Daily briefings on critical security disclosures, vulnerabilities, and threat intelligence.
Google issued patches for CVE-2024-43093, an actively exploited Android Framework zero-day vulnerability in ExternalStorageProvider that allows attackers to bypass file path filters and access sensitive app data directories.
Read briefing →GreyNoise uncovered active in-the-wild exploitation of two chained zero-day vulnerabilities in PTZOptics cameras, CVE-2024-8956 and CVE-2024-8957, enabling unauthenticated remote attackers to bypass access controls and execute commands as root.
Read briefing →Microsoft disclosed that Chinese state-sponsored actor Storm-0940 weaponized CovertNetwork-1658, a SOHO router botnet known as Quad7, to orchestrate low-and-slow password spraying and brute-force campaigns against Microsoft 365 tenants across North America and Europe.
Read briefing →Threat actors hijacked an authorized developer account to push malicious versions of the @lottiefiles/lottie-player npm library, weaponizing unpinned CDN distributions to inject cryptocurrency drainer prompts into decentralized finance and Web3 applications.
Read briefing →Sophos disclosed Operation Pacific Rim, detailing a five-year campaign where Chinese state-sponsored threat actors weaponized zero-days and custom Linux rootkits like Pygmy Goat against edge firewalls, establishing stealthy relay networks to penetrate Indo-Pacific critical infrastructure.
Read briefing →Sysdig uncovered EmeraldWhale, an automated campaign that scanned the internet for exposed Git configuration and environment files, weaponizing leaked access tokens to clone over 10,000 private repositories and exfiltrate more than 15,000 cloud credentials to a public S3 bucket.
Read briefing →ESET Research disclosed CloudScout, a modular .NET framework used by China-aligned APT Evasive Panda to hijack authenticated web sessions across Google Drive, Gmail, and Microsoft Outlook by weaponizing stolen browser cookies to bypass multi-factor authentication.
Read briefing →QNAP issued emergency updates addressing CVE-2024-50388, a critical OS command injection vulnerability in HBS 3 Hybrid Backup Sync exploited at Pwn2Own Ireland 2024 to execute arbitrary commands with root privileges on NAS appliances.
Read briefing →Palo Alto Networks Unit 42 uncovered North Korean state actor Jumpy Pisces collaborating with the Play ransomware syndicate, marking a rare convergence between state espionage and commercial RaaS operations.
Read briefing →A zero-day vulnerability in Windows Themes bypasses previous Microsoft fixes (CVE-2024-38030) to force outbound SMB authentication and leak user NetNTLMv2 hashes upon file preview in Windows Explorer.
Read briefing →