Supply chain

Zyxl NAS devices are under attack and the exploit is pretty simple, A new UEFI vulnerability with a name that some people don't like, that time you setup a load balancer and forgot about it, I love it when there is a vulnerability in a Wifi driver, Polyfill is filling the Internet with supply chain vulnerabilities, open source doesn't mean more sec...

The PoC exploit for the authentication bypass vulnerability is available; patch immediately.

Data stolen by a former Nuance employee, who has since been arrested and indicted, include demographic information, birthdates, addresses, hospital records, and other medical details.

U.S. luxury retailer Neiman Marcus had data from 64,472 individuals compromised following the breach of its Snowflake account.

Malware enabling rogue admin account creation has been injected into five WordPress plugins with more than 30,000 cumulative downloads as part of a software supply chain attack that commenced on Friday.

Acquisition of the domain led to Polyfill.io being CNAMEd to polyfill.io[.]bsclink[.]cn, which facilitated the deployment of malicious code redirecting to a fraudulent Google analytics domain.

Such sanctions have been derided by Kaspersky to be "unjustified and baseless," emphasizing that none of the sanctioned individuals are connected to Russian intelligence and military authorities.

Security pros say the follow-up social engineering attacks CDK's auto dealer customers experienced are standard fare today – so companies must stay vigilant.