Month: October 2024
On the second day of Pwn2Own Ireland 2024, competing white hat hackers showcased an impressive 51 zero-day vulnerabilities, earning a total of $358,625 in cash prizes. Pwn2Own is a hacking contest where security researchers compete to exploit software and mobile hardware devices to earn the coveted title of “Master of Pwn” and $1,000,000 in cash…
Read More
The vulnerability—which has been exploited in attacks compromising more than 50 FortiManager devices, according to Mandiant researchers—was disclosed by Fortinet Wednesday. A critical-severity FortiManager vulnerability publicly disclosed by Fortinet this week has been exploited in attacks dating back to late June, according to Mandiant researchers. The attacks exploiting the flaw (tracked at CVE-2024-47575) has compromised…
Read More
Oct 24, 2024Ravie LakshmananVulnerability / Network Security Cisco on Wednesday said it has released updates to address an actively exploited security flaw in its Adaptive Security Appliance (ASA) that could lead to a denial-of-service (DoS) condition. The vulnerability, tracked as CVE-2024-20481 (CVSS score: 5.8), affects the Remote Access VPN (RAVPN) service of Cisco ASA and…
Read More
Latrodectus is a Windows malware downloader first detected in October 2023 that functions as a backdoor. The malware downloads executable and DLL payloads. Latrodectus can also execute commands. Threat actors are increasingly using Latrodectus malware to target businesses in the financial, automotive, and healthcare sectors. Latrodectus primarily spreads through phishing emails containing malicious attachments disguised…
Read More
Sometimes, it turns out that the answers we struggled so hard to find were sitting right in front of us for so long that we somehow overlooked them. When the Department of Homeland Security, through the Cybersecurity and Infrastructure Security Agency (CISA), in coordination with the FBI, issues a cybersecurity warning and prescribes specific action,…
Read More
The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a now-patched security flaw in Google Chrome to seize control of infected devices. Cybersecurity vendor Kaspersky said it discovered a novel attack chain in May 2024 that targeted the personal computer of an unnamed Russian national with the…
Read More
Oct 24, 2024Ravie LakshmananVulnerability / Network Security Fortinet has confirmed details of a critical security flaw impacting FortiManager that has come under active exploitation in the wild. Tracked as CVE-2024-47575 (CVSS score: 9.8), the vulnerability is also known as FortiJump and is rooted in the FortiGate to FortiManager (FGFM) protocol. “A missing authentication for critical…
Read MoreMS-ISAC ADVISORY NUMBER: 2024-120 DATE(S) ISSUED: 10/23/2024 OVERVIEW: A vulnerability has been discovered in Fortinet FortiManager which could allow for remote code execution. FortiManager is a network and security management tool that provides centralized management of Fortinet devices from a single console. Successful exploitation of the most severe of these vulnerabilities could allow for remote…
Read More
‘Companies are going to be able to decide, ‘Do I go for growth? Invent new use cases? Solve new customer problems and grow again.’ And I think we can lift the whole GDP of the world economy,’ ServiceNow CEO Bill McDermott tells CRN. ServiceNow Wednesday unveiled new AI technologies and expanded strategic relationships with Nvidia…
Read More
‘We aim to help MSPs grow by offering new services that allow them to differentiate and expand their offerings,’ says SonicWall CEO Bob VanKirk. After making three acquisitions in four months, following 14 years of no M&A activity, cybersecurity vendor SonicWall has one goal in mind: to provide MSP-friendly solutions. The acquisitions were driven by…
Read More