Oracle announced 441 new security patches for its April 2024 Critical Patch Update, with over 200 of them fixing flaws that could be exploited by remote, unauthenticated attackers. Oracle’s advisory reported that about 230 unique CVEs were found in Oracle’s April 2024 CPU, with over 30 security patches addressing critical-severity …
Read More »ALERT
18 data centers involve crypto mining secretly
18 companies in Sweden pretended to be legitimate data centers for AI or other activities, but actually evaded taxes and exploited tax incentives to mine cryptocurrency. The Swedish tax agency Skatteverket is requiring almost 1 billion kronor ($91 million) in extra taxes. The Swedish Tax Agency audited 21 companies running …
Read More »CISA Releases Four Industrial Control Systems Advisories
CISA released four advisories about Industrial Control Systems (ICS) on April 16, 2024. They contain important information about security issues, vulnerabilities, and exploits related to ICS. ICSA-24-107-01 Measuresoft ScadaPro ICSA-24-107-02 Electrolink FM/DAB/TV Transmitter ICSA-24-107-03 Rockwell Automation ControlLogix and GuardLogix ICSA-24-107-04 RoboDK RoboDK CISA encourages users and administrators to review the …
Read More »
Forescout Research
“Connect:fun” a campaign targeting FortiClient EMS via CVE-2023-48788
Utilizing Fortinet’s FortiClient EMS a news campaign has emerged. According to Vedere labs of forescout’s report this campaign leverages a critical vulnerability identified as CVE-2023-48788 and The campaign has been active since at least 2022 as stated the report. CVE-2023-48788: According to the official documentation, FortiClient Enterprise Management Server (EMS) …
Read More »CISA, FBI Joint Guidance on Deploying AI Systems Securely
The NSA AISC recently released a cybersecurity information sheet called “Deploying AI Systems Securely”. This sheet was developed in partnership with CISA, the FBI, ASD ACSC, CCCS, NCSC-NZ, and NCSC-UK. The guidance provides best practices for deploying and operating externally developed artificial intelligence (AI) systems and aims to: Improve the …
Read More »
Blackberry blogs
“LightSpy” campaign targets Southern Asia, Possibly India
LightSpy mobile espionage campaign, which focuses on targets in Southern Asia and probably India, potentially indicating a renewed focus and grow tensions in the region. VirusTotal submissions from India suggest potential victims within its borders, aligning with recent warnings by Apple on detections within the same country. Technical Details: Infection …
Read More »Palo Alto Releases Urgent Fixes for PAN-OS Vulnerability
Palo Alto Networks released hotfixes to fix a serious security flaw in PAN-OS software, being actively exploited. The CVE-2024-3400 vulnerability has a critical CVSS score of 10.0. It is a command injection flaw in the globalProtect feature that allows an unauthenticated attacker to run any code with root privileges on …
Read More »Hackers Manipulate GitHub Search to Deliver Malware to developer
Checkmarx researchers found that hackers are using GitHub search results to distribute long-lasting malware to developers’ computers. The attackers in this campaign make harmful repositories with popular names and topics. They use techniques like automated updates and fake stars to improve search rankings. “By leveraging GitHub Actions, the attackers automatically …
Read More »Google Cloud and Palo Alto Networks joins for Cloud-Native NGFW Service
Google Cloud and Palo Alto Networks to announce the release of Google Cloud Next-Generation Firewall (NGFW) Enterprise. The managed firewall service, powered by Palo Alto Networks security technology, provides strong threat prevention features needed for cloud-based business operations. Google Cloud NGFW Enterprise provides advanced Layer 7 security features to protect …
Read More »
ALERT
Bitdefender Critical Vulns Let Attackers Gain Control Over System
The Bitdefender GravityZone Update Server is vulnerable to server-side request forgery (SSRF) because of an incorrect regular expression. Bitdefender’s GravityZone: Bitdefender’s GravityZone Update Server has a critical vulnerability with a CVSS score of 8.1. It could allow an attacker remote network access to compromise the server with low privileges. Bitdefender …
Read More »