Ransomware Gangs Embrace Physical Threats, Family Stalking?
Organizations are reporting that employees face threats to their families, stalking, physical violence, and abduction. But these alarming claims are hard to verify.
-
-
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has come under active exploitation. These include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate…
-
OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room
A Saudi National and employee of OpenAI has been arrested for allegedly planting a hidden recording device in an executive conference room at the company’s San Francisco offices to covertly record sensitive conversations. Abdulrahman Alfozan, 35, has been charged with using or endeavoring to use an electronic, mechanical, or other device to intercept oral communications….
-
Zero-Days Lurk in Microsoft’s Overgrown October Patch Tuesday
The scary surprises for the largest security update ever include security bypasses and unauthenticated RCEs.
-
North Korea Phishes Ukrainians for War Intel
The Democratic People’s Republic of Korea (DPRK) is trying to get insight into its own war effort in Ukraine, through simple reply-baiting phishing attacks.
-
Anthropic Finds Ingredients for Future AI Worms
Anthropic’s latest study combined IoT and network tests to explore AI self-replication, which researchers said would be “challenging” to shut down.
-
Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets
Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic. The frontier AI lab said small AI models could form autonomous, self-propagating worm botnets that are “challenging to shut down,” since “there’s no centralized…
-
Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it. The flaw was in the feature that converts a personal account into an organization, Docker…
-
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to “act immediately.” A fix for the third is still pending, according to Volexity….
-
SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
A flaw in SAP’s Cloud SDK for Python can send an application’s OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP’s official Python client for BTP services. An attacker must be able to control…