FreshRSS

🔒
☐ ☆ ✇ The Hacker News

Why Zero Trust Should be the Foundation of Your Cybersecurity Ecosystem

By The Hacker News — September 21st 2022 at 12:00
For cybersecurity professionals, it is a huge challenge to separate the “good guys” from the “villains”. In the past, most cyberattacks could simply be traced to external cybercriminals, cyberterrorists, or rogue nation-states. But not anymore. Threats from within organizations – also known as “insider threats” – are increasing and cybersecurity practitioners are feeling the pain.  Traditional
☐ ☆ ✇ Naked Security

LastPass source code breach – incident response report released

By Paul Ducklin — September 19th 2022 at 18:59
Wondering how you'd handle a data breach report if the worst happened to you? Here's a useful example.

☐ ☆ ✇ Naked Security

S3 Ep100: Browser-in-the-Browser – how to spot an attack [Audio + Text]

By Paul Ducklin — September 15th 2022 at 18:50
Latest episode - listen now! Cosmic rockets, zero-days, spotting cybercrooks, and unlocking the DEADBOLT...

s3-ep100-js-1200

☐ ☆ ✇ The Hacker News

Microsoft's Latest Security Update Fixes 64 New Flaws, Including a Zero-Day

By Ravie Lakshmanan — September 14th 2022 at 04:42
Tech giant Microsoft on Tuesday shipped fixes to quash 64 new security flaws across its software lineup, including one zero-day flaw that has been actively exploited in real-world attacks. Of the 64 bugs, five are rated Critical, 57 are rated Important, one is rated Moderate, and one is rated Low in severity. The patches are in addition to 16 vulnerabilities that Microsoft addressed in its
☐ ☆ ✇ The Hacker News

Over 280,000 WordPress Sites Attacked Using WPGateway Plugin Zero-Day Vulnerability

By Ravie Lakshmanan — September 14th 2022 at 01:51
A zero-day flaw in the latest version of a WordPress premium plugin known as WPGateway is being actively exploited in the wild, potentially allowing malicious actors to completely take over affected sites. Tracked as CVE-2022-3180 (CVSS score: 9.8), the issue is being weaponized to add a malicious administrator user to sites running the WPGateway plugin, WordPress security company Wordfence
☐ ☆ ✇ The Hacker News

Apple Releases iOS and macOS Updates to Patch Actively Exploited Zero-Day Flaw

By Ravie Lakshmanan — September 13th 2022 at 03:36
Apple has released another round of security updates to address multiple vulnerabilities in iOS and macOS, including a new zero-day flaw that has been used in attacks in the wild. The issue, assigned the identifier CVE-2022-32917, is rooted in the Kernel component and could enable a malicious app to execute arbitrary code with kernel privileges. "Apple is aware of a report that this issue may
☐ ☆ ✇ The Hacker News

Hackers Exploit Zero-Day in WordPress BackupBuddy Plugin in ~5 Million Attempts

By Ravie Lakshmanan — September 9th 2022 at 08:19
A zero-day flaw in a WordPress plugin called BackupBuddy is being actively exploited, WordPress security company Wordfence has disclosed. "This vulnerability makes it possible for unauthenticated users to download arbitrary files from the affected site which can include sensitive information," it said. BackupBuddy allows users to back up their entire WordPress installation from within the
☐ ☆ ✇ Naked Security

Chrome and Edge fix zero-day security hole – update now!

By Paul Ducklin — September 5th 2022 at 15:12
This time, the crooks got there first - only 1 security hole patched, but it's a zero-day.

☐ ☆ ✇ The Hacker News

Apple Releases iOS Update for Older iPhones to Fix Actively Exploited Vulnerability

By Ravie Lakshmanan — September 1st 2022 at 03:24
Apple on Wednesday backported security updates to older iPhones, iPads, and iPod touch devices to address a critical security flaw that has been actively exploited in the wild. The shortcoming, tracked as CVE-2022-32893 (CVSS score: 8.8), is an out-of-bounds write issue affecting WebKit that could lead to arbitrary code execution when processing maliciously crafted web content. WebKit is the
☐ ☆ ✇ Naked Security

URGENT! Apple slips out zero-day update for older iPhones and iPads

By Paul Ducklin — August 31st 2022 at 18:42
Patch as soon as you can - that recent WebKit zero-day affecting new iPhones and iPads is apparently being used against older models, too.

☐ ☆ ✇ Naked Security

S3 Ep97: Did your iPhone get pwned? How would you know? [Audio + Text]

By Paul Ducklin — August 25th 2022 at 15:37
Latest episode - listen now! (Or read the transcript if you prefer the text version.)

☐ ☆ ✇ The first stop for security news | Threatpost

Google Patches Chrome’s Fifth Zero-Day of the Year

By Elizabeth Montalbano — August 18th 2022 at 14:31
An insufficient validation input flaw, one of 11 patched in an update this week, could allow for arbitrary code execution and is under active attack.
☐ ☆ ✇ Threatpost | The first stop for security news

Google Patches Chrome’s Fifth Zero-Day of the Year

By Elizabeth Montalbano — August 18th 2022 at 14:31
An insufficient validation input flaw, one of 11 patched in an update this week, could allow for arbitrary code execution and is under active attack.
☐ ☆ ✇ The Hacker News

New Google Chrome Zero-Day Vulnerability Being Exploited in the Wild

By Ravie Lakshmanan — August 17th 2022 at 12:02
Google on Tuesday rolled out patches for Chrome browser for desktops to contain an actively exploited high-severity zero-day flaw in the wild. Tracked as CVE-2022-2856, the issue has been described as a case of insufficient validation of untrusted input in Intents. Security researchers Ashley Shen and Christian Resell of Google Threat Analysis Group have been credited with reporting the flaw on
☐ ☆ ✇ Naked Security

S3 Ep93: Office security, breach costs, and leisurely patches [Audio + Text]

By Paul Ducklin — July 28th 2022 at 15:47
Latest episode - listen now!

☐ ☆ ✇ The Hacker News

Microsoft Uncovers Austrian Company Exploiting Windows and Adobe Zero-Day Exploits

By Ravie Lakshmanan — July 28th 2022 at 11:18
A cyber mercenary that "ostensibly sells general security and information analysis services to commercial customers" used several Windows and Adobe zero-day exploits in limited and highly-targeted attacks against European and Central American entities. The company, which Microsoft describes as a private-sector offensive actor (PSOA), is an Austria-based outfit called DSIRF that's linked to the
☐ ☆ ✇ The Hacker News

Pegasus Spyware Used to Hack Devices of Pro-Democracy Activists in Thailand

By Ravie Lakshmanan — July 18th 2022 at 15:50
Thai activists involved in the country's pro-democracy protests have had their smartphones infected with NSO Group's infamous Pegasus government-sponsored spyware. At least 30 individuals, spanning activists, academics, lawyers, and NGO workers, are believed to have been targeted between October 2020 and November 2021, many of whom have been previously detained, arrested and imprisoned for their
☐ ☆ ✇ The Hacker News

Microsoft Releases Fix for Zero-Day Flaw in July 2022 Security Patch Rollout

By Ravie Lakshmanan — July 13th 2022 at 04:15
Microsoft released its monthly round of Patch Tuesday updates to address 84 new security flaws spanning multiple product categories, counting a zero-day vulnerability that's under active attack in the wild. Of the 84 shortcomings, four are rated Critical, and 80 are rated Important in severity. Also separately resolved by the tech giant are two other bugs in the Chromium-based Edge browser, one
☐ ☆ ✇ Naked Security

Google patches “in-the-wild” Chrome zero-day – update now!

By Paul Ducklin — July 5th 2022 at 15:55
Running Chrome? Do the "Help-About-Update" dance move right now, just to be sure...

☐ ☆ ✇ Naked Security

S3 Ep86: The crooks were in our network for HOW long?! [Podcast + Transcript]

By Paul Ducklin — June 9th 2022 at 13:07
Latest episode - listen (or read) now!

☐ ☆ ✇ Naked Security

Atlassian announces 0-day hole in Confluence Server – update now!

By Paul Ducklin — June 3rd 2022 at 18:59
Zero-day announced - here's what you need to know

☐ ☆ ✇ Naked Security

Mysterious “Follina” zero-day hole in Office – here’s what to do!

By Paul Ducklin — May 30th 2022 at 23:01
News has emerged of a "feature" in Office that has been abused as a zero-day bug to run evil code. Turning off macros doesn't help!

☐ ☆ ✇ Naked Security

Apple patches zero-day kernel hole and much more – update now!

By Paul Ducklin — May 17th 2022 at 09:30
You'll find fixes for numerous kernel-level code execution holes, including an 0-day vulnerability in many (though not all) versions.

☐ ☆ ✇ Naked Security

GitHub issues final report on supply-chain source code intrusions

By Paul Ducklin — April 29th 2022 at 16:15
Learn how to find out which apps you've given access rights to, and how to revoke those rights immediately in an emergency.

☐ ☆ ✇ Naked Security

Apple pushes out two emergency 0-day updates – get ’em now!

By Paul Ducklin — March 31st 2022 at 23:38
More Apple zero-days - mobile devices, laptops and desktops affected. Update now!

apple-1200

☐ ☆ ✇ Naked Security

Google Chrome patches mysterious new zero-day bug – update now

By Paul Ducklin — March 28th 2022 at 14:18
CVE-2022-1096 - another mystery in-the-wild 0-day in Chrome... check your version now!

☐ ☆ ✇ Naked Security

Firefox patches two actively exploited 0-day holes: update now!

By Paul Ducklin — March 5th 2022 at 19:06
Firefox just published a double-zero-day patch - "remote code execution" combined with "sandbox escape". Update now!

☐ ☆ ✇ Naked Security

Google announces zero-day in Chrome browser – update now!

By Paul Ducklin — February 15th 2022 at 19:17
Zero-day buses: none for a while, then three at once. Here's Google joining Apple and Adobe in "zero-day week"

☐ ☆ ✇ Naked Security

Adobe fixes zero-day exploit in e-commerce code: update now!

By Paul Ducklin — February 14th 2022 at 22:38
There's a remote code execution hole in Adobe e-commerce products - and cybercrooks are already exploiting it.

☐ ☆ ✇ Naked Security

S3 Ep68: Bugs, scams, privacy …and fonts?! [Podcast + Transcript]

By Paul Ducklin — February 3rd 2022 at 16:20
Latest episode - listen now!

☐ ☆ ✇ Naked Security

Check your patches – public exploit now out for critical Exchange bug

By Paul Ducklin — November 23rd 2021 at 14:36
It was a zero-day bug until Patch Tuesday, now there's an anyone-can-use-it exploit. Don't be the one who hasn't patched.

☐ ☆ ✇ Naked Security

Apple ships Monterey with security updates, fixes 0-day in Watch and TV products, updates iDevices

By Paul Ducklin — October 27th 2021 at 22:16
A slew of security bulletins from Apple HQ, including 37 bugs listed as fixed in the initial public release of macOS Monterey.

☐ ☆ ✇ Naked Security

S3 Ep54: Another 0-day, double Apache patch, and Fight The Phish [Podcast]

By Paul Ducklin — October 14th 2021 at 18:33
Latest episode - listen now!

☐ ☆ ✇ McAfee Blogs

Microsoft Urges Customers to Update Windows as Soon as Possible

By McAfee — July 8th 2021 at 20:35

What happened  

Microsoft has shipped an emergency security update affecting most Windows users. This update partially addresses a security vulnerability known as PrintNightmare that could allow remote hackers to take over your system.  

How does this affect you?  

PrintNightmare could allow hackers to gain control of your computer. This means hackers could perform malicious activities like installing their own apps, stealing your data, and creating new user accounts.  

How to fix the issue

Microsoft recommends Windows 10, 8.1, and 7 users update their computers through Windows Update as soon as possible. Note that an additional patch will likely be required to fully fix the issue, so expect another update prompt from Microsoft in the days to come. 

Additional protection 

For extra protection against malware that may result from a hack like this one, we recommend an all-in-one security solution, like McAfee Total Protection or McAfee LiveSafeIf a hacker takes advantage of the exploit and tries to install additional malware, McAfee Total Protection/LiveSafe can help protect against those attempts. Learn more about our online security products here. 

An alternate solution for tech-savvy Windows users 

PrintNightmare exploits a vulnerability in the Windows Print Spooler service. The step-by-step instructions below will guide you through turning off the service to ensure hackers can no longer exploit the security flaw. The Print Spooler will remain off until the PC is rebooted.   

Step 1: Press the Windows key, and type Services, clicking on the Services App 

Zero Day Vulnerability

Step 2: Scroll down to the Print Spooler Service 

Zero Day Vulnerability

Step 3: Right-click on the Print Spooler Service and click Stop. 

Zero Day Vulnerability

The post Microsoft Urges Customers to Update Windows as Soon as Possible appeared first on McAfee Blogs.

❌