FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

S3 Ep108: You hid THREE BILLION dollars in a popcorn tin?

By Paul Ducklin
Patches, busts, leaks and why even low-likelihood exploits can be high-severity risks - listen now!

Emergency code execution patch from Apple – but not an 0-day

By Paul Ducklin
Not a zero-day, but important enough for a quick-fire patch to one system library...

Silk Road drugs market hacker pleads guilty, faces 20 years inside

By Paul Ducklin
Jurisprudence isn't like arithmetic... two negatives never make a positive!

The OpenSSL security update story – how can you tell what needs fixing?

By Paul Ducklin
How to Hack! Finding OpenSSL library files and accurately identifying their version numbers...

ossl-code-1200

OpenSSL patches are out – CRITICAL bug downgraded to HIGH, but patch anyway!

By Paul Ducklin
That bated-breath OpenSSL update is out! It's no longer rated CRITICAL, but we advise you to patch ASAP anyway. Here's why...

SHA-3 code execution bug patched in PHP – check your version!

By Paul Ducklin
As everyone waits for news of a bug in OpenSSL, here's a reminder that other cryptographic code in your life may also need patching!

Chrome issues urgent zero-day fix – update now!

By Paul Ducklin
We've said it before/And we'll say it again/It's not *if* you should patch/It's a matter of *when*. (Hint: now!)

Clearview AI image-scraping face recognition service hit with €20m fine in France

By Paul Ducklin
"We told you to stop but you ignored us," said the French regulator, "so now we're coming after you again."

Apple megaupdate: Ventura out, iOS and iPad kernel zero-day – act now!

By Paul Ducklin
Ventura hits the market with 112 patches, Catalina's gone missing, and iPhones and iPads get a critical kernel-level zero-day patch...

Zoom for Mac patches sneaky “spy-on-me” bug – update now!

By Paul Ducklin
Hey! That back door isn't supposed to be there at all, let alone propped open...

Mystery iPhone update patches against iOS 16 mail crash-attack

By Paul Ducklin
The problem with crashy messaging apps is that *other people* get to choose if and when to send you messages...

S3 Ep102: How to avoid a data breach [Audio + Transcript]

By Paul Ducklin
Latest episode - listen now! Tell fact from fiction in hyped-up cybersecurity news...

WhatsApp “zero-day exploit” news scare – what you need to know

By Paul Ducklin
Is WhatsApp currently under active attack by cybercriminals? Is this a clear and current danger? How worried should WhatsApp users be?

S3 Ep101: Uber and LastPass breaches – is 2FA all it’s cracked up to be? [Audio + Text]

By Paul Ducklin
Latest episode - listen now! Learn why adopting 2FA isn't a reason to relax your other security precautions...

Interested in cybersecurity? Join us for Security SOS Week 2022!

By Paul Ducklin
Four one-on-one interviews with experts who are passionate about sharing their expertise with the community.

S3 Ep100.5: Uber breach – an expert speaks [Audio + Text]

By Paul Ducklin
Chester Wisniewski on what we can learn from Uber: "Just because a big company didn't have the security they should doesn't mean you can't."

S3 Ep100: Browser-in-the-Browser – how to spot an attack [Audio + Text]

By Paul Ducklin
Latest episode - listen now! Cosmic rockets, zero-days, spotting cybercrooks, and unlocking the DEADBOLT...

s3-ep100-js-1200

Serious Security: Browser-in-the-browser attacks – watch out for windows that aren’t!

By Paul Ducklin
Simple but super-sneaky - use a picture of a browser, and convince people it's real...

pipe-light-not-1200

Apple patches zero-day holes – even in the brand new iOS 16

By Paul Ducklin
Five updates, one upgrade, plus two zero-days. Patch your Macs, iPhones and iPads as soon as you can (again)...

apple-plus-16-1200

How to deal with dates and times without any timezone tantrums…

By Paul Ducklin
Heartfelt encouragement to embrace RFC 3339 - find out why!

Chrome and Edge fix zero-day security hole – update now!

By Paul Ducklin
This time, the crooks got there first - only 1 security hole patched, but it's a zero-day.

Peter Eckersley, co-creator of Let’s Encrypt, dies at just 43

By Paul Ducklin
This site, like millions of others, has a certificate from Let's Encrypt. Farewell, Peter Eckersley, PhD, who helped make it all possible.

URGENT! Apple slips out zero-day update for older iPhones and iPads

By Paul Ducklin
Patch as soon as you can - that recent WebKit zero-day affecting new iPhones and iPads is apparently being used against older models, too.

JavaScript bugs aplenty in Node.js ecosystem – found automatically

By Paul Ducklin
How to get the better of bugs in all the possible packages in your supply chain?

Firefox 104 is out – no critical bugs, but update anyway

By Paul Ducklin
Two trust-spoofing bugs were the main culprits this month - but neither one was a zero-day.

Breaching airgap security: using your phone’s gyroscope as a microphone

By Paul Ducklin
One bit per second makes the Voyager probe data rate seem blindingly fast. But it's enough to break your security assumptions...

Bitcoin ATMs leeched by attackers who created fake admin accounts

By Paul Ducklin
The criminals didn't implant any malware. The attack was orchestrated via malevolent configuration changes.

Laptop denial-of-service via music: the 1980s R&B song with a CVE!

By Paul Ducklin
We haven't validated this vuln ourselves... but the source of the story is impeccable. (Impeccably dressed, at least.)

Apple patches double zero-day in browser and kernel – update now!

By Paul Ducklin
Double 0-day exploits - one in WebKit (to break in) and the other in the kernel (to take over). Patch now!

Zoom for Mac patches critical bug – update now!

By Paul Ducklin
There's many a slip 'twixt the cup and the lip. Or at least between the TOC and the TOU...

APIC/EPIC! Intel chips leak secrets even the kernel shouldn’t see…

By Paul Ducklin
If you've ever written code that left stuff lying around in memory when you didn't need it any more... we bet you've regretted it!

Traffic Light Protocol for cybersecurity responders gets a revamp

By Paul Ducklin
Traffic lights make a handy global metaphor for denoting the sensitivity of cybersecurity threat data - three colours that everyone knows.

GitHub blighted by “researcher” who created thousands of malicious projects

By Paul Ducklin
If you spew projects laced with hidden malware into an open source repository, don't waste your time telling us "no harm done" afterwards.

GnuTLS patches memory mismanagement bug – update now!

By Paul Ducklin
GnuTLS may well be the most widespread cryptographic toolkit you've never heard of. Learn more...

How to celebrate SysAdmin Day!

By Paul Ducklin
I've just popped in to wish you all/The best SysAdmin Day!

Critical Samba bug could let anyone become Domain Admin – patch now!

By Paul Ducklin
It's a serious bug... but there's a fix for it, so you know exactly what to do!

Mild monthly security update from Firefox – but update anyway

By Paul Ducklin
You're probably thinking we're going to say, "Don't delay/Do it today"... and that's exactly what we are saying!

❌