Daily briefings on critical security disclosures, vulnerabilities, and threat intelligence.
Microsoft released security updates addressing 118 vulnerabilities, headlined by two actively exploited zero-days in the Microsoft Management Console and legacy MSHTML platform tracked as CVE-2024-43572 and CVE-2024-43573.
Read briefing →Casio disclosed a network breach and IT systems shutdown after the Underground ransomware group penetrated corporate networks via phishing, exfiltrating over 200 GB of confidential data.
Read briefing →American Water disconnected customer portals and billing networks following an unauthorized cyberattack on corporate IT systems, initiating emergency isolation protocols to protect operational technology.
Read briefing →Samsung released security updates addressing CVE-2024-44068, a critical use-after-free zero-day flaw in Exynos processor media drivers exploited in targeted attacks to achieve privileged code execution and process hijacking on mobile devices.
Read briefing →CISA warned that threat actors are actively exploiting CVE-2024-28987, a critical hardcoded credential vulnerability in SolarWinds Web Help Desk that enables unauthenticated remote attackers to access internal endpoints, read sensitive service desk tickets, and steal credentials.
Read briefing →Palo Alto Networks urged customers to patch critical vulnerabilities in its Expedition migration tool, including unauthenticated command injection CVE-2024-9463, which public exploits chain to exfiltrate database secrets and hijack managed PAN-OS firewalls.
Read briefing →CISA and Ivanti warned of active in-the-wild exploitation targeting CVE-2024-29824, a critical SQL injection flaw in Endpoint Manager Core servers allowing unauthenticated network attackers to achieve remote code execution via xp_cmdshell.
Read briefing →Aqua Nautilus identified a widespread campaign deploying stealthy 'perfctl' malware across thousands of Linux servers, leveraging vulnerabilities like CVE-2023-33246 and CVE-2021-4034 to drop evasive userland rootkits that hijack system resources.
Read briefing →DrayTek released urgent firmware updates addressing 14 security vulnerabilities dubbed DRAY:BREAK, including a CVSS 10.0 buffer overflow and an OS command injection flaw that allow remote unauthenticated attackers to gain root access across 700,000 internet-exposed routers.
Read briefing →A critical vulnerability in Kubernetes Image Builder allows remote unauthenticated attackers to gain root access to cluster nodes via persistent default credentials embedded in Proxmox virtual machine templates, tracked as CVE-2024-9486.
Read briefing →