Hello all, Cisco decided to grace us with a major vulnerability, SolarWinds is trying a third time to fix a defect, ransomware is severely impacting European airports, supply chain attacks on NPM packages by worms from Dune, and Windows 25H2 coming soon are just some of the items covered in the…
Hello all, Happy Fall! Another week of lots of excitement in our world of cyber defense. The biggest news is that Apple somehow lost versions 19 – 25 of their operating system, going right to version 26. And several firewall vendors have had a bad week with vulnerabilities, zero-days, and a…
Hello all, This past week was Patch Tuesday for Microsoft and a number of other vendors, when as usual, dozens and dozens of vulnerabilities and defects were announced. The clock is now ticking for threat actors to exploit them before defenders patch them. The race is on! The Salesloft Drift hack…
Hello all, This past week was busy, even into the weekend, with reports of hundreds of companies compromised via Salesloft Drift, Microsoft being forced to reroute traffic stemming from several Red Sea cables being cut, Google dodging a bullet in court and also patching a couple of zero-days in Android, and…
Hello all, The unofficial end of summer is here – Labor Day – observed by the United States and Canada, and nothing is different in the world of cyber security. Evil people are still perpetrating their vile crimes, earning themselves a toasty place in hades, and defenders are still diligently at…
Hello all, Perhaps it is because I’m becoming jaded to all of the incessant histrionics about the latest new zero-day vulnerability, and the patches needed to fix flaws, and threat actors scoring big yet again; but there wasn’t much that stood out as headline newsworthy this week. There was a bit…
Hello all, I knew it would be a busy week since it was Patch Tuesday, but I didn’t know it would be this busy. Hundreds of new vulnerabilities were reported that need evaluation, prioritization, and remediation. Some of the reveals are as a result of discoveries unveiled at Black Hat or…
Hello all, Hacker Summer Camp in Las Vegas has now concluded. There were quite a few new vulnerabilities and security gaps revealed, along with a nice quantity of new and interesting products. Expect that the next couple of weeks will have an increased amount warnings and patches as products and services…
Links to items mentioned in the video presentation. State Sponsored Breaches and Embedding Fake CAPTCHA, Malvertising, and Scareware via pop-ups Phishing, Spear-Phishing, Whaling, Vishing, Quishing, and Smishing Password Hacking, Account Takeovers, and MFA bypass …
Hello all, Most of last week was quiet with a steady rumble of Microsoft sourced phishing emails growing in popularity, and then toward the latter part of the week Arctic Wolf and Huntress warned about a concerning increase in successful attacks against SonicWall firewalls. More on that in a moment. Meanwhile,…
Hello all, Last week I warned about a new zero-day in Microsoft SharePoint on-premises that had just become public knowledge. It escalated quickly, not necessarily with threat actor activity, but with news articles and cyber professionals everywhere urging action. With potentially tens of thousands of vulnerable targets it looked like it…
Hello all, What started out as a somewhat quiet week, with only one nasty item early on from Google Chrome, escalated slowly with the last few days bringing reveals of multiple critical and high-severity vulnerabilities in products by Cisco, CrushFTP, HPE, Microsoft, Sophos, Symantec and more. To offset some of the…