FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

Apple megaupdate: Ventura out, iOS and iPad kernel zero-day – act now!

By Paul Ducklin
Ventura hits the market with 112 patches, Catalina's gone missing, and iPhones and iPads get a critical kernel-level zero-day patch...

Mystery iPhone update patches against iOS 16 mail crash-attack

By Paul Ducklin
The problem with crashy messaging apps is that *other people* get to choose if and when to send you messages...

WhatsApp “zero-day exploit” news scare – what you need to know

By Paul Ducklin
Is WhatsApp currently under active attack by cybercriminals? Is this a clear and current danger? How worried should WhatsApp users be?

Apple patches zero-day holes – even in the brand new iOS 16

By Paul Ducklin
Five updates, one upgrade, plus two zero-days. Patch your Macs, iPhones and iPads as soon as you can (again)...

apple-plus-16-1200

Chrome and Edge fix zero-day security hole – update now!

By Paul Ducklin
This time, the crooks got there first - only 1 security hole patched, but it's a zero-day.

JavaScript bugs aplenty in Node.js ecosystem – found automatically

By Paul Ducklin
How to get the better of bugs in all the possible packages in your supply chain?

Firefox 104 is out – no critical bugs, but update anyway

By Paul Ducklin
Two trust-spoofing bugs were the main culprits this month - but neither one was a zero-day.

Breaching airgap security: using your phone’s gyroscope as a microphone

By Paul Ducklin
One bit per second makes the Voyager probe data rate seem blindingly fast. But it's enough to break your security assumptions...

Bitcoin ATMs leeched by attackers who created fake admin accounts

By Paul Ducklin
The criminals didn't implant any malware. The attack was orchestrated via malevolent configuration changes.

Laptop denial-of-service via music: the 1980s R&B song with a CVE!

By Paul Ducklin
We haven't validated this vuln ourselves... but the source of the story is impeccable. (Impeccably dressed, at least.)

Apple patches double zero-day in browser and kernel – update now!

By Paul Ducklin
Double 0-day exploits - one in WebKit (to break in) and the other in the kernel (to take over). Patch now!

Zoom for Mac patches critical bug – update now!

By Paul Ducklin
There's many a slip 'twixt the cup and the lip. Or at least between the TOC and the TOU...

APIC/EPIC! Intel chips leak secrets even the kernel shouldn’t see…

By Paul Ducklin
If you've ever written code that left stuff lying around in memory when you didn't need it any more... we bet you've regretted it!

GnuTLS patches memory mismanagement bug – update now!

By Paul Ducklin
GnuTLS may well be the most widespread cryptographic toolkit you've never heard of. Learn more...

Critical Samba bug could let anyone become Domain Admin – patch now!

By Paul Ducklin
It's a serious bug... but there's a fix for it, so you know exactly what to do!

Mild monthly security update from Firefox – but update anyway

By Paul Ducklin
You're probably thinking we're going to say, "Don't delay/Do it today"... and that's exactly what we are saying!

OpenSSL fixes two “one-liner” crypto bugs – what you need to know

By Paul Ducklin
"As bad as Heartbleed"? We heard that concern a week ago, but we think it's less ungood than that...

Firefox 102 fixes address bar spoofing security hole (and helps with Follina!)

By Paul Ducklin
Firefox squashes a bug that helped phishers, and brings its own helping hand to Microsoft's "Follina" saga.

OpenSSL issues a bugfix for the previous bugfix

By Paul Ducklin
Fortunately, it's not a major bugfix, which means it's easy to patch and can teach us all some useful lessons.

You’re invited! Join us for a live walkthrough of the “Follina” story…

By Paul Ducklin
Live demo, plain English, no sales pitch, just a chance to watch an attack dissected in safety. Join us if you can!

Firefox 101 is out, this time with no 0-day scares (but update anyway!)

By Paul Ducklin
After an intriguing month of Firefox releases, here's one with a bit less drama, probably to the collective relief of Mozilla's coders.

Mysterious “Follina” zero-day hole in Office – here’s what to do!

By Paul Ducklin
News has emerged of a "feature" in Office that has been abused as a zero-day bug to run evil code. Turning off macros doesn't help!

Poisoned Python and PHP packages purloin passwords for AWS access

By Paul Ducklin
More supply chain trouble - this time with clear examples so you can learn how to spot this stuff yourself.

Microsoft patches the Patch Tuesday patch that broke authentication

By Paul Ducklin
Remember the good old days when security patches rarely needed patches? Because security patches themlelves were rare enough anyway?

US Government says: Patch VMware right now, or get off our network

By Paul Ducklin
Find and patch. Right now. If you can't patch, get it off the network. Right now! Oh, and show us what you did to comply.

Pwn2Own hacking schedule released – Windows and Linux are top targets

By Paul Ducklin
What's better? Disclose early, patch fast? Or dig deep, disclose in full, patch more slowly?

Apple patches zero-day kernel hole and much more – update now!

By Paul Ducklin
You'll find fixes for numerous kernel-level code execution holes, including an 0-day vulnerability in many (though not all) versions.

Serious Security: Learning from curl’s latest bug update

By Paul Ducklin
Learn how to write plain-speaking and purposeful security advisories from one of the most widely-used open source tools in the world.

RubyGems supply chain rip-and-replace bug fixed – check your logs!

By Paul Ducklin
Imagine if you could assume the identity of, say, Franklin Delano Roosevelt simply by showing up and calling yourself "Frank".

ruby-1200

You didn’t leave enough space between ROSE and AND, and AND and CROWN

By Paul Ducklin
What weird Google Docs bug connects the words THEREFORE, AND, SECONDLY, WHY, BUT and BESIDES?

Android monthly updates are out – critical bugs found in critical places!

By Paul Ducklin
Android May 2022 updates are out - with some critical fixes in some critical places. Learn more...

❌