With human error being the common factor in most cyberattacks, employee training has got to get better. To that end, Trustwave cybersec training expert Darren Van Booven explains the importance of fish stress balls and management buy-in.

https://threatpost.com/the-art-of-non-boring-cybersec-training-podcast/178594/

One cryptography expert said that ‘serious flaws’ in the way Samsung phones encrypt sensitive material, as revealed by academics, are ‘embarrassingly bad.’

https://threatpost.com/samsung-shattered-encryption-on-100m-phones/178606/

Adobe updated its recent out-of-band security advisory to add another critical bug, while researchers put out a PoC for the one it emergency-fixed last weekend.

https://threatpost.com/new-critical-rce-bug-found-in-adobe-commerce-magento/178554/

An oversight in a WordPress plug-in exposes PII and authentication data to malicious insiders.

https://threatpost.com/severe-wordpress-plug-in-updraftplus-bug-threatens-backups/178528/

The resurgent trojan has targeted 60 top companies to harvest credentials for a wide range of applications, with an eye to virulent follow-on attacks.

https://threatpost.com/trickbot-amazon-paypal-top-brands/178483/

On the plus side, only instances with non-standard not recommended configurations are vulnerable. On the downside, those configurations aren’t easy to track down, and it’s easy as pie to exploit.

https://threatpost.com/high-severity-rce-bug-found-in-popular-apache-cassandra-database/178464/

A group of five security vulnerabilities could lead to a range of bad outcomes for virtual-machine enthusiasts, including command execution and DoS.

https://threatpost.com/critical-vmware-bugs-esxi-fusion-workstation/178461/

Researchers have never before seen SquirrelWaffle attackers use typosquatting to keep sending spam once a targeted Exchange server has been patched for ProxyLogon/ProxyShell.

https://threatpost.com/squirrelwaffle-fraud-exchange-server-malspamming/178434/

The year’s 1st Chrome zero-day can lead to all sorts of misery, ranging from data corruption to the execution of arbitrary code on vulnerable systems.

https://threatpost.com/google-chrome-zero-day-under-attack/178428/

The vendor issued an emergency fix on Sunday, and eCommerce websites should update ASAP to avoid Magecart card-skimming attacks and other problems.

https://threatpost.com/adobe-zero-day-magento-rce-attack/178407/

A collection of five security vulnerabilities with a collective CVSS score of 10 out of 10 threaten critical infrastructure environments that use Moxa MXview.

https://threatpost.com/critical-mqtt-bugs-industrial-rce-moxa/178399/

A memory issue affects myriad iPhone, iPad and MacOS devices and allows attackers to execute arbitrary code after processing malicious web content.

https://threatpost.com/apple-patches-actively-exploited-webkit-zero-day/178370/

SAP’s Patch Tuesday brought fixes for a trio of flaws in the ubiquitous ICM component in internet-exposed apps. One of them, with a risk score of 10, could allow attackers to hijack identities, steal data and more.

https://threatpost.com/sap-threat-briefing-severe-icmad-bugs/178344/

The plug-in’s default settings spawned flaws that could allow for full site takeover but have since been fixed in an update that users should immediately install, Wordfence researchers said.

https://threatpost.com/php-everywhere-bugs-wordpress-rce/178338/

This batch had zero critical CVEs, which is unheard of. Most (50) of the patches are labeled Important, so don’t delay to apply the patches, security experts said.

https://threatpost.com/microsoft-february-patch-tuesday-zero-day/178286/

Feb. 18 is the deadline to patch a bug that affects all unpatched versions of Windows 10 and requires zero user interaction to exploit.

https://threatpost.com/cisa-orders-federal-agencies-to-fix-actively-exploited-windows-bug/178270/

However, groups are rebranding and recalibrating their profiles and tactics to respond to law enforcement and the security community’s focus on stopping ransomware attacks.

https://threatpost.com/lockbit-blackcat-swissport-ransomware-activity/178261/

The now-patched flaw that led to the ForcedEntry exploit of iPhones was exploited by both NSO Group and a different, newly detailed surveillance vendor.

https://threatpost.com/quadream-israeli-spyware-weaponized-iphone-bug/178252/

The ubiquitous Log4j bug will be with us for years. John Hammond, senior security researcher at Huntress, discusses what’s next.

https://threatpost.com/log4shell-cve-2021-44228/178225/

The popular continuous-delivery platform has a path-traversal bug (CVE-2022-24348) that could allow cyberattackers to hop from one application ecosystem to another.

https://threatpost.com/argo-cd-security-bug-kubernetes-cloud-apps/178239/