Windows and Linux users: The deadline to update Secure Boot keys is near
In 2012, a new form of bootkit was demonstrated. Instead of targeting machines through the BIOS or master boot record, one such bootkit attacked Mac…
Category: ArsTechnica
Critical Copilot vulnerability allowed hackers to seal 2FA code from users
To bring about the Parameter-to-Prompt Injection an attacker sends the target an email that contains the URL with the syntax https://m365.cloud.microsoft/search/?auth=2&origindomain=microsoft365&q=. The field contains an…
Users cry foul after AMD stripped memory crypto from its consumer CPUs
Limoncello promptly replied: “My apologies; but I don’t have any more information to share on this topic.” With that, the discussion and Kilpatrick’s inquiry were…
PeopleSoft 0-day affecting hundreds of organizations steals gigabytes of data
“While several organizations successfully blocked the activity or remediated the vulnerabilities, others experienced compromise, resulting in stolen data being published on the ShinyHunters DLS,” Mandiant…
Locked in heated rivalry with researcher, Microsoft fixes 0-day they disclosed
Tuesday’s patch bundle also fixed MiniPlasma, a separate vulnerability disclosed by Nightmare Eclipse. Microsoft said in an email that the vulnerability is tracked as CVE-2020-17103,…
High-severity vulnerability in Linux caused by a single faulty character
When a verdict map is deleted from memory, catchall elements are deactivated and a chain’s reference counter is decremented. When errors occur the deletion can…
For the 2nd time in weeks, Microsoft packages laced with credential stealer
Dozens of cryptographically verified open source packages from Microsoft were compromised late last week to add advanced credential-stealing code that was triggered when developers opened…
How a USB-connected speaker can infect a PC without ever being touched
After successfully replacing the firmware with a replacement image that did nothing more than display the word “patched” on the speaker’s LED display, the researcher…
Dashlane explains how attackers managed to download encrypted password vaults
That means the chances of the attackers decrypting one of the encrypted vaults they obtained is very small in the event the master password was…
Dashlane issues opaque advisory warning 20 encrypted vaults were stolen
It’s possible that Dashlane’s reference to 2FA meant something else. Sometimes, 2FA can come in the form of push notifications. Once someone enters the correct…
Dozens of Red Hat packages backdoored through its official NPM channel
The worm, dubbed Shai-Hulud, has all the hallmarks of malware released last month as freely available open source. TeamPCP was the first group to use…
Meta AI support chatbot gave hackers access to notable Instagram accounts
Both ZachXBT and Dark Web Informer also confirmed how hackers had targeted and resold particularly valuable Instagram accounts, including the short handles @hey and @jowo…