The out-of-bounds read vulnerability enables an attacker to escape a Squirrel VM in games with millions of monthly players – such as Counter-Strike: Global Offensive and Portal 2 – and in cloud services such as Twilio Electric Imp.

https://threatpost.com/squirrel-attackers-execute-code-games-cloud-services/175586/

Chris Hass, director of information security and research at Automox, discusses how to assign security responsibility, punishment for poor cyber-hygiene and IDing ‘security champions’ to help small businesses.

https://threatpost.com/accountability-cybersecurity/175571/

Companies are worried that the highly privileged password app could let attackers deep inside an enterprise’s footprint, says Redscan’s George Glass.

https://threatpost.com/podcast-zoho-solarwinds/175553/

The accounts were used to catfish security researchers into downloading malware in a long-running cyber-espionage campaign attributed to North Korea.

https://threatpost.com/twitter-suspends-security-researchers/175524/

The group – which also created BazarLoader and the Conti ransomware – has juiced its distribution tactics to threaten enterprises more than ever.

https://threatpost.com/trickbot-cybercrime-elite-affiliates/175510/

Missouri Gov. Mike Parson launched a criminal investigation of a reporter who flagged a state website that exposed 100K+ Social-Security numbers for teachers and other state employees.

https://threatpost.com/missouri-prosecute-hacker-data-leak/175501/

IPTV and IP video security is increasingly under scrutiny, even by high school kids.

https://threatpost.com/rickroll-exterity-iptv-bug/175491/

The new Necro Python exploit targets Visual Tool DVRs used in surveillance systems.

https://threatpost.com/freakout-botnet-dvrs-monero-cryptominers/175467/

A stored XSS and arbitrary file-upload bug can be paired with an authorization bypass to wreak havoc.

https://threatpost.com/brizy-wordpress-plugin-exploit-site-takeovers/175463/

Cybercriminals exploited bugs in the world’s largest digital-goods marketplace to create malicious artwork offered as a perk to unsuspecting users.

https://threatpost.com/opensea-nfts-cryptowallet-balances/175453/

Sounil Yu, CISO at JupiterOne, discusses software bills of materials (SBOMs) and the need for a shift in thinking about securing software supply chains.

https://threatpost.com/mandate-zero-trust-software-supply-chains/175333/

The previously unknown SnapMC group exploits unpatched VPNs and webserver apps to breach systems and carry out quick-hit extortion in less time than it takes to order a pizza.

https://threatpost.com/rapid-attacks-extort-ransomware/175445/

Microsoft’s October 2021 Patch Tuesday included security fixes for 74 vulnerabilities, one of which is a zero-day being used to deliver the MysterySnail RAT to Windows servers.

https://threatpost.com/microsoft-patch-tuesday-bug-exploited-mysterysnail-espionage-campaign/175431/

The cyberattacks, linked to a Chinese-speaking APT, deliver the new MysterySnail RAT malware to Windows servers.

https://threatpost.com/windows-zero-day-exploited-espionage/175432/

The bug is under attack. Within hours of the patch release, a researcher published POC code, calling it a “great” flaw that can be used for jailbreaks and local privilege escalation.

https://threatpost.com/apple-urgent-ios-updates-zero-day/175419/

The possible cyberattacks include disabling monitoring, location-tracking of children and malicious redirects of parent-console users.

https://threatpost.com/canopy-parental-control-app-unpatched-xss-bugs/175384/

Three security vulnerabilities in Axis video products could open up the door to a bevy of different cyberattacks on businesses.

https://threatpost.com/ip-surveillance-bugs-axis-rce-data-theft/175350/

The open-source project has rolled out a security fix for CVE-2021-41773, for which public cyberattack exploit code is circulating.

https://threatpost.com/apache-web-server-zero-day-sensitive-data/175340/

Joseph Carson, Chief Security Scientist at ThycoticCentrify, offers a 7-step practical IR checklist for ensuring a swift recovery from a cyberattack.

https://threatpost.com/incident-response-plan-security-disaster/175335/

Coinbase suspects phishing led to attackers getting personal details needed to access wallets but also blamed a flaw in its SMS-based 2FA.

https://threatpost.com/mfa-glitch-coinbase-customers-robbery/175290/