FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

Serious Security: OAuth 2 and why Microsoft is finally forcing you into it

By Paul Ducklin
Microsoft calls it "Modern Auth", though it's a decade old, and is finally forcing Exchange Online customers to switch to it.

WhatsApp “zero-day exploit” news scare – what you need to know

By Paul Ducklin
Is WhatsApp currently under active attack by cybercriminals? Is this a clear and current danger? How worried should WhatsApp users be?

Apple patches zero-day holes – even in the brand new iOS 16

By Paul Ducklin
Five updates, one upgrade, plus two zero-days. Patch your Macs, iPhones and iPads as soon as you can (again)...

apple-plus-16-1200

Chrome and Edge fix zero-day security hole – update now!

By Paul Ducklin
This time, the crooks got there first - only 1 security hole patched, but it's a zero-day.

Firefox 104 is out – no critical bugs, but update anyway

By Paul Ducklin
Two trust-spoofing bugs were the main culprits this month - but neither one was a zero-day.

Apple patches double zero-day in browser and kernel – update now!

By Paul Ducklin
Double 0-day exploits - one in WebKit (to break in) and the other in the kernel (to take over). Patch now!

Zoom for Mac patches critical bug – update now!

By Paul Ducklin
There's many a slip 'twixt the cup and the lip. Or at least between the TOC and the TOU...

APIC/EPIC! Intel chips leak secrets even the kernel shouldn’t see…

By Paul Ducklin
If you've ever written code that left stuff lying around in memory when you didn't need it any more... we bet you've regretted it!

Mild monthly security update from Firefox – but update anyway

By Paul Ducklin
You're probably thinking we're going to say, "Don't delay/Do it today"... and that's exactly what we are saying!

Paying ransomware crooks won’t reduce your legal risk, warns regulator

By Paul Ducklin
"We paid the crooks to keep things under control and make a bad thing better"... isn't a valid excuse. Who knew?

Firefox 102 fixes address bar spoofing security hole (and helps with Follina!)

By Paul Ducklin
Firefox squashes a bug that helped phishers, and brings its own helping hand to Microsoft's "Follina" saga.

FTC warns of LGBTQ+ extortion scams – be aware before you share!

By Paul Ducklin
It's a simple jingle and it's solid advice: "If in doubt, don't give it out!"

Firefox 101 is out, this time with no 0-day scares (but update anyway!)

By Paul Ducklin
After an intriguing month of Firefox releases, here's one with a bit less drama, probably to the collective relief of Mozilla's coders.

Poisoned Python and PHP packages purloin passwords for AWS access

By Paul Ducklin
More supply chain trouble - this time with clear examples so you can learn how to spot this stuff yourself.

Apple patches zero-day kernel hole and much more – update now!

By Paul Ducklin
You'll find fixes for numerous kernel-level code execution holes, including an 0-day vulnerability in many (though not all) versions.

Firefox out-of-band update to 100.0.1 – just in time for Pwn2Own?

By Paul Ducklin
A new point-release of Firefox. Not unusual, but the timing of this one is interesting, with Pwn2Own coming up in a few days.

Firefox hits 100*, fixes bugs… but no new zero-days this month

By Paul Ducklin
Despite concerns that some websites might break when Chromium and then Firefox reached version 100, the web still seems to be intact.

Ransomware Survey 2022 – like the Curate’s Egg, “good in parts”

By Paul Ducklin
You might not like the headline statistics in this year's ransomware report... but that makes it even more important to take a look!

Firefox 99 is out – no major bugs, but update anyway!

By Paul Ducklin
Firefox's four-weekly updates just dropped - here's what you need to know.

LAPSUS$ hacks continue despite two hacker suspects in court

By Paul Ducklin
Do you know where in your company to report security anomalies? If you receive such reports, do you have an efficient way to process them?

Google Chrome patches mysterious new zero-day bug – update now

By Paul Ducklin
CVE-2022-1096 - another mystery in-the-wild 0-day in Chrome... check your version now!

Serious Security: DEADBOLT – the ransomware that goes straight for your backups

By Paul Ducklin
Some tips on how to keep your network safe - even (or perhaps especially!) if you think you're safe already.

Apple patches 87 security holes – from iPhones and Macs to Windows

By Paul Ducklin
Lots of fixes, with data leakage flaws and code execution bugs patched on iPhones, Macs and even Windows.

apple-1200

“Dirty Pipe” Linux kernel bug lets anyone write to any file

By Paul Ducklin
Even read-only files can be written to, leading to a dangerously general purpose elevation-of-privilege attack.

pipe-1200

Adafruit suffers GitHub data breach – don’t let this happen to you

By Paul Ducklin
Training data stashed in GitHub by mistake... unfortunately, it was *real* data

Firefox patches two actively exploited 0-day holes: update now!

By Paul Ducklin
Firefox just published a double-zero-day patch - "remote code execution" combined with "sandbox escape". Update now!

French speakers blasted by sextortion scams with no text or links

By Paul Ducklin
You'd spot this one a mile away... but what about your friends or family?

Adobe fixes zero-day exploit in e-commerce code: update now!

By Paul Ducklin
There's a remote code execution hole in Adobe e-commerce products - and cybercrooks are already exploiting it.

Apple zero-day drama for Macs, iPhones and iPads – patch now!

By Paul Ducklin
Sudden update! Zero-day browser hole! Drive-by malware danger! Patch Apple laptops and phones now...

apple-1200

Microsoft blocks web installation of its own App Installer files

By Paul Ducklin
It's a big deal when a vendor decides to block one of its own "features" for security reasons. Here's why we think it's a good idea.

Linux kernel patches “performance can be harmful” bug in video driver

By Paul Ducklin
This bug is fiendishly hard to exploit - but if you patch, it won't be there to exploit at all.

Apple fixes Safari data leak (and patches a zero-day!) – update now

By Paul Ducklin
That infamous "supercookie" bug in Safari has now been fixed. Oh, and there was a zero-day kernel hole as well.

apple-1200

“PwnKit” security bug gets you root on most Linux distros – what to do

By Paul Ducklin
An elevation of privilege bug that could let a "mostly harmless" user give themselves a instant root shell

Serious Security: Linux full-disk encryption bug fixed – patch now!

By Paul Ducklin
Imagine if someone who didn't have your password could sneakily modify data that was encrypted with it.

FTC threatens “legal action” over unpatched Log4j and other vulns

By Paul Ducklin
Remember the Equifax breach? Remember the $700m penalty? In case you'd forgotten, here's the FTC to refresh your memory!

S3 Ep63: Log4Shell (what else?) and Apple kernel bugs [Podcast+Transcript]

By Paul Ducklin
Latest episode - listen now! (Yes, there are plenty of critical things to go along with Log4Shell.)

“Log4Shell” Java vulnerability – how to safeguard your servers

By Paul Ducklin
Just when you thought it was safe to relax for the weekend... a critical bug showed up in Apache's Log4j product

Firefox update brings a whole new sort of security sandbox

By Paul Ducklin
Firefox 95.0 is out, with the usual security fixes... plus some funky new ones.

Check your patches – public exploit now out for critical Exchange bug

By Paul Ducklin
It was a zero-day bug until Patch Tuesday, now there's an anyone-can-use-it exploit. Don't be the one who hasn't patched.

Github cookie leakage – thousands of Firefox cookie files uploaded by mistake

By Paul Ducklin
Be aware before you share! That's a good rule for developers and techies, just as much as it is for social media addicts.

Apple’s Mail Privacy Protection feature – watch out if you have a Watch!

By Paul Ducklin
Apple's "Protect Mail Activity" is a handy privacy enhancement for your messaging habits. As long as you know its limitations...

❌