FreshRSS

🔒
△ 🔃
☐ ☆ ✇ Naked Security

VMware fixes holes that could allow virtual machine escapes

By Paul Ducklin — February 16th 2022 at 19:32
Hats off to VMware for not using weasel words: "When should you act?" Immediately...

☐ ☆ ✇ Naked Security

Google announces zero-day in Chrome browser – update now!

By Paul Ducklin — February 15th 2022 at 19:17
Zero-day buses: none for a while, then three at once. Here's Google joining Apple and Adobe in "zero-day week"

☐ ☆ ✇ Naked Security

Adobe fixes zero-day exploit in e-commerce code: update now!

By Paul Ducklin — February 14th 2022 at 22:38
There's a remote code execution hole in Adobe e-commerce products - and cybercrooks are already exploiting it.

☐ ☆ ✇ Naked Security

Power company pays out $3 trillion compensation to astonished customer

By Paul Ducklin — February 14th 2022 at 14:58
More money than the UK's economy produces in a year!

☐ ☆ ✇ Naked Security

Apple zero-day drama for Macs, iPhones and iPads – patch now!

By Paul Ducklin — February 11th 2022 at 14:25
Sudden update! Zero-day browser hole! Drive-by malware danger! Patch Apple laptops and phones now...

apple-1200

☐ ☆ ✇ Naked Security

Microsoft blocks web installation of its own App Installer files

By Paul Ducklin — February 7th 2022 at 16:36
It's a big deal when a vendor decides to block one of its own "features" for security reasons. Here's why we think it's a good idea.

☐ ☆ ✇ Naked Security

Elementor WordPress plugin has a gaping security hole – update now

By Paul Ducklin — February 2nd 2022 at 17:11
We shouldn't need to say, "Check your inputs!" these days, but we're saying it anyway.

☐ ☆ ✇ Naked Security

Linux kernel patches “performance can be harmful” bug in video driver

By Paul Ducklin — February 1st 2022 at 19:59
This bug is fiendishly hard to exploit - but if you patch, it won't be there to exploit at all.

☐ ☆ ✇ Naked Security

Apple fixes Safari data leak (and patches a zero-day!) – update now

By Paul Ducklin — January 27th 2022 at 21:09
That infamous "supercookie" bug in Safari has now been fixed. Oh, and there was a zero-day kernel hole as well.

apple-1200

☐ ☆ ✇ Naked Security

“PwnKit” security bug gets you root on most Linux distros – what to do

By Paul Ducklin — January 26th 2022 at 19:58
An elevation of privilege bug that could let a "mostly harmless" user give themselves a instant root shell

☐ ☆ ✇ Naked Security

Cryptocoin broker Crypto.com says 2FA bypass led to $35m theft

By Paul Ducklin — January 21st 2022 at 16:25
The company has put out a brief security report that summarises the 'what', but not yet the 'how' or 'why'.

☐ ☆ ✇ Naked Security

S3 Ep65: Supply chain conniption, NetUSB hole, Honda flashback, FTC muscle [Podcast + Transcript]

By Paul Ducklin — January 13th 2022 at 15:26
Latest episode -listen to it or read it now!

☐ ☆ ✇ Naked Security

Wormable Windows HTTP hole – what you need to know

By Paul Ducklin — January 12th 2022 at 16:24
One bug in the January 2022 Patch Tuesday list is getting lots of attention: "HTTP Protocol Stack Remote Code Execution Vulnerability".

☐ ☆ ✇ Naked Security

Home routers with NetUSB support could have critical kernel hole

By Paul Ducklin — January 11th 2022 at 17:42
Got a router that supports USB access across the network? You might need a kernel update...

☐ ☆ ✇ Naked Security

Log4Shell-like security hole found in popular Java SQL database engine H2

By Paul Ducklin — January 7th 2022 at 19:32
"It's Log4Shell, Jim, but not as we know it." How to find and fix a JNDI-based vuln in the H2 Database Engine.

☐ ☆ ✇ Naked Security

FTC threatens “legal action” over unpatched Log4j and other vulns

By Paul Ducklin — January 5th 2022 at 19:37
Remember the Equifax breach? Remember the $700m penalty? In case you'd forgotten, here's the FTC to refresh your memory!

☐ ☆ ✇ Naked Security

Log4Shell vulnerability Number Four: “Much ado about something”

By Paul Ducklin — December 29th 2021 at 19:12
It's a Log4j bug, and you ought to patch it. But we don't think it's a critical crisis like the last one.

☐ ☆ ✇ Naked Security

Apache’s other product: Critical bugs in ‘httpd’ web server, patch now!

By Paul Ducklin — December 21st 2021 at 19:57
The Apache web server just got an update - this one is nothing to do with Log4j!

☐ ☆ ✇ Naked Security

Serious Security: OpenSSL fixes “error conflation” bugs – how mixing up mistakes can lead to trouble

By Paul Ducklin — December 17th 2021 at 17:57
Have you ever seen the message "An error occurred"? Even worse, the message "This error cannot occur"? Facts matter!

☐ ☆ ✇ Naked Security

Apple security updates are out – and not a Log4Shell mention in sight

By Paul Ducklin — December 14th 2021 at 12:55
Get 'em while they're hot!

☐ ☆ ✇ Naked Security

Log4Shell explained – how it works, why you need to know, and how to fix it

By Paul Ducklin — December 13th 2021 at 19:41
Find out how to deal with the Log4Shell vulnerability right across your estate. Yes, you need to patch, but that helps everyone else along with you!

☐ ☆ ✇ Naked Security

“Log4Shell” Java vulnerability – how to safeguard your servers

By Paul Ducklin — December 10th 2021 at 19:22
Just when you thought it was safe to relax for the weekend... a critical bug showed up in Apache's Log4j product

☐ ☆ ✇ Naked Security

S3 Ep62: The S in IoT stands for security (and much more) [Podcast+Transcript]

By Paul Ducklin — December 9th 2021 at 17:40
Listen now or read as an article! (Full transcript inside.)

☐ ☆ ✇ Naked Security

Firefox update brings a whole new sort of security sandbox

By Paul Ducklin — December 7th 2021 at 19:14
Firefox 95.0 is out, with the usual security fixes... plus some funky new ones.

☐ ☆ ✇ Naked Security

Mozilla patches critical “BigSig” cryptographic bug: Here’s how to track it down and fix it

By Paul Ducklin — December 3rd 2021 at 17:58
Mozilla's cryptographic code had a critical bug. Problem is that numerous apps are affected and may need patching individually.

☐ ☆ ✇ Naked Security

IoT devices must “protect consumers from cyberharm”, says UK government

By Paul Ducklin — December 2nd 2021 at 19:10
"Must be at least THIS tall to go on ride" seems to be the starting point. Too little, too late? Or better than nothing?

☐ ☆ ✇ Naked Security

S3 Ep60: Exchange exploit, GoDaddy breach and cookies made public [Podcast]

By Paul Ducklin — November 25th 2021 at 12:38
Latest episode - listen now! Solid cybersecurity advice in plain English.

☐ ☆ ✇ Naked Security

Check your patches – public exploit now out for critical Exchange bug

By Paul Ducklin — November 23rd 2021 at 14:36
It was a zero-day bug until Patch Tuesday, now there's an anyone-can-use-it exploit. Don't be the one who hasn't patched.

☐ ☆ ✇ Naked Security

GoDaddy admits to password breach: check your Managed WordPress site!

By Paul Ducklin — November 23rd 2021 at 00:35
GoDaddy found crooks in its network, and kicked them out - but not before they'd been in there for six weeks.

☐ ☆ ✇ Naked Security

Patch Tuesday updates the Win 7 updater… for at most 1 more year of updates

By Paul Ducklin — November 10th 2021 at 19:45
The clock stopped long ago on Windows 7, except for those who paid for overtime. But there won't be any double overtime!

☐ ☆ ✇ Naked Security

Microsoft documents “SHROOTLESS” hack patched in latest Apple updates

By Paul Ducklin — October 29th 2021 at 13:38
We'd have called this bug "SHROOTMORE", but naming it wasn't our call.

☐ ☆ ✇ Naked Security

S3 Ep54: Another 0-day, double Apache patch, and Fight The Phish [Podcast]

By Paul Ducklin — October 14th 2021 at 18:33
Latest episode - listen now!

❌