FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

Bitcoin ATMs leeched by attackers who created fake admin accounts

By Paul Ducklin
The criminals didn't implant any malware. The attack was orchestrated via malevolent configuration changes.

Laptop denial-of-service via music: the 1980s R&B song with a CVE!

By Paul Ducklin
We haven't validated this vuln ourselves... but the source of the story is impeccable. (Impeccably dressed, at least.)

Apple patches double zero-day in browser and kernel – update now!

By Paul Ducklin
Double 0-day exploits - one in WebKit (to break in) and the other in the kernel (to take over). Patch now!

Zoom for Mac patches critical bug – update now!

By Paul Ducklin
There's many a slip 'twixt the cup and the lip. Or at least between the TOC and the TOU...

APIC/EPIC! Intel chips leak secrets even the kernel shouldn’t see…

By Paul Ducklin
If you've ever written code that left stuff lying around in memory when you didn't need it any more... we bet you've regretted it!

Traffic Light Protocol for cybersecurity responders gets a revamp

By Paul Ducklin
Traffic lights make a handy global metaphor for denoting the sensitivity of cybersecurity threat data - three colours that everyone knows.

GitHub blighted by “researcher” who created thousands of malicious projects

By Paul Ducklin
If you spew projects laced with hidden malware into an open source repository, don't waste your time telling us "no harm done" afterwards.

GnuTLS patches memory mismanagement bug – update now!

By Paul Ducklin
GnuTLS may well be the most widespread cryptographic toolkit you've never heard of. Learn more...

How to celebrate SysAdmin Day!

By Paul Ducklin
I've just popped in to wish you all/The best SysAdmin Day!

Critical Samba bug could let anyone become Domain Admin – patch now!

By Paul Ducklin
It's a serious bug... but there's a fix for it, so you know exactly what to do!

Mild monthly security update from Firefox – but update anyway

By Paul Ducklin
You're probably thinking we're going to say, "Don't delay/Do it today"... and that's exactly what we are saying!

S3 Ep91: CodeRed, OpenSSL, Java bugs, Office macros [Audio + Text]

By Paul Ducklin
Latest episode - listen now! Great discussion, technical content, solid advice... all covered in plain English.

OpenSSL fixes two “one-liner” crypto bugs – what you need to know

By Paul Ducklin
"As bad as Heartbleed"? We heard that concern a week ago, but we think it's less ungood than that...

Firefox 102 fixes address bar spoofing security hole (and helps with Follina!)

By Paul Ducklin
Firefox squashes a bug that helped phishers, and brings its own helping hand to Microsoft's "Follina" saga.

OpenSSL issues a bugfix for the previous bugfix

By Paul Ducklin
Fortunately, it's not a major bugfix, which means it's easy to patch and can teach us all some useful lessons.

Capital One identity theft hacker finally gets convicted

By Paul Ducklin
It took three years, but the Capital One cracker was convicted in the end. Don't get caught out in a data breach of your own!

You’re invited! Join us for a live walkthrough of the “Follina” story…

By Paul Ducklin
Live demo, plain English, no sales pitch, just a chance to watch an attack dissected in safety. Join us if you can!

SSNDOB Market domains seized, identity theft “brokerage” shut down

By Paul Ducklin
The online identity "brokerage" SSNDOB Market didn't want people to be in any doubt what it was selling.

Firefox 101 is out, this time with no 0-day scares (but update anyway!)

By Paul Ducklin
After an intriguing month of Firefox releases, here's one with a bit less drama, probably to the collective relief of Mozilla's coders.

Mysterious “Follina” zero-day hole in Office – here’s what to do!

By Paul Ducklin
News has emerged of a "feature" in Office that has been abused as a zero-day bug to run evil code. Turning off macros doesn't help!

Poisoned Python and PHP packages purloin passwords for AWS access

By Paul Ducklin
More supply chain trouble - this time with clear examples so you can learn how to spot this stuff yourself.

Microsoft patches the Patch Tuesday patch that broke authentication

By Paul Ducklin
Remember the good old days when security patches rarely needed patches? Because security patches themlelves were rare enough anyway?

US Government says: Patch VMware right now, or get off our network

By Paul Ducklin
Find and patch. Right now. If you can't patch, get it off the network. Right now! Oh, and show us what you did to comply.

Pwn2Own hacking schedule released – Windows and Linux are top targets

By Paul Ducklin
What's better? Disclose early, patch fast? Or dig deep, disclose in full, patch more slowly?

Apple patches zero-day kernel hole and much more – update now!

By Paul Ducklin
You'll find fixes for numerous kernel-level code execution holes, including an 0-day vulnerability in many (though not all) versions.

S3 Ep82: Bugs, bugs, bugs (and Colonial Pipeline again) [Podcast]

By Paul Ducklin
Latest episode - lots to learn - plain English - fun with a serious side - listen now!

Serious Security: Learning from curl’s latest bug update

By Paul Ducklin
Learn how to write plain-speaking and purposeful security advisories from one of the most widely-used open source tools in the world.

RubyGems supply chain rip-and-replace bug fixed – check your logs!

By Paul Ducklin
Imagine if you could assume the identity of, say, Franklin Delano Roosevelt simply by showing up and calling yourself "Frank".

ruby-1200

You didn’t leave enough space between ROSE and AND, and AND and CROWN

By Paul Ducklin
What weird Google Docs bug connects the words THEREFORE, AND, SECONDLY, WHY, BUT and BESIDES?

World Password Day – the 1960s just called and gave you your passwords back

By Paul Ducklin
Yes, passwords are going away. No, it won't happen tomorrow. So it's still worth knowing the basics of picking proper passwords.

Android monthly updates are out – critical bugs found in critical places!

By Paul Ducklin
Android May 2022 updates are out - with some critical fixes in some critical places. Learn more...

Firefox hits 100*, fixes bugs… but no new zero-days this month

By Paul Ducklin
Despite concerns that some websites might break when Chromium and then Firefox reached version 100, the web still seems to be intact.

GitHub issues final report on supply-chain source code intrusions

By Paul Ducklin
Learn how to find out which apps you've given access rights to, and how to revoke those rights immediately in an emergency.

❌