CSO
Digital security certificate firm says product sets a new standard for managing digital trust and reduces an organization’s attack surface to help prevent data breaches.
CSO
New research from DigiCert has found that digital trust is a key driver of customer loyalty, with 84% of customers saying they would consider leaving a vendor that did not manage digital trust.
Bleeping Computer
GitHub says that unknown attackers have stolen encrypted code-signing certificates for its Desktop and Atom applications after gaining access to some of its development and release planning repositories.
DataBreaches
Sergiu Gatlan reports: GitHub says unknown attackers have stolen encrypted code-signing certificates for its Desktop and Atom applications after gaining access...
Security Affairs
Researchers discovered flaws in the Azure Database for PostgreSQL Flexible Server that could result in unauthorized cross-account database access in a region. Microsoft addressed a couple of vulnerabilities impacting the Azure Database for PostgreSQL Flexible Server that could result in unauthorized cross-account database access in a region. The vulnerabilities were discovered by researchers at cloud […]
Security Affairs
Researchers discovered flaws in the Azure Database for PostgreSQL Flexible Server that could result in unauthorized cross-account database access in a region. Microsoft addressed a couple of vulnerabilities impacting the Azure Database for PostgreSQL Flexible Server that could result in unauthorized cross-account database access in a region. The vulnerabilities were discovered by researchers at cloud […]
ThreatPost
The country’s citizens are being blocked from the internet because foreign certificate authorities can't accept payments due to Ukraine-related sanctions, so it created its own CA.
Bleeping Computer
Microsoft has addressed a chain of critical vulnerabilities found in the Azure Database for PostgreSQL Flexible Server that could let malicious users escalate privileges and gain access to other customers' databases after bypassing authentication.
SecurityWeek
UK firm Netcraft raised $100 million in funding and announced the hiring of a new chief executive to pursue global expansion plans.
The Hacker News
GitHub reports unauthorized access to Desktop & Atom apps repositories, leading to exposure of encrypted code-signing certificates.
The Hacker News
Researchers have discovered 5 new security vulnerabilities in multiple models of Aruba and Avaya network switches.
Security Affairs
GitHub confirmed that threat actors exfiltrated encrypted code signing certificates for some versions of GitHub Desktop for Mac and Atom apps. GitHub this week disclosed a security breach, threat actors exfiltrated encrypted code signing certificates for some versions of GitHub Desktop for Mac and Atom apps. In response to the incident, the Microsoft-owned company is started […]
Ars Technica
Code-signing is supposed to make people safer. In this case, it made them less so.
The Hacker News
Russian government has established a new SSL/TLS Certificate Authority and is rapidly pushing it into Russia to counter Western sanctions.
Bleeping Computer
Malware distributors are rotating payloads once again, switching between trojans that are many times an intermediary stage in a longer infection chain.
Bleeping Computer
The China-aligned APT (advanced persistent threat) group known as 'Bronze Starlight' was seen targeting the Southeast Asian gambling industry with malware signed using a valid certificate used by the Ivacy VPN provider.
Bleeping Computer
Threat actors are compromising Windows IIS servers to add expired certificate notification pages that prompt visitors to download a malicious fake installer.
Bleeping Computer
Russia has created its own trusted TLS certificate authority (CA) to solve website access problems that have been piling up after sanctions prevent certificate renewals.
Bleeping Computer
A digitally signed and trojanized version of the 3CX Voice Over Internet Protocol (VOIP) desktop client is reportedly being used to target the company's customers in an ongoing supply chain attack.
CyberNews
Ukrainians in Western tech firms urge companies to help their homeland by knocking down disinformation websites.
Bleeping Computer
One of the primary methods used by malware distributors to infect devices is by deceiving people into downloading and running malicious files, and to achieve this deception, malware authors are using a variety of tricks.
Bleeping Computer
A malicious document builder named EtterSilent is gaining more attention on underground forums, security researchers note. As its popularity increased, the developer kept improving it to avoid detection from security solutions.
The Record
Hackers based in China are targeting the gambling sector across Southeast Asia in a campaign that researchers say is closely related to data collection and surveillance operations identified earlier this year.
.webp)
Cyber Security News
The loaders, known as MalVirt, leverage the Windows Process Explorer driver for process termination together with obfuscated virtualization for anti-analysis and evasion.
Bleeping Computer
An ongoing Google ads malvertising campaign is spreading malware installers that leverage KoiVM virtualization technology to evade detection when installing the Formbook data stealer.
Bleeping Computer
A digitally signed and trojanized version of the 3CX Voice Over Internet Protocol (VOIP) desktop client is reportedly being used to target the company's customers in an ongoing supply chain attack.
CSO
The network switch vulnerabilities are considered critical and could allow attackers to break network segmentation, exfiltrate data, and escape captive portals.
The Record
More than 100 of the world’s most respected cybersecurity experts have written to European Union lawmakers to warn that a proposed legal reform that may soon become law could fundamentally undermine security online.
DarkReading
Analysts seem bullish about funding and M&A activity for the second half of the year, though transaction volumes and values dipped again in Q2.
CSO
Although the vulnerabilities were patched server-side, they allowed privilege escalation and authentication bypass.
CSO
The spear phishing group has revised its tactics and is employing more sophisticated techniques and tactics based on what appears to be extensive research into Facebook business and ads management accounts.
Naked Security
It’s a backdoor, Jim, but not as we know it… here’s a sober look at this issue.