(For a video version of the introduction below, click here)
Hello all,
Unlike last week’s patch-release frenzy, things dropped back to our normal harried pace this week. We did receive warnings about some pretty nasty defects from the likes of IBM, Synology, TP-Link, Veeam, and WhatsApp, just to name a few. So let’s move onto the notable news items of the week.
Headline NEWS:
- Google made the headlines a few times, the first was as a result of their $32 billion acquisition of the Israeli Cybersecurity firm Wiz, which specializes in cloud security. Both Google and Wiz have assured clients that Wiz’s multi-cloud functionality will continue, and Wiz will not become Google Cloud only. Couple this news with Google’s recent purchase of security firm Mandiant and it paints a clear picture that Cybersecurity is a major focus at the Googleplex.
- Also in Google news, the US Justice Department wants Google to sell off their Chrome browser and possibly even Android business, stating that “Google’s anticompetitive conduct has denied users of a basic American value—the ability to choose in the marketplace.” It is the reward for being a successful business, being told that you’re too big. The implications of this draconian action are far-reaching as Mozilla Firefox derives a major portion of their income from promoting Google search, and if that source dries up, the red fox may starve.
- IBM has a couple of holes apparently large enough to be seen from China. They scored a perfect 10 out of 10 on the Common Vulnerabilities Scoring System (CVSS) for one, and a 9.8 for the other. They are in their Advanced Interactive eXecutive operating system (AIX OS). This is used in an estimated 9,000 organizations, running critical applications. If this is you, patch immediately!
- TP-Link has a newly published hole in their TL-WR845N routers. They also got a 9.8 on CVSS. Unfortunately, as of publication time, there was no patch yet from TP-Link. There is some mitigation guidance in our linked article, follow it if you have one of these devices, and I’d recommend that you replace it with another brand as soon as possible as this seems to be a regular occurrence with this vendor.
- Veeam issued a patch for a critical defect in their Backup and Replication software that scored a 9.9 on CVSS, which, if exploited could allow “remote code execution (RCE) by authenticated domain users”. There is a glimmer of good news. If you followed their best practices and didn’t domain-join your Veeam server, you are not susceptible to this defect. Nevertheless, you should apply this patch as soon as possible to plug this hole and any ancillary ones that could be lurking.
In Ransomware, Malware, and Vulnerabilities News:
- Why Are Young Adults Vulnerable to Phishing Scams is a fascinating dive into this troubling phenomenon that exists among a population that we generally consider to be highly digitally literate. It turns out that the reason is “FOMO”, Fear Of Missing Out.” Rather than scrutinizing a suspicious link, they often simply check if the sender is familiar.” Scammers are well aware of the lower impulse control of youth and are actively phishing this demographic on social media sites. The article encourages more cybersecurity training at an earlier age in schools. I fully agree. We have driver’s education for a reason, we should also have cybersecurity education for very similar reasons.
In Other News Events of Note and Interest:
- Microsoft Patch Tuesday uninstalled Copilot for many people when it rolled out last week. Unfortunately for the opponents of the AI apocalypse, their rejoicing was cut short when Microsoft noticed their error and restored their digital spy.
Musings:
Automatic updates are both a godsend and a bane. When they work, they are wonderful in that your product is automatically secured by your software or hardware vendor at regular intervals or when warranted. Unfortunately, there is the flip side when automatic updates go wrong. The result can be a bit of inconvenience when something doesn’t work, or it can be CrowdStrike catastrophic and take down massive portions of what you or your enterprise need to do business. It is high time that we have reliable auto-updates in all of our products. For our part, as defenders, we can ensure that we have backups and snapshots to restore to if something does fail. But we also need to examine our complex interactions of hardware and multiple software products and simplify so that automatic updates are trivial, allowing us to activate them. The only alternative is to carefully vet that any updates are pre-tested against our particular configuration before rolling it out to production. I’m truly hopeful that AI will be the magic bullet that will be able to model the various software and hardware interactions involved, finally making error-free patching a reality.
Keep the shields up!
Viscount Jan Broucinek
Red Dot Security News
Headline NEWS
- Google announces agreement to acquire Wiz
- Google to acquire Wiz for $32 billion
- Justice Department asks judge to order Google the “immediate” sale of Chrome
- IBM scores perfect 10 … vulnerability in mission-critical OS AIX
- The Israeli Startup That Just Inked the Largest Cybersecurity Deal Ever
- Hackers Exploiting TP-Link Vulnerability to Gain Root Access
- Veeam Patches Critical Vulnerability in Backup & Replication
Ransomware, Malware, and Vulnerabilities News
- CISA tags NAKIVO backup flaw as actively exploited in attacks
- Inspector General Report Points to Banks’ Cybersecurity Risks
- Lawmakers probe DHS cyber ‘Typhoon’ response, future of CSRB
- Critical AMI MegaRAC bug can let attackers hijack, brick servers
- Critical Synology Vulnerability Let Attackers Remote Execute Arbitrary Code
- Dell Warns of Multiple Secure Connect Gateway Vulnerabilities Let Compromise System
- FBI warns about online file converter sites which install malware, steal private information
- Half of login attempts use leaked passwords
- 100 Car Dealerships Hit by Supply Chain Attack
- PSA: This is one of the most sophisticated phishing attacks ever made against Mac users
- How to Protect Your Business from Cyber Threats: Mastering the Shared Responsibility Model
- Why Are Young Adults Vulnerable to Phishing Scams? Blame Social Media
- Introducing EPSS Version 4
- ChatGPT Vulnerability Exploited Against US Government Organizations
- AI is turbocharging organized crime, EU police agency warns
- How AI agents help hackers steal your confidential data – and what to do about it
- Progress from our Frontier Red Team \ Anthropic
- DeepSeek Generating Fully Working Keyloggers & Data Exfiltration Tools
- New ‘Rules File Backdoor’ Attack Lets Hackers Inject Malicious Code via AI Code Editors
- Hackers Leveraging RMM Tools To Maintain Persistence To Infiltrate And Move Through Networks
- Gartner Unveils 6 Cybersecurity Trends to Watch in 2025
- Cybercriminals Exploit CSS to Evade Spam Filters and Track Email Users’ Actions
- Fake Semrush ads used to steal SEO professionals’ Google accounts
- Attack time frames are shrinking rapidly. Here’s how cyber teams can cope.
- Bybit: 89% of stolen $1.4B crypto still traceable post-hack
- Critical Cisco Smart Licensing Utility flaws now exploited in attacks
- Apache Tomcat Vulnerability Actively Exploited Just 30 Hours After Public Disclosure
- Meta: FreeType flaw affecting multiple Linux distributions under active exploitation
- ‘Dead simple’ hijacking hole in Apache Tomcat ‘now actively exploited in the wild’
- Xerox VersaLink C7025 Multifunction printer flaws may expose Windows Active Directory credentials to attackers
- Apple’s Passwords app was vulnerable to phishing attacks for nearly three months after launch
- Next Time You Groan Doing Another Google Chrome Update, Consider This
- Windows File Explorer Vulnerability Let Attackers Perform Network Spoofing
- WhatsApp patched zero-click flaw exploited in Paragon spyware attacks
- VSCode extensions found downloading early-stage ransomware
- Gmail, Outlook users warned of dangerous threat from Medusa ransomware
- Fake “Security Alert” issues on GitHub use OAuth app to hijack accounts
- Malicious Adobe, DocuSign OAuth apps target Microsoft 365 accounts
- Microsoft: New RAT malware used for crypto theft, reconnaissance
- Microsoft Sounds Warning on Multifunctional ‘StilachiRAT’
- New BitM Attack Lets Hackers Steal User Sessions Within Seconds
- ClearFake Infects 9,300 Sites, Uses Fake reCAPTCHA and Turnstile to Spread Info-Stealers
- Large enterprises scramble after supply-chain attack spills their secrets
- Unpatched Windows Zero-Day Flaw Exploited by 11 State-Sponsored Threat Groups Since 2017
- Microsoft isn’t fixing 8-year-old shortcut exploit abused for spying
- How Economic Headwinds Affect Ransomware
- Medusa Ransomware Uses Malicious Driver to Disable Anti-Malware with Stolen Certificates
- China-Linked APT Aquatic Panda: 10-Month Campaign, 7 Global Targets, 5 Malware Families
- New Akira ransomware decryptor cracks encryptions keys using GPUs
- New Ransomware Attacks are Getting More Personal as Hackers ‘Apply Psychological Pressure’
- Extortion Reboot: Ransomware Crew Threatens Leak to Snowden
- Municipalities in four states are struggling with cyberattacks limiting services
- US teachers’ union says hackers stole sensitive personal data on over 500,000 members
- Cherokee, SC County School District offline after network security breach
- Sperm donation giant California Cryobank warns of a data breach
- Oracle denies breach after hacker claims theft of 6 million data records
- Leaked Black Basta Chats Suggest Russian Officials Aided Leader’s Escape from Armenia
- Jaguar Land Rover Breached by HELLCAT Ransomware Group Using Its Infostealer Playbook—Then a Second Hacker Strikes
- RansomHub ransomware uses new Betruger ‘multi-function’ backdoor
- Russian Seller Offering Record Breaking $4,000,000 for Telegram 0-Day Exploits
Other News Events of Note and Interest
- Cool Tool: Freeware image editor GIMP 3.0 arrives after seven years of incubation
- Amazing New Technology Can ‘Bend’ Sounds Into Your Ears Only
- NIST Finalizes Differential Privacy Rules to Protect Data
- White House instructs agencies to avoid firing cybersecurity staff
- Regulatory Reset? U.S. Cyber Incident Reporting Rules Face Congressional Scrutiny
- UK’s secret iCloud backdoor order triggers civil rights challenge
- UK urges critical orgs to adopt quantum cryptography by 2035
- Cybersecurity in healthcare: getting the basics right as bigger threats loom
- USF Launches Bellini College with $40M for AI and Cybersecurity
- Rural Hospitals Move to Enhance Cybersecurity
- Google Search charged with breaking EU antitrust rules
- Google is switching legacy G Suite accounts to pooled storage
- CISA fires, now rehires and immediately benches security crew on full pay
- Why human vulnerability is cybersecurity’s most significant and costliest weakness
- Scientists Achieve Telecom-Compatible Quantum Entanglement with Room-Temperature Memory
- Mozilla outs Firefox 136.0.2 to fix cookie-deleting issue, high CPU usage on Windows, more
- AMD 25.3.2 driver fixes major bug so Windows Update no longer installs older driver on 9070
- Nvidia says ‘the age of generalist robotics is here’
- Google recommendations for the US AI Action Plan
- AI doesn’t want you to code using AI — reduces learning opportunities
- Human Intelligence Sharply Declining
- Shoppers are flocking to AI search
- Siri has become an unmitigated disaster, and AI won’t save it
- TikTok rolls out a ‘Security Checkup’ tool to help users secure their accounts
- After 47 years, OpenVMS gets a package manager (VSP)
- Hierarchy of Needs – Predefender Threat Hunt Book
- Zuckerberg Declares the End of Mobile Phones and Confirms the Tech That’s Replacing Them
- Citrix and NVIDIA to Deliver AI Virtual Workstations, Enabling Customers to Develop and Securely Deliver AI Applications
- Microsoft: Exchange Online bug mistakenly quarantines user emails
- Microsoft wouldn’t look at a bug report without a video. Researcher maliciously complied
- Microsoft Teams Gets Live Chat Feature for Businesses
- Latest Patch Tuesday accidentally removes Copilot app from Windows, and people want that as a feature
- Sorry, Microsoft has fixed the Copilot automatic uninstall bug
- Microsoft’s Topological Qubit Claims Create Mixed Reactions
- Microsoft 365 subscribers get access to Copilot for OneDrive
- Windows 10 KB5053606 issues, install fails, printer spooler buggy and more
- Microsoft Releases New TPM Verification Tool for Windows 11 24H2
- Big Red, Microsoft roll out Azure database services for more mainstream Oracle users
- Microsoft releases new Windows Terminal updates with fixes and Mark Mode improvements
- Microsoft launches two new Microsoft 365 ‘mini apps’ to save you time and hassle