October, 2024

• 21 October

  2nd time hacker breached Internet Archive

  

  The Internet Archive was breached again, this time through their Zendesk email support platform, following warnings that threat actors had stolen exposed GitLab authentication tokens. Bleeping computer reported, Since last night, the authority received numerous messages from people who received replies to their old Internet Archive removal requests, warning that …

  Read More »
• 20 October

  Vulnhuntr: A Tool for Finding Exploitable Vulnerabilities with LLMs

  

  In today’s changing cybersecurity environment, it’s essential to find vulnerabilities in code. Vulnhuntr, an open-source tool on GitHub, uses Large Language Models (LLMs) and static code analysis to detect remotely exploitable vulnerabilities in Python projects. Its user-friendly design combines intelligent automation with thorough code analysis, making it a valuable resource …

  Read More »
• 18 October

  Critical Vulnerabilities in Bitdefender Total Security Expose Users to MITM

  

  Bitdefender said a vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software fails to properly validate website certificates. Specifically, if a site certificate lacks the “Server Authentication” specification in the Extended Key Usage extension, the product does not verify the certificate’s compliance with the site, …

  Read More »
• 17 October

  Microsoft’s Alarming Report: 600 Million Cyberattacks perday

  

  Cybersecurity threats have surged to extraordinary heights, as Microsoft’s latest Digital Defense Report reveals that its customers are confronted with over 600 million cyberattacks every day. The report highlights that cyber operations play a crucial role in geopolitical conflicts, used for espionage, influence, and destruction. The cooperation between nation-states and …

  Read More »
• 17 October

  CVE-2024-38814
  VMware fixes high-severity SQL injection flaw in HCX

  

  VMware has issued a warning about a remote code execution vulnerability, CVE-2024-38814, with a CVSS score of 8.8, in its HCX application mobility platform. An authenticated SQL injection vulnerability in HCX was privately reported to VMware by Sina Kheirkhah from the Summoning Team through the Trend Micro Zero Day Initiative. …

  Read More »
• 17 October

  Over 90 Zero-Days, 40+ N-Days Exploited In The Wild

  

  Mandiant researchers found that over 90 zero-day vulnerabilities and more than 40 known vulnerabilities were exploited in the wild. Vulnerabilities Exploited: A comprehensive vulnerability analysis by “Mandiant” for 2023 uncovered “138” actively exploited “security vulnerabilities.” They identified a significant prevalence of “97 zero-day vulnerabilities” and “41 n-day vulnerabilities” (the latter …

  Read More »
• 16 October

  Oracle Security Update, 334 Vulnerabilities Patched

  

  Oracle’s October 2024 Critical Patch Update has fixed 334 security vulnerabilities in its products. The CPU affects 28 Oracle product families, with patches for various severity levels. Notably, there are 35 critical updates that fix 16 high-risk vulnerabilities. The Critical Patch Update includes new security patches for Oracle product families. …

  Read More »
• 16 October

  Chrome 130 Launches with Patches for 17 Security Vulnerabilities

  

  Google has released Chrome 130, fixing 17 security vulnerabilities. The update (version 130.0.6723.58/.59 for Windows and Mac, and 130.0.6723.58 for Linux) will be gradually rolled out to users in the coming days and weeks. The most severe vulnerability is CVE-2024-9954, a high-severity use-after-free flaw in Chrome’s AI component. Reported by …

  Read More »
• 16 October

  Researchers Break RSA Encryption with Quantum Computing

  

  Chinese researchers, led by Wang Chao from Shanghai University, have cracked RSA encryption using quantum computers. This achievement raises serious concerns about the future of cryptographic systems, as quantum computers can now threaten long-standing methods of global data security. The Research Breakthrough: Cracking RSA Encryption A study in the Chinese …

  Read More »
• 15 October

  Shadowserver's data
  87000+ Fortinet devices still open to attack?

  

  On Sunday, the Shadowserver Foundation revealed that over 87,000 internet-facing Fortinet devices may still be at risk due to (CVE-2024-23113) vulnerability. About CVE-2024-23113: CVE-2024-23113, a format string vulnerability that affects the FortiOS FGFM (FortiGate to FortiManager) daemon and can be triggered via specially crafted requests, was discovered and reported by …

  Read More »