👉 What’s going on in the cyber world today?
SQL Injection, LayerSlider WordPress Plugin, YouTube, Gamers, Ivanti, Urgent Patches, 4 Gateway Flaws, Google, Chrome, Zero-Day, StrelaStealer, Outlook, Thunderbird, Apple, Global Outage, Japan, Hoya Corporation, Production Halt, Louisiana, East Baton Rouge Sheriff’s, Cybersecurity Overhaul, Indiana, Otolaryngology Associates, South Africa, Moneyweb, Banxso Report, US, UK, AI Safety, Sophos, Ransomware, Backups, University of Technology Sydney, Nonprofits, Cyber Training, Rising Chinese Devices, Malaysia, Cyber Security Bill, The Star.
Listen to the full podcast
A critical SQL injection vulnerability in LayerSlider threatens website databases, allowing attackers to extract sensitive information, including password hashes. With over a million active installations, LayerSlider’s flawed popup markup query functionality facilitates this exploit, prompting urgent updates to version 7.10.1 for impacted users.
Cybercriminals are using YouTube to distribute malware via cracked video game links, targeting unsuspecting users seeking free software upgrades. Popular gaming channels, including those with compromised or short-lived accounts, lure viewers with enticing offers, leading them to malicious downloads like Vidar Stealer. The campaign, identified by Proofpoint, highlights the vulnerability of non-enterprise users and the challenges in tracing such attacks.
Ivanti releases updates to fix four flaws in Connect Secure and Policy Secure Gateways, averting potential code execution and DoS attacks. Vulnerabilities like heap overflow and null pointer dereference in IPSec components pose significant risks to unauthenticated users, emphasizing the critical need for immediate patching. Despite ongoing security challenges, Ivanti pledges to enhance its security posture and practices to confront the evolving threat landscape with transparency and proactive measures.
Google addresses a critical security flaw in Chrome, CVE-2024-3159, exploited during Pwn2Own contest. Vulnerability in Chrome’s V8 JavaScript engine allows remote attackers to access sensitive data or execute arbitrary code. Palo Alto Networks researchers awarded $42,500 for demonstrating exploit, now patched in Chrome versions worldwide.
A sophisticated StrelaStealer variant has surfaced, posing a grave threat to Spanish-speaking users by targeting popular email clients Outlook and Thunderbird to pilfer email account credentials. This updated strain employs advanced obfuscation techniques, embedding malicious JavaScript in email attachments to execute its payload discreetly. SonicWall’s Capture Labs highlights the emergence of this potent malware, emphasizing the need for heightened cybersecurity measures to thwart its clandestine activities
Apple services, including the App Store and streaming platforms like Apple TV+ and Apple Music, experienced widespread outages affecting users across various regions. The issues, which also impacted services such as Apple Fitness+ and Arcade, lasted for over an hour, disrupting access for users in countries like the United States, Britain, India, China, and Australia. While more than 6,400 users flagged issues on the App Store, Apple TV+, and Apple Music each received over 1,000 reports during the peak of the outage, as per Downdetector.
Japanese lens maker Hoya Corp grapples with production halts following a system failure, possibly due to unauthorized access. Despite attempts to contain the issue, disruptions persist, leading to investigations and cooperation with authorities to resume operations swiftly. Hoya Vision Care Co, the company’s consumer eyeglass lens unit, apologizes for halted orders on its website, reflecting the widespread impact of the system failure across the group.
The East Baton Rouge Sheriff’s Office in Louisiana is restructuring network security after an attempted cyber attack, aiming to enhance protections against future threats. Following an intrusion attempt, investigators believe hackers obtained limited data before being stopped by security software, prompting precautionary shutdowns of compromised computers. Public services remain operational, but temporary interruptions may occur as the IT department collaborates with state and federal partners to upgrade network security.
Indiana’s Otolaryngology Associates swiftly responds to a cyberattack, mitigating potential data breaches and ensuring continued access to its systems. Following communications from threat actors demanding payment, the majority of affected individuals’ data compromised primarily consisted of billing records, with no access gained to medical records.
Moneyweb, a prominent South African financial news website, encountered relentless cyber attacks and extortion demands following its investigative reporting on Banxso, a company allegedly linked to fraudulent investment schemes. Despite efforts to defend against the attacks, extortion emails threatened continued disruptions unless articles exposing Banxso were removed. These incidents highlight the intense pressure faced by media outlets when uncovering potential financial scams in South Africa’s digital landscape.
The United States and the United Kingdom have inked a groundbreaking AI agreement to collaborate on testing advanced AI models and sharing research expertise. Commencing Monday, the partnership aims to jointly develop safety evaluation mechanisms and guidance for emerging AI risks, fulfilling commitments made at the Bletchley Park AI Safety Summit last November. U.S. Secretary of Commerce Gina Raimondo emphasized that the collaboration will advance understanding of AI systems and facilitate robust risk evaluations, fostering safe and responsible AI development.
In a worrying trend highlighted by Sophos, ransomware attackers are now setting their sights on organizations’ backups, intensifying the threat landscape. Learn essential strategies to fortify your backup systems and mitigate the impact of potential ransomware assaults. Safeguarding backups not only ensures data integrity but also minimizes the financial burden posed by exorbitant ransom demands, ultimately bolstering your organization’s resilience against cyber extortion.
The University of Technology Sydney (UTS) CyberSecurity Program offers comprehensive training and job placement support for professionals shifting into cybersecurity, especially targeting immigrants and low socio-economic communities in Australia. It features flexible formats, immersive practical training, and remote learning options to accommodate diverse needs while addressing the escalating demand for cyber professionals. With Australia anticipating a surge in cybersecurity salaries, the program equips participants with practical skills and industry certifications essential for thriving in today’s cyber-centric landscape.
Forescout’s analysis reveals a 40% surge in Chinese-made devices within US networks despite government efforts to curb security risks. Healthcare, manufacturing, and government sectors are most affected, with critical infrastructure increasingly vulnerable to potential espionage or disruption. Forescout warns organizations to scrutinize all network assets, especially those manufactured in China, to mitigate cybersecurity risks effectively.
Malaysia’s upper house unanimously passes the Cyber Security Bill 2024, led by Digital Minister Gobind Singh Deo to bolster the nation’s cyber defenses. The bill aims to safeguard critical sectors like government, banking, and defense against evolving cyber threats by enforcing stringent measures and standards. With both houses of parliament approving the bill, Malaysia demonstrates its commitment to fortifying its cyber infrastructure and positioning itself as a regional leader in cybersecurity governance.
Copyright © 2024 CyberMaterial. All Rights Reserved.
