Cyber

Critical WordPress plugin vulnerability under active exploit threatens thousands

Vulnerability with severity rating of 9.8 out of possible 10 still live on >8,000 sites. Credit: Getty Images Thousands of sites running WordPress remain unpatched against a critical security flaw in...

5 charged in “Scattered Spider,” one of the most profitable phishing scams ever

Phishing attacks were so well-orchestrated that they fooled some of the best in the...

Hundreds of code libraries posted to NPM try to install malware on dev machines

These are not the the developer tools you think they are. Credit: Getty Images An ongoing...

Android Trojan that intercepts voice calls to banks just got more stealthy

FakeCall malware can reroute calls intended for banks to attacker-controlled numbers. Credit: Getty Images Researchers have...

Systems used by courts and governments across the US riddled with vulnerabilities

With hundreds of courts and agencies affected, chances are one near you is, too. Public...

Threat actors exploited Windows 0-day for more than a year before Microsoft fixed it

The goal of the exploits was to open Explorer and trick targets into running malicious code. Threat actors carried out zero-day attacks that targeted Windows...

To guard against cyberattacks in space, researchers ask “what if?”

A hack on satellites could cripple much of our digital infrastructure. If space systems such as GPS were hacked and knocked offline, much of the world...

384,000 sites pull code from sketchy code library recently bought by Chinese firm

Many website admins, it seems, have yet to get memo to remove Polyfillio links. More than 384,000 websites are linking to a site that was...

“RegreSSHion” vulnerability in OpenSSH gives attackers root on Linux

Full system compromise possible by peppering servers with thousands of connection requests. Researchers have warned of a critical vulnerability affecting the OpenSSH networking utility that...

3 million iOS and macOS apps were exposed to potent supply-chain attacks

Apps that used code libraries hosted on CocoaPods were vulnerable for about 10 years. Vulnerabilities that went undetected for a decade left thousands of macOS...

Mac users served info-stealer malware through Google ads

Full-service Poseidon info stealer pushed by "advertiser identity verified by Google." Mac malware that steals passwords, cryptocurrency wallets, and other sensitive data has been spotted...

High-severity vulnerabilities affect a wide range of Asus router models

Many models receive patches; others will need to be replaced. Enlarge Hardware manufacturer Asus has released updates patching multiple critical vulnerabilities that allow hackers to remotely...

China state hackers infected 20,000 Fortinet VPNs, Dutch spy service says

Critical code-execution flaw was under exploitation 2 months before company disclosed it. Hackers working for the Chinese government gained access to more than 20,000 VPN...

Ransomware gangs are adopting “more brutal” tactics amid crackdowns

Researchers fear real-world violence as law enforcement plays Whac-A-Mole with gangs. Today, people around the world will head to school, doctor’s appointments, and pharmacies, only...

Nasty bug with very simple exploit hits PHP just in time for the weekend

With PoC code available and active Internet scans, speed is of the essence. A critical vulnerability in the PHP programming language can be trivially exploited...

FCC pushes ISPs to fix security flaws in Internet routing

Chair: Addressing BGP flaws will "help make our Internet routing more secure." The Federal Communications Commission wants to verify that Internet service providers are strengthening...

What kind of bug would make machine learning suddenly 40% worse at NetHack?

One day, a roguelike-playing system just kept biffing it, for celestial reasons. Members of the Legendary Computer Bugs Tribunal, honored guests, if I may have...

Ticketmaster hacked in what’s believed to be a spree hitting Snowflake customers

Researcher says Snowflake customers hit by mass scraping ... "but nobody noticed." Cloud storage provider Snowflake said that accounts belonging to multiple customers have been...

Federal agency warns critical Linux vulnerability being actively exploited

Cybersecurity and Infrastructure Security Agency urges affected users to update ASAP. The US Cybersecurity and Infrastructure Security Agency has added a critical security bug in...
HomeCyber