#security-vulnerabilities
#security-vulnerabilities

Microsoft fixes the fixes that broke Windows tools

Apart from affected clients running Windows 11 v23H2 and Windows 11 v22H2, the bug affected systems running Windows Server 2022 and Windows Server 2019.

Information security

fromInfoWorld

Google adds VM monitoring to Database Center amid enterprise demand

"The holistic visibility helps identify critical security vulnerabilities, improve security posture, and simplify compliance," said Charlie Dai, VP and principal analyst at Forrester.

Privacy professionals

fromComputerworld

For August, a 'complex' Patch Tuesday with 111 updates

Microsoft's August Patch Tuesday release offers 111 fixes affecting Windows, Office, SQL Server, and Exchange Server, requiring immediate attention for several vulnerabilities.

Privacy technologies

fromWIRED

Hackers Went Looking for a Backdoor in High-Security Safes-and Now Can Open Them in Seconds

Researchers James Rowley and Mark Omo uncovered vulnerabilities in Securam Prologic locks, allowing unauthorized access to electronic safes from various brands.

Information security

Privacy technologies

fromWIRED

A Misconfiguration That Haunts Corporate Streaming Platforms Could Expose Sensitive Data

Design flaws in streaming service APIs allow unauthorized access to content without subscription.

Ruby on Rails

RubyGems, PyPI Hit by Malicious Packages Stealing Credentials, Crypto, Forcing Security Changes

60 malicious RubyGems packages target unsuspecting users, posing as automation tools to steal credentials.

fromComputerWeekly.com

Attacker could defeat Dell firmware flaws with a vegetable | Computer Weekly

The vulnerabilities on ControlVault USHs were potentially highly dangerous. These laptop models are widely-used in the cybersecurity industry, government settings and challenging environments in their rugged version.

Privacy technologies

fromTechCrunch

Sex toy maker Lovense threatens legal action after fixing security flaws that exposed users' data | TechCrunch

Lovense fixed security vulnerabilities that exposed emails and allowed account takeovers but is considering legal action over reported disclosures.

Artificial intelligence

NVIDIA Triton Bugs Let Unauthenticated Attackers Execute Code and Hijack AI Servers

New security flaws in NVIDIA's Triton Inference Server could allow remote control of servers through a series of vulnerabilities.

#cybersecurity

Privacy professionals

Critical Flaws in Niagara Framework Threaten Smart Buildings and Industrial Systems Worldwide

DevOps

Inside the Mind of the Adversary: Why More Security Leaders Are Selecting AEV

Information security

How Breaches Start: Breaking Down 5 Real Vulns

Privacy professionals

Critical Flaws in Niagara Framework Threaten Smart Buildings and Industrial Systems Worldwide

DevOps

Inside the Mind of the Adversary: Why More Security Leaders Are Selecting AEV

Information security

How Breaches Start: Breaking Down 5 Real Vulns

DJI couldn't confirm or deny it disguised this drone to evade a US ban

DJI's drones are largely absent from the U.S. market, leading to alternatives like the SkyRover X1, closely resembling DJI products.

fromsfist.com

Sam Altman Warns of Coming AI-Created 'Fraud Crisis'

I am very nervous that we have an impending, significant, impending fraud crisis. A thing that terrifies me is apparently there are still some financial institutions that will accept a voice print as authentication for you to move a lot of money.

Privacy professionals

Software development

Curl creator mulls nixing bug bounty awards to stop AI slop

Generative AI tools have led to an increase in low-quality bug reports for the curl utility.

#bitchat

fromFuturism

Privacy technologies

Jack Dorsey's New App Just Hit a Very Embarrassing Snag

fromTechCrunch

Privacy technologies

Jack Dorsey says his 'secure' new Bitchat app has not been tested for security | TechCrunch

fromFuturism

Privacy technologies

Jack Dorsey's New App Just Hit a Very Embarrassing Snag

fromTechCrunch

Privacy technologies

Jack Dorsey says his 'secure' new Bitchat app has not been tested for security | TechCrunch

Veeam fixes another critical RCE bug in Backup & Replication

Users of Veeam Backup & Replication should urgently apply the latest patches to fix a critical remote code execution vulnerability.

Privacy technologies

Sitecore fixes pre-auth RCE exploits in enterprise CMS

A pre-authentication exploit chain in Sitecore CMS could lead to full system takeover, affecting major companies.

Researchers found hardcoded passwords and other vulnerabilities in Sitecore CMS, posing serious security risks.

Information security

fromSecuritymagazine

40,000 IoT Security Cameras Are Exposed Online

Exposed IoT cameras worldwide pose significant security risks, potentially enabling espionage and cyberattacks.

HPE Issues Security Patch for StoreOnce Bug Allowing Remote Authentication Bypass

These vulnerabilities could be remotely exploited to allow remote code execution, disclosure of information, server-side request forgery, authentication bypass, arbitrary file deletion, and directory traversal information disclosure vulnerabilities.

Information security

New Linux Flaws Allow Password Hash Theft via Core Dumps in Ubuntu, RHEL, Fedora

Vulnerabilities in apport and systemd-coredump can let local attackers access sensitive information through race conditions.

Node JS

fromThe Cyber Express

Multer Vulnerabilities Expose Node.js Apps To DoS Attacks

Two critical vulnerabilities in Multer could crash Node.js applications through malformed uploads, emphasizing the need for immediate updates.

Tech industry

Intel data-leaking Spectre defenses scared off once again

ETH Zurich researchers developed a method to bypass Intel's protections against Spectre vulnerabilities, highlighting ongoing security concerns.

Information security

ASUS Patches DriverHub RCE Flaws Exploitable via HTTP and Crafted .ini Files

ASUS patches critical security flaws in DriverHub that could allow remote code execution through crafted HTTP requests.

Artificial intelligence

fromInfoQ

Meta Launches AutoPatchBench to Evaluate LLM Agents on Security Fixes

AutoPatchBench evaluates LLM agents' ability to autonomously patch security vulnerabilities in C/C++ code.

Web frameworks

fromInfoQ

Spring News Roundup: RCs of Spring Boot, Data, Security, Auth, Session, Integration, Web Services

Recent updates in the Spring ecosystem include significant release candidates for Spring Boot and Spring Data, enhancing features and addressing vulnerabilities.

The splintering of a standard bug tracking system has begun

"Dependence on the largesse of a single, and now volatile, government48;that's a serious flaw. The CVE funding fiasco is a wake-up call for the industry."

Privacy professionals

Apple

fromZDNET

Update your iPhone now to patch a CarPlay glitch and two serious security flaws

iOS 18.4.1 fixes CarPlay issues and crucial security vulnerabilities in iPhones.

Privacy professionals

fromBusiness Matters

Ensuring Compliance with Industry Standards Through Code Review Services

Code reviews are essential for maintaining compliance and ensuring high-quality software in regulated industries.

London startup

fromDeveloper Tech News