BotenaGo, written in Google’s Golang programming language, can exploit more than 30 different vulnerabilities.

https://threatpost.com/routers-iot-open-source-malware/176270/

Cyberattackers stole PS5 root keys and exploited the kernel, revealing rampant insecurity in gaming devices.

https://threatpost.com/playstation-5-hacks-same-day/176240/

The distributed computing vendor patched the flaw, affecting Citrix ADC and Gateway, along with another flaw impacting availability for SD-WAN appliances.

https://threatpost.com/critical-citrix-bug-etwork-cloud-app-access/176183/

Researchers have a working exploit for the vulnerability (now patched), which allows for unauthenticated RCE and affects an estimated 70,000+ VPN/firewalls.

https://threatpost.com/massive-zero-day-hole-found-in-palo-alto-security-appliances/176170/

Experts urged users to prioritize patches for Microsoft Exchange and Excel, those favorite platforms so frequently targeted by cybercriminals and nation-state actors.

https://threatpost.com/microsoft-nov-patch-tuesday-fixes-six-zero-days-55-bugs/176143/

The Q3 2021 report revealed a 4.5% increase in CVEs associated with ransomware and a 3.4% increase in ransomware families compared with Q2 2021.

https://threatpost.com/12-new-flaws-used-in-ransomware-attacks-in-q3/176137/

Researchers discovered 14 vulnerabilities in the ‘Swiss Army Knife’ of the embedded OS used in many OT and IoT environments. They allow RCE, denial of service and data leaks.

https://threatpost.com/busybox-security-bugs-linux-devices/176098/

A new campaign is prying apart a known security vulnerability in the Zoho ManageEngine ADSelfService Plus password manager, researchers warned over the weekend. The threat actors have managed to exploit the Zoho weakness in at least nine global entities across critical sectors so far (technology, defense, healthcare, energy and education), deploying the Godzilla webshell and […]

https://threatpost.com/zoho-password-manager-flaw-godzilla-webshell/176063/

CISA is urging vendors to patch, given the release of public exploit code & a proof of concept tool for bugs that open billions of devices – phones, PCs, toys, etc. – to DoS & code execution.

https://threatpost.com/braktooth-bluetooth-bugs-exploit-poc/176036/

NSO Group plans to fight the trade ban, saying it’s “dismayed” and clinging to the mantra that its tools actually help to prevent terrorism and crime.

https://threatpost.com/pegasus-spyware-blacklisted-us/175999/

The bug (CVE-2021-43267) exists in a TIPC message type that allows Linux nodes to send cryptographic keys to each other.

https://threatpost.com/critical-linux-kernel-bug/176000/

The banker, aka Metamorfo, is roaring back after Spanish police arrested more than a dozen gang members.

https://threatpost.com/mekotio-banking-trojan-campaign/175981/

The Microsoft Exchange ProxyShell vulnerabilities are being exploited yet again for ransomware, this time with Babuk from the new “Tortilla” threat actor.

https://threatpost.com/tortilla-exchange-servers-proxyshell/175967/

API security risk has dramatically evolved in the last two years. Jason Kent, Hacker-in-Residence at Cequence Security, discusses the top API security concerns today and how to address them.

https://threatpost.com/owasp-api-security-top-10/175961/

Google’s Android November 2021 security updates plug 18 flaws in the framework and system components and 18 more in the kernel and vendor components.

https://threatpost.com/android-patches-exploited-kernel-bug/175931/

‘Shrootless’ allows bypass of System Integrity Protection IT security measures to install a malicious rootkit that goes undetected and performs arbitrary device operations.

https://threatpost.com/apple-macos-flaw-kernel-compromise/175927/

An alleged sports content pirate is accused of not only hijacking leagues’ streams but also threatening to tell reporters how he accessed their systems.

https://threatpost.com/pirate-sports-streamer-mlb-extortion/175898/

The old RLO trick of exploiting how Unicode handles script ordering and a related homoglyph attack can imperceptibly switch the real name of malware.

https://threatpost.com/trojan-source-invisible-bugs-source-code/175891/

The flaw, found in the Hashthemes Demo Importer plugin, allows any authenticated user to exsanguinate a vulnerable site, deleting nearly all database content and uploaded media.

https://threatpost.com/wordpress-plugin-bug-wipe-sites/175826/

Defending against ransomware will take a move to zero-trust, argues Daniel Spicer, CSO, Ivanti.

https://threatpost.com/ransomware-attacks-evolving-security-strategy/175835/