A new campaign is prying apart a known security vulnerability in the Zoho ManageEngine ADSelfService Plus password manager, researchers warned over the weekend. The threat actors have managed to exploit the Zoho weakness in at least nine global entities across critical sectors so far (technology, defense, healthcare, energy and education), deploying the Godzilla webshell and […]

https://threatpost.com/zoho-password-manager-flaw-godzilla-webshell/176063/

CISA is urging vendors to patch, given the release of public exploit code & a proof of concept tool for bugs that open billions of devices – phones, PCs, toys, etc. – to DoS & code execution.

https://threatpost.com/braktooth-bluetooth-bugs-exploit-poc/176036/

NSO Group plans to fight the trade ban, saying it’s “dismayed” and clinging to the mantra that its tools actually help to prevent terrorism and crime.

https://threatpost.com/pegasus-spyware-blacklisted-us/175999/

The bug (CVE-2021-43267) exists in a TIPC message type that allows Linux nodes to send cryptographic keys to each other.

https://threatpost.com/critical-linux-kernel-bug/176000/

The banker, aka Metamorfo, is roaring back after Spanish police arrested more than a dozen gang members.

https://threatpost.com/mekotio-banking-trojan-campaign/175981/

The Microsoft Exchange ProxyShell vulnerabilities are being exploited yet again for ransomware, this time with Babuk from the new “Tortilla” threat actor.

https://threatpost.com/tortilla-exchange-servers-proxyshell/175967/

API security risk has dramatically evolved in the last two years. Jason Kent, Hacker-in-Residence at Cequence Security, discusses the top API security concerns today and how to address them.

https://threatpost.com/owasp-api-security-top-10/175961/

Google’s Android November 2021 security updates plug 18 flaws in the framework and system components and 18 more in the kernel and vendor components.

https://threatpost.com/android-patches-exploited-kernel-bug/175931/

‘Shrootless’ allows bypass of System Integrity Protection IT security measures to install a malicious rootkit that goes undetected and performs arbitrary device operations.

https://threatpost.com/apple-macos-flaw-kernel-compromise/175927/

An alleged sports content pirate is accused of not only hijacking leagues’ streams but also threatening to tell reporters how he accessed their systems.

https://threatpost.com/pirate-sports-streamer-mlb-extortion/175898/

The old RLO trick of exploiting how Unicode handles script ordering and a related homoglyph attack can imperceptibly switch the real name of malware.

https://threatpost.com/trojan-source-invisible-bugs-source-code/175891/

The flaw, found in the Hashthemes Demo Importer plugin, allows any authenticated user to exsanguinate a vulnerable site, deleting nearly all database content and uploaded media.

https://threatpost.com/wordpress-plugin-bug-wipe-sites/175826/

Defending against ransomware will take a move to zero-trust, argues Daniel Spicer, CSO, Ivanti.

https://threatpost.com/ransomware-attacks-evolving-security-strategy/175835/

Out of 92 security vulnerabilities, 66 are rated critical in severity, mostly allowing code execution. The most severe can lead to information disclosure.

https://threatpost.com/critical-patches-adobe-security-bulletin/175825/

A researcher was able to crack 70 percent of the gathered hashes in an experiment in a residential neighborhood.

https://threatpost.com/war-driving-wi-fi-password-cracking/175817/

Researchers found that one critical flaw in question is exploitable from the browser, allowing watering-hole attacks.

https://threatpost.com/apple-patches-ios-bugs/175803/

Much is made of shared responsibility for cloud security. But Oliver Tavakoli, CTO at Vectra AI, notes there’s no guarantee that Azure or AWS are delivering services in a hardened and secure manner.

https://threatpost.com/public-clouds-shared-responsibility-vulnerability/175778/

New software and code stand at the core of everything we do, but how well is all of this new code tested? Luckily, autonomous application security is here.

https://threatpost.com/next-generation-application-security/175765/

No security defense is perfect, and shadow IT means no company can inventory every single asset that it has. David “moose” Wolpoff, CTO at Randori, discusses strategies for core asset protection given this reality.

https://threatpost.com/defending-unknown-assets-cyberattacks/175730/

A SQL injection bug in the BillQuick billing app has not only leaked sensitive information, it’s also let malicious actors remotely execute code and deploy ransomware.

https://threatpost.com/billquick-billing-app-ransomware/175720/