WhatsApp may expose the OS you use to run it – which could expose you to crooks
Messaging service creates persistent user IDs that have different qualities on each device
https://www.theregister.com/2024/10/16/whatsapp_privacy_concerns/
Messaging service creates persistent user IDs that have different qualities on each device
https://www.theregister.com/2024/10/16/whatsapp_privacy_concerns/
The Register
WhatsApp may expose the OS you use to run it – which could expose you to crooks
Meta knows messaging service creates persistent user IDs that have different qualities on each device
Multiple Splunk Enterprise Vulnerabilities Let Attackers Execute Remote Code
https://research.kudelskisecurity.com/2024/10/16/splunk-enterprise-multiple-vulnerabilities-for-rce/
https://research.kudelskisecurity.com/2024/10/16/splunk-enterprise-multiple-vulnerabilities-for-rce/
Kudelski Security Research
Splunk Enterprise Multiple Vulnerabilities for RCE
Summary Splunk has disclosed several high-severity vulnerabilities in Splunk Enterprise and Splunk Cloud Platform, which allowattackers to execute remote code on vulnerable systems. The vulnerabili…
Critical hardcoded SolarWinds credential now exploited in the wild
A critical, hardcoded login credential in SolarWinds' Web Help Desk line has been exploited in the wild by criminals..:
https://www.theregister.com/2024/10/16/solarwinds_critical_hardcoded_credential_bug/
A critical, hardcoded login credential in SolarWinds' Web Help Desk line has been exploited in the wild by criminals..:
https://www.theregister.com/2024/10/16/solarwinds_critical_hardcoded_credential_bug/
The Register
Critical hardcoded SolarWinds credential now exploited in the wild
Another blow for IT software house and its customers
How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends
https://cloud.google.com/blog/topics/threat-intelligence/time-to-exploit-trends-2023
https://cloud.google.com/blog/topics/threat-intelligence/time-to-exploit-trends-2023
Google Cloud Blog
How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends | Google Cloud Blog
Mandiant analyzed 138 vulnerabilities that were disclosed in 2023 and that we tracked as exploited in the wild.
New macOS vulnerability, “HM Surf”, could lead to unauthorized data access
https://www.microsoft.com/en-us/security/blog/2024/10/17/new-macos-vulnerability-hm-surf-could-lead-to-unauthorized-data-access/
https://www.microsoft.com/en-us/security/blog/2024/10/17/new-macos-vulnerability-hm-surf-could-lead-to-unauthorized-data-access/
Microsoft News
New macOS vulnerability, “HM Surf”, could lead to unauthorized data access
Microsoft Threat Intelligence uncovered a macOS vulnerability that could potentially allow an attacker to bypass the operating system’s Transparency, Consent, and Control (TCC) technology and gain unauthorized access to a user’s protected data. The vulnerability…
The Ultimate Guide to Fine-Tuning LLMs from Basics to Breakthroughs:
An Exhaustive Review of Technologies, Research, Best Practices, Applied Research Challenges and Opportunities
(Version 1.0)
https://arxiv.org/html/2408.13296v2
An Exhaustive Review of Technologies, Research, Best Practices, Applied Research Challenges and Opportunities
(Version 1.0)
https://arxiv.org/html/2408.13296v2
Call and Register — Relay Attack on WinReg RPC Client
https://www.akamai.com/blog/security-research/2024/oct/winreg-relay-vulnerability
https://www.akamai.com/blog/security-research/2024/oct/winreg-relay-vulnerability
Akamai
Call and Register — Relay Attack on WinReg RPC Client | Akamai
Akamai researchers explore a new vulnerability that can be exploited to lead to elevation of privilege attacks against Windows machines.
Trojanized Ethers Forks on npm Attempting to Steal Ethereum Private Keys
https://blog.phylum.io/trojanized-ethers-forks-on-npm-attempting-to-steal-ethereum-private-keys/
https://blog.phylum.io/trojanized-ethers-forks-on-npm-attempting-to-steal-ethereum-private-keys/
Phylum Research | Software Supply Chain Security
Trojanized Ethers Forks on npm Attempting to Steal Ethereum Private Keys | Phylum
Software supply chain attack targets open-source developers in npm via malicious packages that steal Ethereum private keys, gain SSH persistence.
macOS NotLockBit | Evolving Ransomware Samples Suggest a Threat Actor Sharpening Its Tools
https://www.sentinelone.com/blog/macos-notlockbit-evolving-ransomware-samples-suggest-a-threat-actor-sharpening-its-tools/
https://www.sentinelone.com/blog/macos-notlockbit-evolving-ransomware-samples-suggest-a-threat-actor-sharpening-its-tools/
SentinelOne
macOS NotLockBit | Evolving Ransomware Samples Suggest a Threat Actor Sharpening Its Tools
An unknown threat actor is developing ransomware to lock files and steal data on macOS, and it's not LockBit.
A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from the local unprivileged user.
https://access.redhat.com/security/cve/CVE-2024-9050
https://access.redhat.com/security/cve/CVE-2024-9050
identity-security-threat-landscape-2024-report.pdf
11.5 MB
Threat Landscape Report 2024
qBittorrent fixes flaw exposing users to MitM attacks for 14 years
https://www.bleepingcomputer.com/news/security/qbittorrent-fixes-flaw-exposing-users-to-mitm-attacks-for-14-years/
https://www.bleepingcomputer.com/news/security/qbittorrent-fixes-flaw-exposing-users-to-mitm-attacks-for-14-years/
BleepingComputer
qBittorrent fixes flaw exposing users to MitM attacks for 14 years
qBittorrent has addressed a remote code execution flaw caused by the failure to validate SSL/TLS certificates in the application's DownloadManager, a component that manages downloads throughout the app.