Security Leftovers
-
LWN ☛ Security updates for Thursday
Security updates have been issued by AlmaLinux (container-tools:rhel8), Debian (flatpak), Fedora (389-ds-base, dotnet8.0, and roundcubemail), Red Hat (bind9.16, firefox, python-setuptools, and thunderbird), Slackware (dovecot), SUSE (389-ds, curl, kernel, kernel-firmware, kubernetes1.25, openssl-1_1, openssl-3, python-Pillow, and zziplib), and Ubuntu (busybox, linux-azure, and ruby-rmagick).
-
Security Week ☛ SolarWinds Issues Hotfix for Critical Web Help Desk Vulnerability
SolarWinds has released a hotfix for a critical Java deserialization remote code execution vulnerability in Web Help Desk.
-
Federal News Network ☛ Wales optimism about federal cyber is stronger than ever
Brandon Wales, the now former executive director of CISA, said in an “exit” interview agencies have more resilient federal cybersecurity architecture today.
-
Security Week ☛ Ransomware Attacks on Industrial Firms Surged in Q2 2024
Dragos has seen a significant increase in ransomware attacks on industrial organizations in Q2 2024 compared to the previous quarter.
-
Security Week ☛ Mayor of Columbus, Ohio, Says Ransomware Attackers Stole Corrupted, Unusable Data
Hackers recently stole data from Ohio’s largest city, but what they got was not usable and no personal information about city workers was made available online, the mayor said.
-
Security Week ☛ AutoCanada Hit by Cyberattack
AutoCanada has disclosed a disruptive cybersecurity incident after also being impacted by the recent CDK Global ransomware attack.
-
Security Week ☛ Palo Alto Networks Patches Unauthenticated Command Execution Flaw in Cortex XSOAR
Palo Alto Networks has patched multiple vulnerabilities, including ones rated high severity, in several products.
-
Silicon Angle ☛ Misconfigured access controls expose sensitive data on Oracle NetSuite websites
A new report out today from software-as-a-service security management company AppOmni Inc. is warning of an issue in Oracle NetSuite’s SuiteCommerce platform that could allow attackers to access sensitive data due to misconfigured access controls on custom record types. -
Atlantic Council ☛ The UN finally advances a convention on cybercrime . . . and no one is happy about it
The treaty risks empowering authoritarian governments, harming global cybersecurity, and endangering human rights.
-
OpenSSF (Linux Foundation) ☛ GUAC v0.8.0 Released
GUAC v0.8.0 is now available. This release brings support for license information, node deletion, and many other improvements.