Out of 92 security vulnerabilities, 66 are rated critical in severity, mostly allowing code execution. The most severe can lead to information disclosure.

https://threatpost.com/critical-patches-adobe-security-bulletin/175825/

A researcher was able to crack 70 percent of the gathered hashes in an experiment in a residential neighborhood.

https://threatpost.com/war-driving-wi-fi-password-cracking/175817/

Researchers found that one critical flaw in question is exploitable from the browser, allowing watering-hole attacks.

https://threatpost.com/apple-patches-ios-bugs/175803/

Much is made of shared responsibility for cloud security. But Oliver Tavakoli, CTO at Vectra AI, notes there’s no guarantee that Azure or AWS are delivering services in a hardened and secure manner.

https://threatpost.com/public-clouds-shared-responsibility-vulnerability/175778/

New software and code stand at the core of everything we do, but how well is all of this new code tested? Luckily, autonomous application security is here.

https://threatpost.com/next-generation-application-security/175765/

No security defense is perfect, and shadow IT means no company can inventory every single asset that it has. David “moose” Wolpoff, CTO at Randori, discusses strategies for core asset protection given this reality.

https://threatpost.com/defending-unknown-assets-cyberattacks/175730/

A SQL injection bug in the BillQuick billing app has not only leaked sensitive information, it’s also let malicious actors remotely execute code and deploy ransomware.

https://threatpost.com/billquick-billing-app-ransomware/175720/

The patch, urgently rushed out on Friday, is an emergency fix for the widely deployed platform, whose No. 1 most trafficked site is Amazon’s Seller Central.

https://threatpost.com/cisa-critical-rce-discourse/175705/

The high-severity bug, tracked as CVE-2021-1529, is an OS command-injection flaw.

https://threatpost.com/cisco-sd-wan-bug-code-execution-root/175669/

Meanwhile, Zerodium’s quest to buy VPN exploits is problematic, researchers said.

https://threatpost.com/us-ban-cyberattack-tools-zerodium/175654/

Hardly a week goes by without another major company falling victim to a ransomware attack. Nate Warfield, CTO at Prevailion, discusses the immense challenges in changing that status quo.

https://threatpost.com/cybersecurity-failing-ransomware/175637/

Experts warn that virtual private networks are increasingly vulnerable to leaks and attack.

https://threatpost.com/vpn-exposes-data-1m/175612/

Disguised as an IT firm, the APT is hitting targets in Afghanistan & India, exploiting a 20-year-old+ Microsoft Office bug that’s as potent as it is ancient.

https://threatpost.com/apt-commodity-rats-microsoft-bug/175601/

The out-of-bounds read vulnerability enables an attacker to escape a Squirrel VM in games with millions of monthly players – such as Counter-Strike: Global Offensive and Portal 2 – and in cloud services such as Twilio Electric Imp.

https://threatpost.com/squirrel-attackers-execute-code-games-cloud-services/175586/

Chris Hass, director of information security and research at Automox, discusses how to assign security responsibility, punishment for poor cyber-hygiene and IDing ‘security champions’ to help small businesses.

https://threatpost.com/accountability-cybersecurity/175571/

Companies are worried that the highly privileged password app could let attackers deep inside an enterprise’s footprint, says Redscan’s George Glass.

https://threatpost.com/podcast-zoho-solarwinds/175553/

The accounts were used to catfish security researchers into downloading malware in a long-running cyber-espionage campaign attributed to North Korea.

https://threatpost.com/twitter-suspends-security-researchers/175524/

The group – which also created BazarLoader and the Conti ransomware – has juiced its distribution tactics to threaten enterprises more than ever.

https://threatpost.com/trickbot-cybercrime-elite-affiliates/175510/

Missouri Gov. Mike Parson launched a criminal investigation of a reporter who flagged a state website that exposed 100K+ Social-Security numbers for teachers and other state employees.

https://threatpost.com/missouri-prosecute-hacker-data-leak/175501/

IPTV and IP video security is increasingly under scrutiny, even by high school kids.

https://threatpost.com/rickroll-exterity-iptv-bug/175491/