Authorities Arrest Another TrickBot Gang Member in South Korea

Governance & Risk Management , IT Risk Management , Patch Management Company Also Plans to Upgrade All Page Loads to HTTPS Rashmi Ramesh • July 16, 2021     Google will soon release a security update to address eight vulnerabilities in its Chrome browser, including a high-severity zero-day flaw that’s being exploited in the wild….

BlackBerry this week informed customers that the QNX embedded operating system is affected by a BadAlloc vulnerability leading to arbitrary code execution or denial of service. Publicly disclosed in April, BadAlloc is a collection of 25 vulnerabilities impacting many Internet of Things (IoT) and operational technology (OT) devices. The flaws can allow malicious attackers to…

3rd Party Risk Management , Breach Notification , Critical Infrastructure Security Microsoft, FireEye Find Additional Payloads Used During Supply Chain Attack Scott Ferguson (Ferguson_Writes) • March 4, 2021     Researchers with Microsoft and FireEye are disclosing additional malware used by the hacking group that targeted SolarWinds in December 2020, according to a pair of…

This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as /////evil.com/path or \evil.com/path. This vulnerability is only exploitable if an….

The personal data of over 500 million Facebook users has been posted online in a low-level hacking forum. The data includes phone numbers, full names, location, email address, and biographical information. Security researchers warn that the data could be used by hackers to impersonate people and commit fraud. See more stories on Insider’s business page….

Critical Infrastructure Security , Digital Identity , Endpoint Security Critical Networks Within National Security Systems Should Implement Zero Trust Akshaya Asokan (asokan_akshaya) • February 27, 2021     NSA: Consider Zero Trust models for all National Security Systems’ critical networks Source: NSA The US National Security Agency has issued its zero trust guidance aimed at…