security update

MOVEit hackers leverage new zero-day bug to breach organizations (CVE-2023-47246)

November 9, 2023

A critical zero-day vulnerability (CVE-2023-47246) in the SysAid IT support and management software solution is being exploited by Lace Tempest, a ransomware affiliate known …

Attackers exploiting Apache ActiveMQ flaw to deliver ransomware (CVE-2023-46604)

November 2, 2023

Ransomware-wielding attackers are trying to break into servers running outdated versions of Apache ActiveMQ by exploiting a recently fixed vulnerability (CVE-2023-46604). …

Atlassian patches critical Confluence bug, urges for immediate action (CVE-2023-22518)

October 31, 2023

Atlassian is urging enterprise administrators to update their on-premises Confluence Data Center and Server installations quickly to plug a critical security vulnerability …

VMware patches critical vulnerability in vCenter Server (CVE-2023-34048)

October 25, 2023

VMware has fixed a critical out-of-bounds write vulnerability (CVE-2023-34048) and a moderate-severity information disclosure flaw (CVE-2023-34056) in vCenter Server, its …

“Disappearing” implants, followed by first fixes for exploited Cisco IOS XE zero-day

October 23, 2023

Cisco has released the first fixes for the IOS XE zero-day (CVE-2023-20198) exploited by attackers to ultimately deliver a malicious implant. The fixes were made available on …

Citrix NetScaler bug exploited in the wild since August (CVE-2023-4966)

October 18, 2023

A recently patched Citrix NetScaler ADC/Gateway information disclosure vulnerability (CVE-2023-4966) has been exploited by attackers in the wild since late August 2023, …

Valve introduces SMS-based confirmation to prevent malicious games on Steam

October 17, 2023

Video game publisher/digital distribution company Valve is forcing developers who publish games on its Steam platform to “validate” new builds with a confirmation …

Curl project squashes high-severity bug in omnipresent libcurl library (CVE-2023-38545)

October 11, 2023

Curl v8.4.0 is out, and fixes – among other things – a high-severity SOCKS5 heap buffer overflow vulnerability (CVE-2023-38545). Appropriate patches for some older …

Microsoft fixes exploited WordPad, Skype for Business zero-days (CVE-2023-36563, CVE-2023-41763)

October 10, 2023

On this October 2023 Patch Tuesday, Microsoft has released 103 patches and has fixed three actively exploited vulnerabilities (CVE-2023-36563, CVE-2023-41763, CVE-2023-44487). …

Be prepared to patch high-severity vulnerability in curl and libcurl

October 10, 2023

UPDATE (October 11, 2023, 07:15 a.m. ET): Curl v8.4.0 is out and fixes both CVE-2023-38545, a SOCKS5 heap buffer overflow vulnerability and CVE-2023-38546, a cookie injection …

“Looney Tunables” bug allows root access on Linux distros (CVE-2023-4911)

October 5, 2023

A vulnerability (CVE-2023-4911) in the GNU C Library (aka “glibc”) can be exploited by attackers to gain root privileges on many popular Linux distributions, …

Apple patches another iOS zero-day under attack (CVE-2023-42824)