FreshRSS

🔒
△ 🔃
☐ ☆ ✇ Naked Security

OpenSSL patches infinite-loop DoS bug in certificate verification

By Paul Ducklin — March 18th 2022 at 17:59
When it comes to writing loops in your code... never sit on the fence!

☐ ☆ ✇ Naked Security

CISA warning: “Russian actors bypassed 2FA” – what happened and how to avoid it

By Paul Ducklin — March 16th 2022 at 01:22
Don't leave old accounts lying around where someone sketchy could reactivate them.

☐ ☆ ✇ Naked Security

“Dirty Pipe” Linux kernel bug lets anyone write to any file

By Paul Ducklin — March 8th 2022 at 19:37
Even read-only files can be written to, leading to a dangerously general purpose elevation-of-privilege attack.

pipe-1200

☐ ☆ ✇ Naked Security

WordPress backup plugin maker Updraft says “You should update”…

By Paul Ducklin — February 22nd 2022 at 17:26
A straight-talking bug report written in plain English by an actual expert - there's a teachable moment in this cybersecurity story!

☐ ☆ ✇ Naked Security

Irony alert! PHP fixes security flaw in input validation code

By Paul Ducklin — February 18th 2022 at 17:59
What's wrong with this sequence? 1. Step into the road 2. Check if it's safe 3. Keep on walki...

☐ ☆ ✇ Naked Security

Google announces zero-day in Chrome browser – update now!

By Paul Ducklin — February 15th 2022 at 19:17
Zero-day buses: none for a while, then three at once. Here's Google joining Apple and Adobe in "zero-day week"

☐ ☆ ✇ Naked Security

Adobe fixes zero-day exploit in e-commerce code: update now!

By Paul Ducklin — February 14th 2022 at 22:38
There's a remote code execution hole in Adobe e-commerce products - and cybercrooks are already exploiting it.

☐ ☆ ✇ Naked Security

Apple zero-day drama for Macs, iPhones and iPads – patch now!

By Paul Ducklin — February 11th 2022 at 14:25
Sudden update! Zero-day browser hole! Drive-by malware danger! Patch Apple laptops and phones now...

apple-1200

☐ ☆ ✇ Naked Security

Microsoft blocks web installation of its own App Installer files

By Paul Ducklin — February 7th 2022 at 16:36
It's a big deal when a vendor decides to block one of its own "features" for security reasons. Here's why we think it's a good idea.

☐ ☆ ✇ Naked Security

Linux kernel patches “performance can be harmful” bug in video driver

By Paul Ducklin — February 1st 2022 at 19:59
This bug is fiendishly hard to exploit - but if you patch, it won't be there to exploit at all.

☐ ☆ ✇ Naked Security

S3 Ep67: Tax scams, carder busts and crypto capers [Podcast + Transcript]

By Paul Ducklin — January 27th 2022 at 19:57
Latest episode - listen now!

☐ ☆ ✇ Naked Security

“PwnKit” security bug gets you root on most Linux distros – what to do

By Paul Ducklin — January 26th 2022 at 19:58
An elevation of privilege bug that could let a "mostly harmless" user give themselves a instant root shell

☐ ☆ ✇ Naked Security

Cryptocoin broker Crypto.com says 2FA bypass led to $35m theft

By Paul Ducklin — January 21st 2022 at 16:25
The company has put out a brief security report that summarises the 'what', but not yet the 'how' or 'why'.

☐ ☆ ✇ Naked Security

Wormable Windows HTTP hole – what you need to know

By Paul Ducklin — January 12th 2022 at 16:24
One bug in the January 2022 Patch Tuesday list is getting lots of attention: "HTTP Protocol Stack Remote Code Execution Vulnerability".

☐ ☆ ✇ Naked Security

Home routers with NetUSB support could have critical kernel hole

By Paul Ducklin — January 11th 2022 at 17:42
Got a router that supports USB access across the network? You might need a kernel update...

☐ ☆ ✇ Naked Security

Log4Shell-like security hole found in popular Java SQL database engine H2

By Paul Ducklin — January 7th 2022 at 19:32
"It's Log4Shell, Jim, but not as we know it." How to find and fix a JNDI-based vuln in the H2 Database Engine.

☐ ☆ ✇ Naked Security

Log4Shell vulnerability Number Four: “Much ado about something”

By Paul Ducklin — December 29th 2021 at 19:12
It's a Log4j bug, and you ought to patch it. But we don't think it's a critical crisis like the last one.

☐ ☆ ✇ Naked Security

SFW! The Top N Cyber­security Stories of 2021 (for small positive integer values of N)

By Paul Ducklin — December 24th 2021 at 17:44
Happy Holidays! Our Top N stories, all totally SFW!

☐ ☆ ✇ Naked Security

Apache’s other product: Critical bugs in ‘httpd’ web server, patch now!

By Paul Ducklin — December 21st 2021 at 19:57
The Apache web server just got an update - this one is nothing to do with Log4j!

☐ ☆ ✇ Naked Security

Log4Shell: The Movie… a short, safe visual tour for work and home

By Paul Ducklin — December 20th 2021 at 13:20
Be happy that your sysadmins are taking one (three, actually!) for the team right now... here's why!

☐ ☆ ✇ Naked Security

Serious Security: OpenSSL fixes “error conflation” bugs – how mixing up mistakes can lead to trouble

By Paul Ducklin — December 17th 2021 at 17:57
Have you ever seen the message "An error occurred"? Even worse, the message "This error cannot occur"? Facts matter!

☐ ☆ ✇ Naked Security

S3 Ep63: Log4Shell (what else?) and Apple kernel bugs [Podcast+Transcript]

By Paul Ducklin — December 16th 2021 at 17:41
Latest episode - listen now! (Yes, there are plenty of critical things to go along with Log4Shell.)

☐ ☆ ✇ Naked Security

Log4Shell explained – how it works, why you need to know, and how to fix it

By Paul Ducklin — December 13th 2021 at 19:41
Find out how to deal with the Log4Shell vulnerability right across your estate. Yes, you need to patch, but that helps everyone else along with you!

☐ ☆ ✇ Naked Security

“Log4Shell” Java vulnerability – how to safeguard your servers

By Paul Ducklin — December 10th 2021 at 19:22
Just when you thought it was safe to relax for the weekend... a critical bug showed up in Apache's Log4j product

☐ ☆ ✇ Naked Security

Check your patches – public exploit now out for critical Exchange bug

By Paul Ducklin — November 23rd 2021 at 14:36
It was a zero-day bug until Patch Tuesday, now there's an anyone-can-use-it exploit. Don't be the one who hasn't patched.

☐ ☆ ✇ Naked Security

Microsoft documents “SHROOTLESS” hack patched in latest Apple updates

By Paul Ducklin — October 29th 2021 at 13:38
We'd have called this bug "SHROOTMORE", but naming it wasn't our call.

☐ ☆ ✇ Naked Security

Listen up 2 – CYBERSECURITY FIRST! How to protect yourself from supply chain attacks

By Paul Ducklin — October 25th 2021 at 16:38
Everyone remembers this year's big-news supply chain attacks on Kaseya and SolarWinds. Sophos expert Chester Wisniewski explains how to control the risk.

☐ ☆ ✇ Naked Security

Listen up 3 – CYBERSECURITY FIRST! Cyberinsurance, help or hindrance?

By Paul Ducklin — October 25th 2021 at 16:37
Dr Jason Nurse, Associate Professor in Cybersecurity at the University of Kent, takes on the controversial topic of cyberinsurance.

☐ ☆ ✇ Naked Security

Listen up 4 – CYBERSECURITY FIRST! Purple teaming – learning to think like your adversaries

By Paul Ducklin — October 25th 2021 at 16:36
Michelle Farenci knows her stuff, because she's a cybersecurity practitioner inside a cybersecurity company! Learn why thinking like an attacker makes you a better defender.

☐ ☆ ✇ Naked Security

Cybersecurity Awareness Month: Listen up – CYBER­SECURITY FIRST!

By Paul Ducklin — October 25th 2021 at 16:39
Fraser Howard of SophosLabs is truly a world expert in fighting malware. Read now, and learn from the best!

☐ ☆ ✇ Naked Security

Cybersecurity Awareness Month: Building your career

By Paul Ducklin — October 18th 2021 at 18:23
Explore. Experience. Share. How to get into cybersecurity...

❌