Latest Cybersecurity News and Articles

---

As Cars Hoover up More and More Drivers’ Data, is it Time to Regulate the Industry?

According to the California Privacy Protection Agency, cars are “connected computers on wheels” and should be treated as such. It recently announced its enforcement division will review the data privacy practices of connected vehicle manufacturers.

---

‘Downfall’ Vulnerability Leaves Billions of Intel CPUs at Risk

The vulnerability, known as Downfall, exploits a technique used to increase performance in the x86 architecture. By sharing a small register buffer, different applications can inadvertently leave data that can be accessed by an attacker.

---

Managing Human Cyber Risks Matters Now More Than Ever

As artificial intelligence amplifies the sophistication and reach of phishing, vishing, and smishing attacks, understanding and managing human cyber risks has become increasingly vital, according to the SANS Institute.

---

U.K. Electoral Commission Breach Exposes Voter Data of 40 Million Britons

The U.K. Electoral Commission on Tuesday disclosed a "complex" cyber attack on its systems that went undetected for over a year, allowing the threat actors to access years worth of voter data belonging to 40 million people. "The incident was identified in October 2022 after suspicious activity was detected on our systems," the regulator said. "It became clear that hostile actors had first

---

Interpol Takes Down 16shop Phishing-as-a-Service Platform

These platforms are a significant risk as they lower the bar of entry for inexperienced cybercriminals, offering them a simple and cost-effective way to launch phishing attacks with only a few clicks.

---

Electoral Commission and PSNI data breaches: what we know so far

Russia named as likely culprit in cyber-attack on election watchdog, while police service accidentally publishes staff detailsThe UK election watchdog and Northern Ireland’s police service both announced serious data breaches on Tuesday, in the latest example of the vulnerability of personal details to hacks and human error.The UK data regulator, the Information Commissioner’s Office (ICO), is looking at the incidents, which have raised immediate safety concerns over the consequences of leaking personal data. Here is what has happened and what we know so far. Continue reading...

---

Seasoned Cyber Pros are More Complacent in Their Skills Than Junior Staff

Average response time accelerated from 29 to 19 days, from 2021 to 2022, with lessons from Log4j and other high-profile vulnerabilities having a significant impact on urgency levels, according to Immersive Labs.

---

Yashma Ransomware Evolves with Multilingual Attack

A newly identified strain of Yashma ransomware has raised concerns as it was found targeting organizations across Bulgaria, China, Vietnam, and English-speaking countries since June 4. The Yashma ransomware, a rebranding of the Chaos strain, fetches ransom notes from a controlled GitHub repository through an embedded batch file. The ransom note's eerie resemblance to WannaCry adds to the intrigue, suggesting an effort to cloud attribution.

---

Microsoft Releases Patches for 74 New Vulnerabilities in August Update

This comprises six Critical and 67 Important security vulnerabilities. Also released by the tech giant are two defense-in-depth updates for Microsoft Office (ADV230003) and the Memory Integrity System Readiness Scan Tool (ADV230004).

---

Malicious Campaigns Exploit Weak Kubernetes Clusters for Crypto Mining

Exposed Kubernetes (K8s) clusters are being exploited by malicious actors to deploy cryptocurrency miners and other backdoors. Cloud security firm Aqua, in a report shared with The Hacker News, said a majority of the clusters belonged to small to medium-sized organizations, with a smaller subset tied to bigger companies, spanning financial, aerospace, automotive, industrial, and security sectors

---

Morgan & Morgan Sues Tampa General Hospital Over Data Breach

The exposed information encompasses sensitive details like names, addresses, phone numbers, dates of birth, Social Security numbers and select Health Insurance Portability and Accountability Act (HIPAA)-protected medical records.

---

New Inception Attack Leaks Sensitive Data From All AMD Zen CPUs

Researchers at ETH Zurich have now combined an older technique named 'Phantom speculation' (CVE-2022-23825) with a new transient execution attack called 'Training in Transient Execution' (TTE) to create an even more powerful 'Inception' attack.

---

Norway Threatens Meta With Fines for Ad Violations

The Norwegian data regulator says it will start fining Facebook parent company Meta nearly $100,000 daily starting on Monday unless the social media giant stops showing users behavioral ads without their explicit consent.

---

Microsoft Visual Studio Code Flaw Lets Extensions Steal Passwords

Microsoft's Visual Studio Code (VS Code) code editor and development environment contains a flaw that allows malicious extensions to retrieve authentication tokens stored in Windows, Linux, and macOS credential managers.

---

New Android 14 Security Feature: IT Admins Can Now Disable 2G Networks

Google has introduced a new security feature in Android 14 that allows IT administrators to disable support for 2G cellular networks in their managed device fleet. The search giant said it's introducing a second user setting to turn off support, at the model level, for null-ciphered cellular connections. "The Android Security Model assumes that all networks are hostile to keep users safe from

---

New SkidMap Malware Variant Targets Linux Distributions

A highly sophisticated malware variant called SkidMap is targeting vulnerable Redis services on a wide range of Linux distributions, including Alibaba, Anolis, CentOS, and RedHat. The attack chain begins with attackers logging into unsecured Redis instances via brute force attacks and setting up variables containing cron tasks under a base64 string. 

---

Microsoft Releases Patches for 74 New Vulnerabilities in August Update

Microsoft has patched a total of 74 flaws in its software as part of the company's Patch Tuesday updates for August 2023, down from the voluminous 132 vulnerabilities the company fixed last month. This comprises six Critical and 67 Important security vulnerabilities. Also released by the tech giant are two defense-in-depth updates for Microsoft Office (ADV230003) and the Memory Integrity System

---

New Report Exposes Vice Society's Collaboration with Rhysida Ransomware

Tactical similarities have been unearthed between the double extortion ransomware group known as Rhysida and Vice Society, including in their targeting of education and healthcare sectors. "As Vice Society was observed deploying a variety of commodity ransomware payloads, this link does not suggest that Rhysida is exclusively used by Vice Society, but shows with at least medium confidence that

---

Ensuring data privacy while working remotely

Protecting the personal information of remote executives.

---

Microsoft Patch Tuesday, August 2023 Edition

Microsoft Corp. today issued software updates to plug more than 70 security holes in its Windows operating systems and related products, including a patch that addresses multiple zero-day vulnerabilities currently being exploited in the wild.