Vulnerability ManagementUbuntu affected by 10-year-old flaws in needrestart packageLaura FrenchNovember 20, 2024The five vulnerabilities could lead to local privilege escalation without user interaction.
Critical Infrastructure SecurityCISA Dir. Jen Easterly to step down Jan. 20: Security community reactsLaura FrenchNovember 19, 2024Easterly has led the agency since July 2021 and was instrumental in driving the Secure by Design initiative.
RansomwareUpstart SafePay ransomware group uses LockBit builder, claims 22 victimsLaura FrenchNovember 18, 2024Huntress researchers describe two SafePay ransomware incidents resulting in file encryption and exfiltration.
AI/MLGoogle fixes 2 Vertex AI flaws that could lead to privilege escalation, model leaksLaura FrenchNovember 14, 2024An exploit using a poisoned model could enable exfiltration of sensitive fine-tuned LLM adapters.
Government RegulationsLegal protections for security researchers sought in new German draft lawLaura FrenchNovember 7, 2024A proposed amendment would exclude legitimate security research from the definition of data espionage.
Cloud SecuritySnowflake data theft suspect arrested in CanadaLaura FrenchNovember 5, 2024Alexander “Connor” Moucka, 26, is accused of stealing data from Ticketmaster, AT&T and more.
AI/MLGoogle’s Big Sleep LLM agent discovers exploitable bug in SQLiteLaura FrenchNovember 4, 2024The Gemini 1.5 Pro-driven agent used variant analysis to discover the stack buffer underflow flaw.
Critical Infrastructure SecurityCISA Director Easterly seeks to quell concerns about election securityLaura FrenchNovember 1, 2024Easterly addressed ballot security, disinformation and voter databases in public comments this week.
PhishingFake product listings on real shopping sites lead to stolen payment informationLaura FrenchOctober 31, 2024The “Phish ‘n’ Ships” threat operation has infected more than 1,000 websites and has possibly stolen tens of millions of dollars.
RansomwareNorth Korean nation-state threat actor using Play ransomwareLaura FrenchOctober 30, 2024The “Jumpy Pisces” cyberespionage group appeared to provide initial access for ransomware deployment.
