security update

Microsoft fixes exploited zero-day, revokes certificate used to sign malicious drivers (CVE-2022-44698)

December 13, 2022

It’s December 2022 Patch Tuesday, and Microsoft has delivered fixes for 50+ vulnerabilities, including a Windows SmartScreen bypass flaw (CVE-2022-44698) exploited by …

Critical FortiOS pre-auth RCE vulnerability exploited by attackers (CVE-2022-42475)

December 13, 2022

A critical RCE vulnerability (CVE-2022-42475) in Fortinet’s operating system, FortiOS, is being exploited by attackers, reportedly by a ransomware group. “Fortinet …

Google Chrome zero-day exploited in the wild (CVE-2022-4262)

December 6, 2022

Google has patched CVE-2022-4262, a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome (and Chromium), which is being exploited by attackers in the …

Critical vulnerability in Spotify’s Backstage discovered, patched

November 15, 2022

A critical unauthenticated remote code execution vulnerability in Spotify’s Backstage project has been found and fixed, and developers are advised to take immediate action in …

Microsoft fixes many zero-days under attack

November 8, 2022

November 2022 Patch Tuesday is here, with fixes for many vulnerabilities actively exploited in the wild, including CVE-2022-41091, a Windows Mark of the Web bypass flaw, and …

High-severity OpenSSL vulnerabilities fixed (CVE-2022-3602, CVE-2022-3786)

November 1, 2022

Version 3.0.7 of the popular OpenSSL cryptographic library is out, with fixes for CVE-2022-3602 and CVE-2022-3786, two high-severity buffer overflow vulnerabilities in the …

ConnectWise backup solutions open to RCE, patch ASAP!

October 31, 2022

ConnectWise has fixed a critical vulnerability in ConnectWise Recover and R1Soft Server Backup Manager that could allow attackers to achieve remote code exection (RCE) or …

Incoming OpenSSL critical fix: Organizations, users, get ready!

October 26, 2022

UPDATE (November 1, 2022, 01:55 p.m. ET): OpenSSL version 3.0.7 is out, and the severity of the vulnerability has been downgraded. Check out what you should be doing next. The …

Apple fixes exploited iOS, iPadOS zero-day (CVE-2022-42827)

October 25, 2022

For the ninth time this year, Apple has released fixes for a zero-day vulnerability (CVE-2022-42827) exploited by attackers to compromise iPhones. About CVE-2022-42827 …

Apache Commons Text flaw is not a repeat of Log4Shell (CVE-2022-42889)

October 19, 2022

A freshly fixed vulnerability (CVE-2022-42889) in the Apache Commons Text library has been getting attention from security researchers these last few days, worrying it could …

Microsoft patches Windows flaw exploited in the wild (CVE-2022-41033)

October 11, 2022

October 2022 Patch Tuesday is here, with fixes for 85 CVE-numbered vulnerabilities, including CVE-2022-41033, a vulnerability in Windows COM+ Event System Service that has …

Auth bypass bug in FortiOS, FortiProxy is exploited in the wild (CVE-2022-40684)