-1200

LAPSUS$ hacks continue despite two hacker suspects in court

By Paul Ducklin
Do you know where in your company to report security anomalies? If you receive such reports, do you have an efficient way to process them?

Apple pushes out two emergency 0-day updates – get ’em now!

By Paul Ducklin
More Apple zero-days - mobile devices, laptops and desktops affected. Update now!

apple-1200

World Backup Day: 5 data recovery tips for everyone!

By Paul Ducklin
The only backup you will ever regret is the one you didn't make

Google Chrome patches mysterious new zero-day bug – update now

By Paul Ducklin
CVE-2022-1096 - another mystery in-the-wild 0-day in Chrome... check your version now!

UK police arrest 7 hacking suspects – have they bust the LAPSUS$ gang?

By Naked Security writer
Seven alleged hackers have been arrested in the UK. But who are they, and which hacking crew are they from?

Serious Security: DEADBOLT – the ransomware that goes straight for your backups

By Paul Ducklin
Some tips on how to keep your network safe - even (or perhaps especially!) if you think you're safe already.

Web vendor CafePress fined $500,000 for giving cybersecurity a low value

By Paul Ducklin
Just because you're the victim of a cybercrime doesn't let you off your cybersecurity obligations

Beware bogus Betas – cryptocoin scammers abuse Apple’s TestFlight system

By Paul Ducklin
"Install this moneymaking app" - this one is so special that it isn't available on Google Play or the App Store!

❌