Security Leftovers

posted by Roy Schestowitz on Nov 19, 2023

• Computer Weekly ☛ Russian cyber criminal pleads guilty to running IPStorm botnet[Ed: Windows TCO]

  Sergey Manikin, a joint Moldovan-Russian national who ran a botnet proxy network known as IPStorm that compromised computer systems all over the world, has pled guilty to three counts of violating US fraud laws against knowingly causing the transmission of a program to intentionally cause damage without authorisation to protected computers.

• TechTarget ☛ VMware discloses critical, unpatched Cloud Director bug

  A manual workaround is currently available for a critical VMware Cloud Director Appliance flaw, tracked as CVE-2023-34060, but no patch is available at press time.

• TechTarget ☛ LockBit observed exploiting critical 'Citrix Bleed' flaw [Ed: Windows TCO]

  The Financial Services Information Sharing and Analysis Center warned that LockBit ransomware actors are exploiting CVE-2023-4966, also known as Citrix Bleed.

• TechTarget ☛ SBOM formats compared: CycloneDX vs. SPDX vs. SWID Tags

  Software bills of materials, or SBOMs, inventory every application in use at an organization. This standard catalog of application components and dependencies boosts software supply chain security by enabling security teams to find and mitigate application security vulnerabilities, as well as ensure compliance with internal and government regulations.

• 2023-11-13 [Older] Freexian Collaborators: Monthly report about Debian Long Term Support, October 2023 (by Roberto C. Sánchez)

• Gizmodo ☛ 2023-11-14 [Older] Millions of Old Bitcoin Wallets Have Critical Security Flaws, Experts Say

• US News And World Report ☛ 2023-11-11 [Older] Australia Ports Operator Suffers 'Cybersecurity Incident', Suspends Operations [Ed: Windows TCO]

• US News And World Report ☛ 2023-11-16 [Older] North American Grid Regulator Tests Physical, Cyber Security Preparedness

• Engadget ☛ 2023-11-15 [Older] Google's updated Titan security key can store up to 250 passkeys [Ed: But Google is not a security idol/titan. It is a spying company.]

• CISA ☛ 2023-11-17 [Older] Juniper Releases Security Advisory for Juniper Secure Analytics

• CISA ☛ 2023-11-16 [Older] Citrix Releases Security Updates for Citrix Hypervisor

• CISA ☛ 2023-11-14 [Older] Adobe Releases Security Updates for Multiple Products

• CISA ☛ 2023-11-14 [Older] Fortinet Releases Security Updates for FortiClient and FortiGate

• CISA ☛ 2023-11-14 [Older] Microsoft Releases November 2023 Security Updates

• CISA ☛ 2023-11-14 [Older] Microsoft Releases October 2023 Security Updates

• CISA ☛ 2023-11-14 [Older] VMware Releases Security Update for Cloud Director Appliance

• CISA ☛ 2023-11-16 [Older] CISA Adds Three Known Exploited Vulnerabilities to Catalog

• CISA ☛ 2023-11-16 [Older] CISA Releases Fourteen Industrial Control Systems Advisories

• CISA ☛ 2023-11-16 [Older] CISA Requests Comment on Draft Secure Software Development Attestation Form

• CISA ☛ 2023-11-16 [Older] FBI and CISA Release Advisory on Scattered Spider Group

• CISA ☛ 2023-11-16 [Older] Red Lion Sixnet RTUs

• CISA ☛ 2023-11-16 [Older] Siemens Desigo CC product family

• CISA ☛ 2023-11-16 [Older] Siemens Mendix Runtime

• CISA ☛ 2023-11-16 [Older] Siemens SIMATIC PCS neo

• CISA ☛ 2023-11-16 [Older] Siemens OPC UA Modeling Editor (SiOME)

• CISA ☛ 2023-11-16 [Older] Siemens SCALANCE Family Products

• CISA ☛ 2023-11-16 [Older] Siemens COMOS

• CISA ☛ 2023-11-16 [Older] Siemens Mendix Studio Pro

• CISA ☛ 2023-11-16 [Older] Siemens PNI

• CISA ☛ 2023-11-16 [Older] Siemens RUGGEDCOM APE1808 Devices

• CISA ☛ 2023-11-15 [Older] CISA, FBI, and MS-ISAC Release Advisory on Rhysida Ransomware

• CISA ☛ 2023-11-14 [Older] CISA Adds Three Known Exploited Vulnerabilities to Catalog

• CISA ☛ 2023-11-14 [Older] CISA Releases Roadmap for Artificial Intelligence Adoption

• CISA ☛ 2023-11-14 [Older] CISA Releases Two Industrial Control Systems Advisories

• CISA ☛ 2023-11-14 [Older] AVEVA Operations Control Logger

• CISA ☛ 2023-11-14 [Older] Rockwell Automation SIS Workstation and ISaGRAF Workbench

• CISA ☛ 2023-11-13 [Older] ACSC and CISA Release Business Continuity in a Box

• CISA ☛ 2023-11-13 [Older] CISA Adds Six Known Exploited Vulnerabilities to Catalog

• CISA ☛ 2023-11-13 [Older] CISA Releases Update to Royal Ransomware Advisory

• Security highlights from KubeCon + CloudNativeCon 2023

• TechTarget ☛ Veteran platform engineers share lessons learned, wish lists [Ed: LF puff pieces. Follow the money.]

  Platform engineering is the new DevOps, but few companies have reached maturity; reps from early adopter orgs shared tips, caveats and a call to action at KubeCon.