Latest Cybersecurity News and Articles

---

The Changing Dynamics of Ransomware as Law Enforcement Strikes

Despite law enforcement actions disrupting major ransomware operations, the long-term impact remains uncertain as groups adapt and evolve. Ransomware-as-a-Service (RaaS) collectives are facing growing competition to attract affiliates.

---

Researchers Discover Over 20 Supply Chain Vulnerabilities in MLOps Platforms

Inherent vulnerabilities stem from the underlying formats and processes of the technology, allowing attackers to exploit features like automatic code execution in ML models and certain dataset formats.

---

Pidgin Users Beware! Malicious Plugin Discovered with Keylogger

The plugin, which was added to Pidgin’s third-party plugins list on July 6th, was flagged by a user, 0xFFFC0000, on August 16th, who reported suspicious behavior, including the unauthorized capture and sharing of screenshots.

---

Researchers Discover Several Potential Attack Vectors in Bicycles With Shimano Di2 Wireless Gear-Shifting System

Researchers found a vulnerability in the Shimano Di2 system’s proprietary protocol, making it susceptible to a replay attack. They demonstrated that an attacker could intercept and replay commands using off-the-shelf software-defined radio.

---

Tech Support Scam Found Hijacking Microsoft Search Queries Through Google Ads

Two deceptive campaigns were identified recently using Google ads and Microsoft's infrastructure. The first scam involves a fake helpdesk page on Microsoft Learn whereas the second one hijacks Microsoft search queries through a Google ad.

---

Critical SSTI Flaw in WPML Plugin Exposes Millions of WordPress Sites to RCE Attacks

This vulnerability allows authorized users to inject and execute malicious code through the plugin's shortcode feature, potentially leading to data theft and website takeover.

---

Centreon Issues Critical Security Update to Fix SQL Injection Vulnerabilities That Threaten IT Monitoring

These vulnerabilities, known as CVE-2024-32501, CVE-2024-33852, CVE-2024-33853, CVE-2024-33854, CVE-2024-5725, and CVE-2024-39841, pose a significant risk to organizations relying on Centreon for IT infrastructure monitoring.

---

Microsoft Fixes ASCII Smuggling Flaw That Enabled Data Theft from Microsoft 365 Copilot

Details have emerged about a now-patched vulnerability in Microsoft 365 Copilot that could enable the theft of sensitive user information using a technique called ASCII smuggling. "ASCII Smuggling is a novel technique that uses special Unicode characters that mirror ASCII but are actually not visible in the user interface," security researcher Johann Rehberger said. "This means that an attacker

---

Google Warns of CVE-2024-7965 Chrome Security Flaw Under Active Exploitation

Google has revealed that a security flaw that was patched as part of a security update rolled out last week to its Chrome browser has come under active exploitation in the wild. Tracked as CVE-2024-7965, the vulnerability has been described as an inappropriate implementation bug in the V8 JavaScript and WebAssembly engine. "Inappropriate implementation in V8 in Google Chrome prior to

---

Audit Finds Notable Security Gaps in FBI’s Storage Media Management

The FBI lacks proper policies and controls for tracking and disposing of storage media, leading to risks of loss or theft. The audit also identified physical security gaps in the media destruction process at FBI facilities.

---

Vulnerability Prioritization is Only the Beginning

Vulnerability prioritization is crucial in managing security threats but is only the beginning. Knowing which vulnerabilities to address is not enough; the focus should be on quickly addressing and mitigating them.

---

Marketing Data Security Threats Are Rising: Where CMOs See Gaps

A new report from the CMO Council and KPMG shows that building strong relationships between marketing and data security teams is crucial, but one-third of partnerships struggle with collaboration.

---

Fraud Tactics and the Growing Prevalence of AI Scams

Hiya, a call-blocking service, identified nearly 20 billion spam calls in the first half of 2024, with over 107 million spam calls daily. Of the 42 countries analyzed, 25 had spam flag rates exceeding 20%, some even surpassing 50%.

---

US Charges Alleged Member of Russian Karakurt Ransomware Group

A 33-year-old Latvian man, Deniss Zolotarjovs, residing in Moscow, has been charged in the U.S. with money laundering, financial fraud, and extortion related to the Russian ransomware group Karakurt.

---

Report: 63% of security practitioners experience burnout

A survey shows 63% of security practitioners experience burnout and reveals the key steps to retaining security talent. 

---

Over 3400 High and Critical Cyber Alerts Recorded in First Half 2024

A report from Critical Start’s Cyber Research Unit revealed over 3400 high and critical cyber alerts in the first half of 2024, marking a 46.15% increase in attacks in the US compared to 2023.

---

Fake Funeral Live Stream Scams Target Grieving Users on Facebook

This type of scam typically starts with a comment on a funeral home's Facebook notification, promoting a fake live stream of the funeral service or soliciting donations on behalf of the deceased family.

---

Russian Laundering Millions for Lazarus Hackers Arrested in Argentina

A 29-year-old Russian national has been arrested in Buenos Aires, Argentina by the federal police on charges of money laundering for North Korean Lazarus hackers using cryptocurrency.

---

WordPress Websites Used to Distribute ClearFake Trojan Malware

WordPress websites were found distributing the ClearFake Trojan malware, a dangerous threat that can lead to ransomware infections. The malware was disguised as a prompt to install a root certificate.

---

SonicWall Issues Critical Patch for Firewall Vulnerability Allowing Unauthorized Access

SonicWall has released security updates to address a critical flaw impacting its firewalls that, if successfully exploited, could grant malicious actors unauthorized access to the devices. The vulnerability, tracked as CVE-2024-40766 (CVSS score: 9.3), has been described as an improper access control bug. "An improper access control vulnerability has been identified in the SonicWall SonicOS