September 20, 2024 at 04:36AM Ivanti announced the exploitation of two vulnerabilities in its Cloud Services Appliance (CSA): CVE-2024-8190 and CVE-2024-8963. The flaws allow unauthorized access and arbitrary command execution on devices. CSA 4.6 Patch 519 and CSA 5.0 address the vulnerabilities, with the latter recommended due to the end of life for 4.6. CISA … Read more
September 20, 2024 at 03:39AM Google introduced a Password Manager PIN for Chrome web users to securely sync passkeys across various devices. This PIN enhances security by end-to-end encrypting the passkeys, preventing access by anyone, including Google. Users can create a longer alpha-numeric PIN and are no longer required to scan a QR code. iOS … Read more
September 18, 2024 at 03:03AM The GSM Association aims to implement end-to-end encryption (E2EE) for messages between Android and iOS ecosystems through the RCS Universal Profile. This follows Apple’s support for RCS in its Messages app and Google’s adoption of the Signal protocol for RCS security. Meta also detailed plans for interoperability with third-party messaging … Read more
September 17, 2024 at 07:33AM OpenAI introduced improvements to data analysis in ChatGPT, allowing users to integrate with Google Drive and Microsoft OneDrive. However, this deep integration raises cybersecurity challenges. The post advises how to monitor and manage these connections in Google Workspace and recommends Nudge Security for discovering and managing all genAI integrations to … Read more
September 16, 2024 at 05:27AM Exploitation of the Ivanti Cloud Service Appliance (CSA) vulnerability CVE-2024-8190 began shortly after the vendor released patches. The high-severity flaw enables unauthorized access and remote code execution, affecting certain versions of the CSA. Ivanti has addressed the issue in Patch 519 and CSA 5.0, but noted limited customer exploitation. CISA … Read more
September 13, 2024 at 02:39PM Microsoft is redesigning anti-malware products’ interaction with Windows kernel to prevent a repeat of the global IT outage caused by a faulty CrowdStrike update. This will involve new platform capabilities in Windows 11, focusing on security and resilience goals. Microsoft aims to enforce Safe Deployment Practices for updates to avoid … Read more
September 12, 2024 at 09:36AM Aembit, a non-human identity and access management (IAM) provider, has raised $25 million in a Series A funding round, bringing the total raised to $45 million. The startup, founded in 2021, aims to solve the challenge of access between distributed applications and SaaS services. Aembit’s solution provides policy-based access management … Read more
September 10, 2024 at 07:39AM Shadow apps, a subset of Shadow IT, are SaaS applications procured without the security team’s knowledge. They may lack essential security measures and compliance standards, posing risks such as data leaks and regulatory violations. Standalone and integrated shadow apps both expand the company’s attack surface. SaaS Security Posture Management (SSPM) … Read more
August 23, 2024 at 01:32AM Hackers are exploiting a critical vulnerability in LiteSpeed Cache, a WordPress plugin for speeding up response times, just one day after the technical details were made public. Based on the meeting notes, it is imperative to take immediate action to address the critical severity vulnerability in LiteSpeed Cache, a WordPress … Read more
August 19, 2024 at 11:13AM The author highlights the increasing impact of AI in security analysis, acknowledging its efficiency but also cautioning about AI jailbreaking challenges. They discuss conflicting views on disclosure and suggest assuming AI jailbreaks are trivial, recommending focus on monitoring and rapid response rather than attempting to create unbreakable systems. The meeting … Read more