TECHZONE™

Analysis of two arbitrary code execution vulnerabilities affecting WPS Office https://www.welivesecurity.com/en/eset-research/analysis-of-two-arbitrary-code-execution-vulnerabilities-affecting-wps-office/ Demystifying CVE-2024-7262 and CVE-2024-7263

French Authorities Charge Telegram CEO with Facilitating Criminal Activities on Platform https://thehackernews.com/2024/08/french-authorities-charge-telegram-ceo.html French prosecutors on Wednesday formally charged CEO Pavel Durov with facilitating a litany of criminal activity on the popular messaging platform and placed him under formal investigation following his arrest Saturday. Russian-born Durov, who is also a French citizen, has been charged with being complicit in the spread of child sexual abuse material (CSAM) as well as enabling organized crime,

Fortra Issues Patch for High-Risk FileCatalyst Workflow Security Vulnerability https://thehackernews.com/2024/08/fortra-issues-patch-for-high-risk.html Fortra has addressed a critical security flaw impacting FileCatalyst Workflow that could be abused by a remote attacker to gain administrative access. The vulnerability, tracked as CVE-2024-6633, carries a CVSS score of 9.8, and stems from the use of a static password to connect to a HSQL database. "The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are

APT-C-60 Group Exploit WPS Office Flaw to Deploy SpyGlace Backdoor https://thehackernews.com/2024/08/apt-c-60-group-exploit-wps-office-flaw.html A South Korea-aligned cyber espionage has been linked to the zero-day exploitation of a now-patched critical remote code execution flaw in Kingsoft WPS Office to deploy a bespoke backdoor dubbed SpyGlace. The activity has been attributed to a threat actor dubbed APT-C-60, according to cybersecurity firms ESET and DBAPPSecurity. The attacks have been found to infect Chinese and East Asian users

Old devices, new dangers: The risks of unsupported IoT tech https://www.welivesecurity.com/en/internet-of-things/old-devices-new-dangers-the-risks-of-unsupported-iot-tech/ In the digital graveyard, a new threat stirs: Out-of-support devices becoming thralls of malicious actors

BlackByte Ransomware Exploits VMware ESXi Flaw in Latest Attack Wave https://thehackernews.com/2024/08/blackbyte-ransomware-exploits-vmware.html The threat actors behind the BlackByte ransomware group have been observed likely exploiting a recently patched security flaw impacting VMware ESXi hypervisors, while also leveraging various vulnerable drivers to disarm security protections. "The BlackByte ransomware group continues to leverage tactics, techniques, and procedures (TTPs) that have formed the foundation of its tradecraft since its

CISA Flags Critical Apache OFBiz Flaw Amid Active Exploitation Reports https://thehackernews.com/2024/08/cisa-flags-critical-apache-ofbiz-flaw.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a critical security flaw affecting the Apache OFBiz open-source enterprise resource planning (ERP) system to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The vulnerability, known as CVE-2024-38856, carries a CVSS score of 9.8, indicating critical severity.

New QR Code Phishing Campaign Exploits Microsoft Sway to Steal Credentials https://thehackernews.com/2024/08/new-qr-code-phishing-campaign-exploits.html Cybersecurity researchers are calling attention to a new QR code phishing (aka quishing) campaign that leverages Microsoft Sway infrastructure to host fake pages, once again highlighting the abuse of legitimate cloud offerings for malicious purposes. "By using legitimate cloud applications, attackers provide credibility to victims, helping them to trust the content it serves," Netskope Threat

Critical WPML Plugin Flaw Exposes WordPress Sites to Remote Code Execution https://thehackernews.com/2024/08/critical-wpml-plugin-flaw-exposes.html A critical security flaw has been disclosed in the WPML WordPress multilingual plugin that could allow authenticated users to execute arbitrary code remotely under certain circumstances. The vulnerability, tracked as CVE-2024-6386 (CVSS score: 9.9), impacts all versions of the plugin before 4.6.13, which was released on August 20, 2024. Arising due to missing input validation and sanitization,

Exploring Android threats and ways to mitigate them | Unlocked 403 cybersecurity podcast (ep.5) https://www.welivesecurity.com/en/videos/exploring-android-threats-and-ways-to-mitigate-them-unlocked-403-cybersecurity-podcast-ep5/ The world of Android threats is quite vast and intriguing. In this episode, Becks and Lukáš demonstrate how easy it is to take over your phone, with some added tips on how to stay secure

macOS Version of HZ RAT Backdoor Targets Chinese Messaging App Users https://thehackernews.com/2024/08/macos-version-of-hz-rat-backdoor.html Users of Chinese instant messaging apps like DingTalk and WeChat are the target of an Apple macOS version of a backdoor named HZ RAT. The artifacts "almost exactly replicate the functionality of the Windows version of the backdoor and differ only in the payload, which is received in the form of shell scripts from the attackers' server," Kaspersky researcher Sergey Puzan said. HZ RAT was first

Chinese Volt Typhoon Exploits Versa Director Flaw, Targets U.S. and Global IT Sectors https://thehackernews.com/2024/08/chinese-volt-typhoon-exploits-versa.html The China-nexus cyber espionage group tracked as Volt Typhoon has been attributed with moderate confidence to the zero-day exploitation of a recently disclosed high-severity security flaw impacting Versa Director. The attacks targeted four U.S. victims and one non-U.S. victim in the Internet service provider (ISP), managed service provider (MSP) and information technology (IT) sectors as early

CTEM in the Spotlight: How Gartner's New Categories Help to Manage Exposures https://thehackernews.com/2024/08/ctem-in-spotlight-how-gartners-new.html Want to know what’s the latest and greatest in SecOps for 2024? Gartner’s recently released Hype Cycle for Security Operations report takes important steps to organize and mature the domain of Continuous Threat Exposure Management, aka CTEM. Three categories within this domain are included in this year’s report: Threat Exposure Management, Exposure Assessment Platforms (EAP), and Adversarial

Microsoft Fixes ASCII Smuggling Flaw That Enabled Data Theft from Microsoft 365 Copilot https://thehackernews.com/2024/08/microsoft-fixes-ascii-smuggling-flaw.html Details have emerged about a now-patched vulnerability in Microsoft 365 Copilot that could enable the theft of sensitive user information using a technique called ASCII smuggling. "ASCII Smuggling is a novel technique that uses special Unicode characters that mirror ASCII but are actually not visible in the user interface," security researcher Johann Rehberger said. "This means that an attacker

Google Warns of CVE-2024-7965 Chrome Security Flaw Under Active Exploitation https://thehackernews.com/2024/08/google-warns-of-cve-2024-7965-chrome.html Google has revealed that a security flaw that was patched as part of a security update rolled out last week to its Chrome browser has come under active exploitation in the wild. Tracked as CVE-2024-7965, the vulnerability has been described as an inappropriate implementation bug in the V8 JavaScript and WebAssembly engine. "Inappropriate implementation in V8 in Google Chrome prior to

SonicWall Issues Critical Patch for Firewall Vulnerability Allowing Unauthorized Access https://thehackernews.com/2024/08/sonicwall-issues-critical-patch-for.html SonicWall has released security updates to address a critical flaw impacting its firewalls that, if successfully exploited, could grant malicious actors unauthorized access to the devices. The vulnerability, tracked as CVE-2024-40766 (CVSS score: 9.3), has been described as an improper access control bug. "An improper access control vulnerability has been identified in the SonicWall SonicOS

Dutch Regulator Fines Uber €290 Million for GDPR Violations in Data Transfers to U.S. https://thehackernews.com/2024/08/dutch-regulators-fines-uber-290-million.html The Dutch Data Protection Authority (DPA) has fined Uber a record €290 million ($324 million) for allegedly failing to comply with European Union (E.U.) data protection standards when sending sensitive driver data to the U.S. "The Dutch DPA found that Uber transferred personal data of European taxi drivers to the United States (U.S.) and failed to appropriately safeguard the data with regard to

Researchers Identify Over 20 Supply Chain Vulnerabilities in MLOps Platforms https://thehackernews.com/2024/08/researchers-identify-over-20-supply.html Cybersecurity researchers are warning about the security risks in the machine learning (ML) software supply chain following the discovery of more than 20 vulnerabilities that could be exploited to target MLOps platforms. These vulnerabilities, which are described as inherent- and implementation-based flaws, could have severe consequences, ranging from arbitrary code execution to loading

Unpacking Slack Hacks: 6 Ways to Protect Sensitive Data with Secure Collaboration https://thehackernews.com/2024/08/unpacking-slack-hacks-6-ways-to-protect.html Nowadays, sensitive and critical data is traveling in everyday business channels that offer only the basic level of security and encryption, and companies are often oblivious to the risk. A case in point: Disney suffered a devastating data leak by a hacktivist group known as NullBulge that got hold of over 1.2 terabytes of data from Disney's internal Slack messaging channels. The breach exposed

Critical Flaws in Traccar GPS System Expose Users to Remote Attacks https://thehackernews.com/2024/08/critical-flaws-in-traccar-gps-system.html Two security vulnerabilities have been disclosed in the open-source Traccar GPS tracking system that could be potentially exploited by unauthenticated attackers to achieve remote code execution under certain circumstances. Both the vulnerabilities are path traversal flaws and could be weaponized if guest registration is enabled, which is the default configuration for Traccar 5, Horizon3.ai