The most relevant security news, explained in two minutes with what we recommend doing about it.
20 articles
Microsoft attributes to Storm-0940 a campaign that used already-authorised identities of the ConnectWise Cloud Backup application to enter Microsoft 365 tenants.
Source: Microsoft SecurityReadEight private keys used to issue digital certificates were compromised; browsers blocked the affected certificates.
Source: The Hacker NewsReadA campaign used compromised accounts to plant malicious automation in GitHub Actions and steal development secrets and cloud credentials.
Source: The Hacker NewsReadAn authentication bypass in Ivanti Connect Secure lets a remote attacker without credentials run commands on the gateway; it was exploited as a zero-day.
Source: CCN-CERTReadA court-authorised operation against three phishing-as-a-service platforms that, according to its backers, carried more than 1,000 million fraudulent emails and texts.
Source: The Hacker NewsReadMicrosoft shipped its October patch release with 1,411 vulnerabilities fixed, 70 of them critical, plus three zero-days, one already exploited, according to BleepingComputer.
Source: BleepingComputerReadAttackers took remote control of refrigeration controllers and forced defrost cycles that spoiled food and sparked fires.
Source: OCCRPReadAn email campaign delivers a signed, legitimate MSP360 RMM installer disguised as a document and then uses it to install ScreenConnect as a second remote access channel.
Source: Microsoft SecurityReadCitrix disclosed two critical flaws in NetScaler ADC and Gateway allowing remote code execution, with attacks already observed.
Source: Dark ReadingReadTwo application identities in the same tenant ran more than 150 destructive operations in 35 minutes and deleted most of over 100 storage accounts.
Source: Microsoft SecurityReadGoogle patched a privilege-escalation flaw in the Pixel modem in its September update and reported signs of limited, targeted exploitation.
Source: 9to5GoogleReadAn SQL injection in Cisco AsyncOS lets an unauthenticated remote attacker run commands as root by sending a crafted email; it is being exploited.
Source: CCN-CERTReadWe review your environment and tell you what to prioritise, with no commitment.
