FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

S3 Ep132: Proof-of-concept lets anyone hack at will

By Paul Ducklin
When Doug says, "Happy Remote Code Execution Day, Duck"... it's irony. For the avoidance of all doubt :-)

PaperCut security vulnerabilities under active attack – vendor urges customers to patch

By Paul Ducklin
If you have the product, but you haven't patched - well, the crooks have now landed, so please don't delay. Do it today...

Double zero-day in Chrome and Edge – check your versions now!

By Paul Ducklin
Wouldn't it be handy if there were a single version number to check for in every Chromium-based browser, on every supported platform?

VMware patches break-and-enter hole in logging tools: update now!

By Paul Ducklin
You know jolly well/What we're going to say/And that's "Do not delay/Simply do it today."

S3 Ep130: Open the garage bay doors, HAL [Audio + Text]

By Paul Ducklin
I'm sorry, Dave. I'm afraid I can't... errr, no, hang on a minute, I can do that easily! Worldwide! Right now!

Apple zero-day spyware patches extended to cover older Macs, iPhones and iPads

By Paul Ducklin
That double-whammy Apple browser-to-kernel spyware bug combo we wrote up last week? Turns out it applies to all supported Macs and iDevices - patch now!

Popular server-side JavaScript security sandbox “vm2” patches remote execution hole

By Paul Ducklin
The security error was in the error handling system that was supposed to catch potential security errors...

vm2-1200

Apple issues emergency patches for spyware-style 0-day exploits – update now!

By Paul Ducklin
A bug to hack your browser, then a bug to pwn the kernel... reported from the wild by Amnesty International.

Apple patches everything, including a zero-day fix for iOS 15 users

By Paul Ducklin
Got an older iPhone that can't run iOS 16? You've got a zero-day to deal with! That super-cool Studio Display monitor needs patching, too.

WooCommerce Payments plugin for WordPress has an admin-level hole – patch now!

By Paul Ducklin
Admin-level holes in websites are always a bad thing... and for "bad", read "worse" if it's an e-commerce site.

woo-1200

Dangerous Android phone 0-day bugs revealed – patch or work around them now!

By Paul Ducklin
Despite its usually inflexible 0-day disclosure policy, Google is keeping four mobile modem bugs semi-secret due to likely ease of exploitation.

S3 Ep 126: The price of fast fashion (and feature creep) [Audio + Text]

By Paul Ducklin
Worried about rogue apps? Unsure about the new Outlook zero-day? Clear advice in plain English... just like old times, with Duck and Chet!

Microsoft fixes two 0-days on Patch Tuesday – update now!

By Paul Ducklin
An email you haven't even looked at yet could be used to trick Outlook into helping crooks to logon as you.

Firefox 111 patches 11 holes, but not 1 zero-day among them…

By Paul Ducklin
In the game of cricket, 111 is an inauspicious number, but for Firefox, there doesn't seem to be much to worry about this month.

Serious Security: TPM 2.0 vulns – is your super-secure data at risk?

By Paul Ducklin
Security bugs in the very code you've been told you must have to improve the security of your computer...

Apple fixes zero-day spyware implant bug – patch now!

By Paul Ducklin
Everyone update now! Except for those who don't need to! Or who need to but will only get updates later on, though Apple isn't saying yet!

OpenSSL fixes High Severity data-stealing bug – patch now!

By Paul Ducklin
7 memory mismanagements and a timing attack. We explain all the jargon bug terminology in plain English...

VMWare user? Worried about “ESXi ransomware”? Check your patches now!

By Paul Ducklin
To borrow from HHGttG, please DON'T PANIC. But if you are two years out of date with patches, please do ACT NOW!

OpenSSH fixes double-free memory bug that’s pokable over the network

By Paul Ducklin
It's a bug fix for a bug fix. A memory leak was turned into a double-free that has now been turned into correct code...

Password-stealing “vulnerability” reported in KeePass – bug or feature?

By Paul Ducklin
Is it a vulnerability if someone with control over your account can mess with files that your account is allowed to access anyway?

Serious Security: The Samba logon bug caused by outdated crypto

By Paul Ducklin
Enjoy our Serious Security deep dive into this real-world example of why cryptographic agility is important!

Apple patches are out – old iPhones get an old zero-day fix at last!

By Paul Ducklin
Don't delay, especially if you're still running an iOS 12 device... please do it today!

Serious Security: How dEliBeRaTe tYpOs might imProVe DNS security

By Paul Ducklin
It's a really cool and super-simple trick. The question is, "Will it help?"

Microsoft Patch Tuesday: One 0-day; Win 7 and 8.1 get last-ever patches

By Paul Ducklin
Get 'em while they're hot. And get 'em for the very last time, if you still have Windows 7 or 8.1...

Popular JWT cloud security library patches “remote” code execution hole

By Paul Ducklin
It's remotely triggerable, but attackers would already have pretty deep network access if they could "prime" your server for compromise.

CircleCI – code-building service suffers total credential compromise

By Paul Ducklin
They're saying "rotate secrets"... in plain English, they mean "change your credentials". The company has a tool to help you find them all.

Naked Security 33 1/3 – Cybersecurity predictions for 2023 and beyond

By Paul Ducklin
The problem with anniversaries is that there's an almost infinite number of them every day...

hny-1200

Microsoft dishes the dirt on Apple’s “Achilles heel” shortly after fixing similar Windows bug

By Paul Ducklin
It happens to the best of us: Microsoft highlights a security bypass bug on Macs that is curiously similar to a recent Windows 0-day.

Apple patches everything, finally reveals mystery of iOS 16.1.2

By Paul Ducklin
There's an update for everything this time, not just for iOS.

Pwn2Own Toronto: 54 hacks, 63 new bugs, $1 million in bounties

By Paul Ducklin
That's a mean average of $15,710 per bug... and 63 fewer bugs out there for crooks and rogues to find.

Ping of death! FreeBSD fixes crashtastic bug in network tool

By Paul Ducklin
It's a venerable program, and this version had a venerable bug in it.

Chrome fixes 8th zero-day of 2022 – check your version now (Edge too!)

By Paul Ducklin
There isn't a rhyme to remind you which months have browser zero-days... you just have to keep your eyes and ears open!

How to hack an unpatched Exchange server with rogue PowerShell code

By Paul Ducklin
Review your servers, your patches and your authentication policies - there's a proof-of-concept out

Firefox fixes fullscreen fakery flaw – get the update now!

By Paul Ducklin
What's so bad about a web page going fullscreen without warning you first?

Log4Shell-like code execution hole in popular Backstage dev tool

By Paul Ducklin
Good old "string templating", also known as "string interpolation", in the spotlight again...

bs-1200

S3 Ep108: You hid THREE BILLION dollars in a popcorn tin?

By Paul Ducklin
Patches, busts, leaks and why even low-likelihood exploits can be high-severity risks - listen now!

Emergency code execution patch from Apple – but not an 0-day

By Paul Ducklin
Not a zero-day, but important enough for a quick-fire patch to one system library...

The OpenSSL security update story – how can you tell what needs fixing?

By Paul Ducklin
How to Hack! Finding OpenSSL library files and accurately identifying their version numbers...

ossl-code-1200

OpenSSL patches are out – CRITICAL bug downgraded to HIGH, but patch anyway!

By Paul Ducklin
That bated-breath OpenSSL update is out! It's no longer rated CRITICAL, but we advise you to patch ASAP anyway. Here's why...

SHA-3 code execution bug patched in PHP – check your version!

By Paul Ducklin
As everyone waits for news of a bug in OpenSSL, here's a reminder that other cryptographic code in your life may also need patching!

Chrome issues urgent zero-day fix – update now!

By Paul Ducklin
We've said it before/And we'll say it again/It's not *if* you should patch/It's a matter of *when*. (Hint: now!)

❌