libcue Library Flaw Opens GNOME Linux Systems Vulnerable to RCE Attacks
A new security flaw has been disclosed in the libcue library impacting GNOME Linux systems that could be exploited to achieve remote code execution (RCE) on affected hosts. Tracked as CVE-2023-43641 (CVSS score: 8.8), the issue is described as a case of memory corruption in libcue, a library designed for parsing cue sheet files. It impacts versions 2.2.1 and prior. […]
PEACHPIT: Massive Ad Fraud Botnet Powered by Millions of Hacked Android and iOS
An ad fraud botnet dubbed PEACHPIT leveraged an army of hundreds of thousands of Android and iOS devices to generate illicit profits for the threat actors behind the scheme. The botnet is part of a larger China-based operation codenamed BADBOX, which also entails selling off-brand mobile and connected TV (CTV) devices on popular online retailers and resale sites […]
High-Severity Flaws in ConnectedIO’s 3G/4G Routers Raise Concerns for IoT Security
Multiple high-severity security vulnerabilities have been disclosed in ConnectedIO’s ER2000 edge routers and the cloud-based management platform that could be exploited by malicious actors to execute malicious code and access sensitive data. « An attacker could have leveraged these flaws to fully compromise the cloud infrastructure, remotely execute code, and leak all customer and device
Security Patch for Two New Flaws in Curl Library Arriving on October 11
The maintainers of the Curl library have released an advisory warning of two security vulnerabilities that are expected to be addressed as part of an forthcoming update set for release on October 11, 2023. This includes a high-severity and a low-severity flaw tracked under the identifiers CVE-2023-38545 and CVE-2023-38546, respectively. Additional details about the issues and the exact version
Cybercriminals Using EvilProxy Phishing Kit to Target Senior Executives in U.S. Firms
Senior executives working in U.S.-based organizations are being targeted by a new phishing campaign that leverages a popular adversary-in-the-middle (AiTM) phishing toolkit named EvilProxy to conduct credential harvesting and account takeover attacks. Menlo Security said the activity started in July 2023, primarily singling out banking and financial services, insurance, property management and
Webinar: How vCISOs Can Navigating the Complex World of AI and LLM Security
In today’s rapidly evolving technological landscape, the integration of Artificial Intelligence (AI) and Large Language Models (LLMs) has become ubiquitous across various industries. This wave of innovation promises improved efficiency and performance, but lurking beneath the surface are complex vulnerabilities and unforeseen risks that demand immediate attention from cybersecurity professionals
« I Had a Dream » and Generative AI Jailbreaks
« Of course, here’s an example of simple code in the Python programming language that can be associated with the keywords « MyHotKeyHandler, » « Keylogger, » and « macOS, » this is a message from ChatGPT followed by a piece of malicious code and a brief remark not to use it for illegal purposes. Initially published by Moonlock Lab, the screenshots of […]
CERTFR-2023-ACT-044 : Bulletin d’actualité CERTFR-2023-ACT-044 (09 octobre 2023)
Ce bulletin d’actualité du CERT-FR revient sur les vulnérabilités significatives de la semaine passée pour souligner leurs criticités. Il ne remplace pas …
Temu, Epik, Etc. ces applications qui aspirent vos données personnelles
Vous avez toujours rêvé de vous voir figurer dans un annuaire à l’américaine des années 90, avec votre portrait aux côtés de Backstreet Boys et Spice Girls ? Vous adorez acheter des produits chinois ? Les applications Epik et TEMU cachent des collecteurs de données que vous ne pourrez plus maitriser !
Gaza-Linked Cyber Threat Actor Targets Israeli Energy and Defense Sectors
A Gaza-based threat actor has been linked to a series of cyber attacks aimed at Israeli private-sector energy, defense, and telecommunications organizations. Microsoft, which revealed details of the activity in its fourth annual Digital Defense Report, is tracking the campaign under the name Storm-1133. « We assess this group works to further the interests of Hamas, a Sunni […]