Security News

Morningstar Security News gathers all the most popular infosec and cyber security news headlines into a single page that auto-updates 24/7.

Most Popular

Exploits

Bug Bounties

Vulnerabilities

Tools

Exploit Dev

Reversing/I like ASM

Malware/APT

Crypto

Podcasts

Threat Intel

Privacy/VPNs

Help Wanted

Locks/Social Engineering

Security Blogs

Mainstream Media

Thirsty for more

Security Twitterverse

PacketStorm
Microsoft Says Fix For Two Exchange Zero Days On Accelerated Timeline new
Rights Groups Say Pentagon Is Buying Its Way Around The 4th Amendment new
This Is The GrayKey 2.0, The Tool Cops Use To Hack Phones new
NYPD Considers Using Encryption To Block Public From Radio Scanner Broadcasts
Exchange Server Zero-Day Being Actively Exploited
MI5 Website Briefly Hit By Denial Of Service Attack
FBI Arrests Former NSA Employee For Trying To Sell Top Secret Documents
Optus: How A Massive Data Breach Has Exposed Australia
Hackers Are Making DDoS Attacks Sneakier And Harder To Protect Against
How Hobbyist Hackers Are Preserving Pokemon's Past And Shaping Its Future
UK Watchdog Dismisses Criticisms Over Crypto Authorizations
Akamai Finds 13 Million Malicious Newly Observed Domains A Month
The Register
Gone in a day: Ethical hackers say it would take mere hours to empty your network new
Microsoft warns of North Korean crew posing as LinkedIn recruiters
Stop us if you've heard this one before: Exchange Server zero-days actively exploited
Ex-eBay execs jailed for cyberstalking web critics
How CIA betrayed informants with shoddy front websites built for covert comms
Pentagon is far too tight with its security bug bounties
Covert malware targets VMware shops for hypervisor-level espionage
Microsoft to kill off old access rules in Exchange Online
Matrix chat encryption sunk by five now-patched holes
The web's cruising at 13 million new and nefarious domain names a month
Want to sneak a RAT into Windows? Buy Quantum Builder on the dark web
Hacked Fast Company sends 'obscene and racist' alerts via Apple News
Reddit - NetSec
Wiresocks for easy proxied routing new
Emulate Shellcode with Radare2 new
/r/netsec's Q4 2022 Information Security Hiring Thread new
H4CK1NG G00GL3 - Security challenges new
Reddit is looking for a Security Data Engineer
VNCERT/CC has just developed a tool to check Exchange's 0-day exploit http request blocking. #exchange #0day #exploit #vncertcc
What I learnt from reading 220 IDOR bug reports.
Detecting Mimikatz with Busylight
Arbitrary cache poisoning on all Akamai websites via 'Connection: Content-Length'
New attack campaign utilized a new 0-day RCE vulnerability on Microsoft Exchange Server
GitHub - swanandx/lemmeknow: The fastest way to identify anything! Blazingly Fast alternative to PyWhat made with Rust.
The Confusing Lifetimes of AWS IAM Identity Center Access Tokens
Bleeping Computer
The Hacker News
Pay What You Want for This Collection of White Hat Hacking Courses new
State-Sponsored Hackers Likely Exploited MS Exchange 0-Days Against ~10 Organizations new
CISA Warns of Hackers Exploiting Critical Atlassian Bitbucket Server Vulnerability new
New Malware Families Found Targeting VMware ESXi Hypervisors
Cyber Attacks Against Middle East Governments Hide Malware in Windows logo
New Malware Campaign Targeting Job Seekers with Cobalt Strike Beacons
Why Organisations Need Both EDR and NDR for Complete Network Protection
North Korean Hackers Weaponizing Open-Source Software in Latest Cyber Attacks
Microsoft Confirms 2 New Exchange Zero-Day Flaws Being Used in the Wild
WARNING: New Unpatched Microsoft Exchange Zero-Day Under Active Exploitation
Brazilian Prilex Hackers Resurfaced With Sophisticated Point-of-Sale Malware
Researchers Uncover Covert Attack Campaign Targeting Military Contractors

Threat Wire

Exploits

Packet Storm Exploits
Packet Storm New Exploits For September, 2022 new
ZKSecurity BIO 3.0.5.0_R Privilege Escalation new
ZKSecurity BIO 4.1.2 SQL Injection / Code Execution new
Centreon 22.04.0 Cross Site Scripting new
GuppY CMS 6.00.10 Shell Upload new
Joomla MyMuse 4.3.0 SQL Injection new
Joomla JS Jobs Pro 1.3.6 SQL Injection new
Joomla jMarket 5.15 Cross Site Scripting new
Joomla DJ-Classifieds Ads 3.9 Cross Site Scripting
jCart For OpenCart 3.0.3.19 Cross Site Scripting
Joomla JoomRecipe 4.2.2 Cross Site Scripting
qdPM 9.1 Authenticated Shell Upload
Exploit-DB Webapps
[webapps] Feehi CMS 2.1.1 - Remote Code Execution (RCE) (Authenticated)
[webapps] Wordpress Plugin WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS)
[webapps] Wordpress Plugin 3dady real-time web stats 1.0 - Stored Cross Site Scripting (XSS)
[webapps] Aero CMS v0.0.1 - SQLi
[webapps] Testa 3.5.1 Online Test Management System - Reflected Cross-Site Scripting (XSS)
[webapps] TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE)
[webapps] Bookwyrm v0.4.3 - Authentication Bypass
[webapps] Buffalo TeraStation Network Attached Storage (NAS) 1.66 - Authentication Bypass
[webapps] Gitea 1.16.6 - Remote Code Execution (RCE) (Metasploit)
[webapps] Sophos XG115w Firewall 17.0.10 MR-10 - Authentication Bypass
[webapps] WordPress Plugin Testimonial Slider and Showcase 2.2.6 - Stored Cross-Site Scripting (XSS)
[webapps] WordPress Plugin Netroics Blog Posts Grid 1.0 - Stored Cross-Site Scripting (XSS)
Exploit-DB Local and Privilege Escalation
[local] Blink1Control2 2.2.7 - Weak Password Encryption
[local] Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path
[local] Kite 1.2021.610.0 - Unquoted Service Path
[local] Dr. Fone 4.0.8 - 'net_updater32.exe' Unquoted Service Path
Exploit-DB DoS
Exploit-DB Shellcode
Exploit-DB Papers
Exploit-DB Remote
[remote] Teleport v10.1.1 - Remote Code Execution (RCE)
[remote] Wifi HD Wireless Disk Drive 11 - Local File Inclusion
[remote] WiFiMouse 1.8.3.4 - Remote Code Execution (RCE)
[remote] Mobile Mouse 3.6.0.4 - Remote Code Execution (RCE)
[remote] Airspan AirSpot 5410 version 0.3.4.1 - Remote Code Execution (RCE)
[remote] PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated)
[remote] uftpd 2.10 - Directory Traversal (Authenticated)
[remote] Omnia MPX 1.5.0+r1 - Path Traversal
[remote] Easy Chat Server 3.1 - Remote Stack Buffer Overflow (SEH)
[remote] rpc.py 0.6.0 - Remote Code Execution (RCE)
[remote] Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) - Remote Code Execution
[remote] IOTransfer 4.0 - Remote Code Execution (RCE)

LiveOverflow

Bug Bounties

Vulnerabilities

Tools

Exploit Dev

Reversing/I like ASM

Reddit - Reverse Engineering
Poseidon’s Offspring: Charybdis and Scylla new
Found this obfuscated script on my website. Anyone can help me deobfuscate it?
Reconstructed source code of the game Duke Nukem II
IDA 2022 Plug-In Contest
Tips and tricks for reversing foreign architecture games
What’s In A Bit – Designing, Using And Reverse-engineering Binary File Formats - Peter Bindels
Process Memory Basics for Reverse Engineers - Tracking Memory With A Debugger (OALABS Tutorial)
/r/ReverseEngineering's Weekly Questions Thread
Racoon Stealer V2 / Record Breaker Malware Analysis
What else can be made out of cement
Native function and Assembly Code Invocation - Check Point Research [IDA Appcall,Dumpulator,Unicorn Engine]
Druva inSync for Mac Local Privilege Escalation
Reddit - Game Hacks
Undetected Apex Legends External Cheat new
The best cheat to any game i’ve seen! new
The best cheat to any game i’ve seen! new
Fortnite Hacker for Hire? new
The best cheat to any game i’ve seen!
is this place just kids beg for cheats???
What is this subreddit?????
The best cheat to any game i’ve seen!
Any r6 payed hacks that’s not a virus?
What's a good place to start learning how to make cheats?
the state of games • A podcast
WARZONE/MW/VANGUARD TOOLS/SERVICES(console&pc)
Reddit - REGames
Reconstucted source code for Duke Nukem II new
Linux Help
Trying to break Shadow Hunter: A New World (or Demon Hunter: Shadow World) save data
Return to Monkey Island *.ggpack tool
Guided Hacking requires paid accounts to view posts
Help with decompiling PS3 files
Seeking x64dbg/Ghidra Pro For Research Project $$$
Where to start? Reverse engineering RA2 Yuri’s revenge
Have you seen Nvidia's RTX Remix demo? Curious how it'll serve as an RE tool for, say, quickly ripping assets, models, etc. from games!
When you reverse engineer a game can you also hack it to get as many items as you want?
When you reverse engineer a game, can you add multiplayer/online features?
What can you do with a reverse engineered game?
StackExchange - ReverseEngineering
How do I create a native app with Visual Studio 2022? new
Reverse-engineering a 90s CNC machine (FORTH like) firmware new
How do I reverse an exe packed with an unknown packer?
Get radare2 to only display assembly code without other info
How to disassemble an entire function in Windbg?
Huawei HG8145V5 Router PPPoE Password Decryption
Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code
Identify two structs in IDA
can't debug properly
How to prevent dynamic loader from modifying binary in memory?
Decompiling an executable compiled by vercel/pkg
unpack ZXIC chip firmware

Guided Hacking

Malware/APT

Crypto

Reddit - Crypto
DOMtegrity: Integrity checking for the web browser - A proposal by Newcastle University new
r/Crypto, can you help take down an evil tool that's stealing people's private keys?
Utilizing OpenSSL In Javascript Within Node.js
Need Assistance Converting Public Key Types
What is getting signed in XML Signature (XMLDsig)?
Can someone tell me if my method of substitution alphabets good way to cipher it?
Weekly cryptography community and meta thread
A couple of questions about libsodium...
SSL/TLS certificates survey (in wild) + RSA GCD attack in 2022
How practical are side channel attacks?
StackExchange - Crypto
How to distribute Android mobile app functionality between OS, Trusted Execution Environment (TEE) and Secure Element (SE)? new
Fastest cipher for use with openssl and x86 (Intel)? new
Proof of equality without involving Peggy after the fact new
Difference between the eavesdropping and the CPA experiment in the case of multiple messages new
Question regarding a subset of p=?np new
Building 256-hash function from known 64-bit hash functions new
Is there a metaverse/application where I can feature my 3D NFTs? [closed] new
How to create a CSPRNG seed that can be used to shuffle a deck of cards new
How do I try a timing attack on a public-key implementation on a general-purpose computer?
Difference between ElGamal and Schnorr signature
512/N-Bit Key AES
How much Computer Science theory needs to be learnt for learning zkSnarks & what is a good book for it?

Seytonic

Podcasts

Security Weekly
PSW #757 - Ev Kontsevoy, Casey Ellis
PSW #756 - Sinan Eren
PSW #755 - Thomas Kinsella
PSW #754 - John Hammond
PSW #753 - Davi Ottenheimer, Daniel Niefeld, Zachary Stashis
PSW #752 - Greg Conti & Chris Blask
PSW #751 - Jesse Michael & Mickey Shkatov
PSW #750 - Guy Bruneau
PSW #749 - Larry Pesce
PSW #748 - Lesley Carhart
PSW #747 - Andy Robbins
PSW #746 - Joseph Menn
Risky.Biz
Risky Biz Soap Box: Why Microsoft's Smart Application Control is very strange
Risky Business #680 -- Uber, Rockstar Games hacker arrested
Risky Business #679 -- A look at Uber's very bad week
Risky Biz Soap Box: Haroon Meer on "sensitive command tokens"
Risky Business #678 -- Iranians Gone Wild
Risky Business #677 -- A day late and a dollar short: China doxxes NSA op
Risky Business #676 -- Okta, Authy users among Twilio hack targets
Risky Business #675 -- The problem with Mudge's whistleblowing complaint
Risky Biz Soap Box: Okta's Brett Winterford on session cookie theft and mitigations
Risky Business #674 -- "Free money" exploit spawns $150m blockchain feeding frenzy
Risky Business #673 -- When throwing computers into a woodchipper is standard IR
Risky Business #672 -- "Expected behaviour" is in the eye of the beholder
The CyberWire
Targeting your browser bookmarks? [Research Saturday] new
Espionage, both online and in-person. Sabotage, both kinetic and (maybe eventually) cyber. Waterin holes, deepfakes, and the pushing of naughty words.
Hackers support Iranian dissidents. Notes on C2C markets. Cyberespionage campaigns. Intercepted mobile calls from Russian troops expose morale problems.
DDoS remains commonplace in Russia's hybrid war. Leaked LockBit 3.0 builder used by new gang. Meta takes down Russian disinfo networks. Lazarus Group goes spearphishing.…
Ukraine's Defense Intelligence warns of coming Russian cyberattacks against infrastructure. Next moves for Lapsus$? Cashout scams and neglected wallets. Developments in the Optus breach.
Unrest in Iran finds expression in cyberspace. Cyber conflict and diplomacy. Cybercrime in the hybrid war. And there seems to have been an arrest in…
Adam Marrè: Learning to be a leader. [CISO] [Career Notes]
Keeping an eye on RDS vulnerabilities. [Research Saturday]
Privateers seem to be evolving into front groups for the Russian organs. Unidentified threat actors engaging in cyberespionage. Catphishing from a South Carolina prison.
GRU operators masquerade as Ukrainian telecommunications providers. 2K Games Support compromised to spread malware. Developments in the cyber underworld.
CISA Alert AA22-265A – Control system defense: know the opponent. [CISA Cybersecurity Alerts]
CISA Alert AA22-264A – Iranian state actors conduct cyber operations against the government of Albania. [CISA Cybersecurity Alerts]
Cyber Security Interviews
ISC Daily Stormcast
ISC StormCast for Friday, September 30th, 2022
ISC StormCast for Thursday, September 29th, 2022
ISC StormCast for Wednesday, September 28th, 2022
ISC StormCast for Tuesday, September 27th, 2022
ISC StormCast for Monday, September 26th, 2022
ISC StormCast for Friday, September 23rd, 2022
ISC StormCast for Thursday, September 22nd, 2022
ISC StormCast for Wednesday, September 21st, 2022
ISC StormCast for Tuesday, September 20th, 2022
ISC StormCast for Monday, September 19th, 2022
Darknet Diaries
124: Synthetic Remittance
123: Newswires
122: Lisa
121: Ed
Presenting: Click Here "Lapsus$"

Threat Intel

Reddit - Onions
Best resources, tutorials and communities to become a hacker new
Ukraine onion links new
seller wont send my order new
Questions regarding XMPP over TOR. new
How is this done ? site (don't think it's required): BreachForums
How do I access dark web websites
Will factory reseting my phone be enough to get rid of proof?
What do y'all do when on the dark web?
Dark web advice .
What should i try?
Tails and Steam Deck compatibility?
hi i am New deep web user need some cool onion sites to surf
Reddit - Pwned
American Airlines employees' Office365 accounts compromised by criminals; data breach affects over 1,700 customers and employees
Optus notifies customers of cyberattack compromising customer information
Cambridgeshire police warning Clarion Housing personal data leaked onto the Dark Web
Uber hacked, internal systems breached and vulnerability reports stolen
Los Angeles Unified School District hit by ransomware over Labor Day Weekend, but classes and normal operations resumed Tuesday
US tax agency IRS unintentionally posted private data on ~120,000 taxpayers to its website
Samsung discloses data breach after July hack, their second in 2022. Data included customers' names, contacts and demographic information, dates of birth, and product registration…
Student Loan servicer Nelnet breached, exposing data of 2.5M borrowers, including contact details and Social Security Number
Delivery app-maker DoorDash breached by criminals who stole credentials from employees of a third-party vendor, Twillio
Media-player software company Plex warns users to reset passwords after data breach
Email marketing firm Klaviyo disclosed a data breach after threat actors gained access to internal systems and downloaded marketing lists for cryptocurrency-related customers.
T-Mobile to pay $500M for one of the largest data breaches in US history
HaveIBeenPwned
TAP Air Portugal - 5,067,990 breached accounts
Brand New Tube - 349,627 breached accounts
START - 7,455,386 breached accounts
Banorte - 2,107,000 breached accounts
SitePoint - 1,021,790 breached accounts
Twitter - 6,682,453 breached accounts
QuestionPro - 22,229,637 breached accounts
Tuned Global - 985,586 breached accounts
Mecho Download - 437,928 breached accounts
Battlefy - 83,610 breached accounts
Paytm - 3,395,101 breached accounts
PPCGeeks - 492,518 breached accounts

Privacy/VPNs

Slashdot - Rights
Danish Pirate Site Blocking Updated, Telecoms Group Publishes All Domains new
House Democrats Debut New Bill To Limit US Police Use of Facial Recognition new
MGM Paid Problem Gambler To Not Report Online Glitches
NSA Employee Leaked Classified Cyber Intel, Charged With Espionage
UN Elects First Female Tech Agency Secretary-General
EU Proposes Rules Making It Easier To Sue Drone Makers, AI Systems
UK Online Safety Bill Threatens Security, WhatsApp Chief Warns
All 50 States Get Green Light To Build EV Charging Stations
Oracle Pays $23 Million To SEC To Settle Bribery Charges
Stock Trade Ban For Congress Is Being Readied For Release In US House
Senators Push To Reform Police's Cellphone Tracking Tools
SEC Sues Former MoviePass Executives, Alleges They Made 'False or Misleading Statements' To Public
Reddit - Privacy
Pi-hole and NextDNS new
have been hacked? new
Help hiding location on life360 on iOS new
Will Using an Extension like "Disbale Page visibility API" stop teachers from seeing when you leave the quiz on canavs, to go to another link? new
Any alternatives to Google Drive SHARED ACCESS feature? new
Why did Norton access the Macbook Keychain during uninstallation? new
Unboxing, bad baby and evil Santa: how YouTube got swamped with creepy content for kids – podcast | News | The Guardian new
INVISV Relay: Providing Multi-Hop Privacy for All new
Finding Possible Rental Surveillance by Landlord new
Time to Switch Back to Firefox-Chrome’s new ad-blocker-limiting extension platform will launch in 2023 new
Should I use Aurora Store if I use Google Play Services? new
7 Reasons Privacy Should Be Considered a Human Right new
Reddit - VPN
building won't allow VPN's new
why my vpn is not working for ometv new
Why do some VPNs change my wireless icon to Ethernet? new
Can VPN Reduce ping? new
Where Did All the SSTP VPN Providers Go? new
Obfuscating OpenVPN or Wireguard inside a Docker container new
my vpn doesn't work new
What’s with Picture in Picture on YouTube not working for ages and randomly start working again today? Not premium but VPN set to US new
Why are commercial VPNs easier to block? new
Any success using Roku 4k with a vpn new
Netflix
How does it work?
PrivacyTools.io
EFF
EFF to NJ court: Give defendants information regarding police use of facial recognition technology new
Victory! Court Unseals Records Showing Patent Troll’s Shakedown Efforts new
Google Loses Appeal Against EU's Record Antitrust fine, But Will Big Tech Ever Change?
Automated License Plate Readers Threaten Abortion Access. Here's How Policymakers Can Mitigate the Risk
EFF Urges FTC to Address Security and Privacy Problems in Daycare and Early Education Apps
Google’s Perilous Plan for a Cloud Center in Saudi Arabia is an Irresponsible Threat to Human Rights
Ban Government Use of Face Recognition In the UK
Study of Electronic Monitoring Smartphone Apps Confirms Advocates’ Concerns of Privacy Harms
San Francisco’s Board of Supervisors Grants Police More Surveillance Powers
Lawsuit: SMUD and Sacramento Police Violate State Law and Utility Customers’ Privacy by Sharing Data Without a Warrant
How to Ditch Facebook Without Losing Your Friends (Or Family, Customers or Communities)
Giving Big Corporations “Closed Generic” Top-Level Domain Names to Run as Private Kingdoms Is Still a Bad Idea

Help Wanted

Reddit - AskNetSec
Reddit - Netsec Students
What kinds of services would you keep separated from an edge device or software? new
Application Security for Dummies
What are some good entry level jobs a new graduate should start applying for?
Comprehensive List of CVE PoC's
Stackoverflow - Security
Are VPN leaky when used in WSL-2? new
Resource server with Spring Security 5 issue with SecurityContextPersistenceFilter in SpringSecurityChain new
Why are all my passwords appearing in data breach? new
Hi everybody , i want have a solution for my problem how to "bypass" "hack" an authentication on terminal prompt new
How can I use an HTTPS client certificate protected api with Firefox new
Nuking the Python inspect module to allow for private data new
Bad Certificate in soap response using UploadCertificate in AdvanceSecurity new
Authenticating a user through AJAX
Can Philips light bulbs connect to WIFI? [closed]
How are attackers circumventing my php webapp's authentication?
How to distribute mobile app functionality between Android REE, Trusted Execution Environment (TEE) and Secure Element (SE)?
Securing connection between iOS app and Server [closed]
Stack Exchange
How does Apple password leak check differ from HaveIBeenPwned? new
Privacy of using personal email on work phone new
PGP disk passphrase not recognized [migrated] new
Dismissing 500 errors in logwatch new
Using your own server as a proxy without having set it up as a proxy new
How much data of a user get recorded by service providers? [closed] new
Get root permission on android for metasploit new
Can someone find out my other websites based on the IP address of one of my websites? [duplicate] new
Can you exclude scanning of a particular app or file on Avast Antivirus for Samsung? new
Does i need vpn to update/upgrade packages on fedora or debian if https is configured in sources file
Should password strength validation also be run server-side or only client-side?
How to make the website owner anonymous? [duplicate]

Locks/Social Engineering

Reddit - Lockpicking
Another 55/40 Bites the Dust!!! new
Training Tools Prep for Newbie new
Lockmail! This CL is so beautiful. I can’t wait to pick it. new
I like picking a lot more than gutting so I tapped out the plugs and threaded the holes. now I can drop in security pins… new
Does anybody have a hardened chain lock here that they are willing to sell me for cheap? new
Round tension wrench? new
Visited a museum in Wisconsin with a Harry Houdini exhibit. Here is a replica of the picks he used. new
Would this count as a challenge lock? https://youtu.be/T9u3g-0uYko new
RIP - DOM IX6SR bricked. new
How do I open a lock like this without knowing the code? The building I work in has a lot of them and no one… new
Snapshot of r/lockpicking belt stats. new
Today fanally i beat the trioving with seven pins. next step assa d12 new
Reddit - Social Engineering
Fashion Brands After The Great Reset
How do you go from asking someone for small favor to a big favor?
how do you deal with seniors who is rude?
Free gifts usually involve a trick or a hidden obligation.
Future social engineering attacks
Trying to find zip code and address tools
When's the best time during a conversation to ask a favor?
How do you deal with a friend with hypomania ?
how do you give someone the feeling of being included in something?
Dr Robert Epstein: Google Is Way Creepier Than You Think - How the world's most powerful company is shaping all of us...
What parts of someone's personality do you mirror?
is Mitnick's AoD and AoI still relevant today?

Hak5

Security Blogs

Whitehat Security Blog
HITB News
Better than JPEG? Researcher discovers that Stable Diffusion can compress images
The Unlikely Cure for Burnout? A Second Job
Hacker Behind Optus Breach Releases 10,200 Customer Records in Extortion Scheme
VPN Providers Flee India as a New Data Law Takes Hold
Everything you need to know about Zen 4, socket AM5, and AMD’s newest chipsets
Russia plans “massive cyberattacks” on critical infrastructure, Ukraine warns
Interpol issues red notice for crypto founder Do Kwon
Not All Bots Are Bad, and Twitter Knows It
Malwarebytes Gets $100M Weeks After Laying Off 14% of Staff
Researchers Uncover Mysterious 'Metador' Cyber-Espionage Group
AI model from OpenAI automatically recognizes speech and translates it to English
A New Linux Tool Aims to Guard Against Supply Chain Attacks
The RISKS Digest
Tesla Megapack battery fire spurs shelter-in-place warning in California
NTSB wants all new vehicles to check drivers for alcohol use
Optus' breach exposes 9.8M customers' data
LastPass says hackers had internal access for four dayso
The UN Wants to Curb Anti-Satellite Missile Tests
Vulnerability of insulin pumps
15-Year-Old Python Bug Allows Code Execution in 350k Projects
Artist finds private medical record photos in popular AI training data set
Uber blames contractor for hack
The ITU's Secretary-General Election Could Shape the Internet's Future
How vigilante *predator catchers* are infiltrating the criminal justice system
'Protestware' is on the rise, with programmers self-sabotaging their own code. Should we be worried?
Kaspersky Blog
Vulnerability in tarfile module | Kaspersky official blog
Transatlantic Cable podcast, episode 269 | Kaspersky official blog
What’s wrong with NFTs | Kaspersky official blog
Have you revoked ex-employees’ access? | Kaspersky official blog
Agent Tesla trojan in spam | Kaspersky official blog
Transatlantic Cable podcast, episode 268 | Kaspersky official blog
The Harly Trojan subscriber in Google Play apps | Kaspersky official blog
Global Transparency Initiative update: September 2022 | Kaspersky official blog
Kaspersky EDR optimum updated | Kaspersky official blog
Transatlantic Cable podcast, episode 267 | Kaspersky official blog
RedLine stealer spreads on YouTube disguised as game cheats | Kaspersky official blog
Microsoft patches 64 vulnerabilities, one being exploited
Adam Shostack & friends
Security Bloggers Network
BSidesLV 2022 Lucky13 GroundFloor – Remi Escourrou’s, Xavier Gerondeau’s And Gauthier Sebaux’s ‘CICD Security: A New Eldorado (Talk)’ new
Cybersecurity Awareness Month Champion | See Yourself in Cyber | Contrast Security new
Get Ready for Cybersecurity Awareness Month new
Hackers Use Telegram, Signal, Dark Web to Help Iranian Protesters
Preparing for Cyber Insurance? 6 Questions to Ask Your IT Team Today
This Week in Malware – 135 Packages Target npm and PyPI Registries
New DHS Cybersecurity Grant Program – Seceon Offers Expertise in Developing Your Cyber Plan
Identity Attack Watch: September 2022
BSidesLV 2022 Lucky13 CommonGround – Robert “TProphet” Walker’s ‘The Exclave Experience: Relocating To ‘Almost Canada”
Poisoning the source – How and why attackers are targeting developer accounts
Warning: N. Korean Job Scams Push Trojans via LinkedIn
Defend from within | Intrusion suppression with runtime protection, continuous monitoring & application security | Contrast SecurityDefend from within
Graham Cluley
Prison for ex-eBay staff who aggressively cyberstalked company’s critics with Craigslist sex party ads and funeral wreaths
Watchfinder warns customers that hackers stole their data
IT admin admits sabotaging ex-employer’s network in bid for higher salary
Smashing Security podcast #291: Deepfake dangers, AI image opt out, and controlling your urges
TAP Air Portugal confirms hack, as Ragnar Locker gang leaks data – including that of Portugese president
Beware Revolut frozen card scams sent via SMS text
Teen hacking suspect charged with computer misuse and breach of bail conditions
See how Pentera identifies and mitigates the risk of your most exploitable exposed credentials
Oxford teen arrested in UK on suspicion of hacking
“Fake crypto millionaire” charged with alleged $1.7M cryptomining scam
Come to the National Information Security Conference in October, and see Smashing Security LIVE!
How to have fun negotiating with a ransomware gang
ThreatPost
Rapid7
CVE-2022-41040 and CVE-2022-41082: Unpatched Zero-Day Vulnerabilities in Microsoft Exchange Server
[The Lost Bots] S02E04: Cyber's Most Dangerous Game — Threat Hunting
The Empty SOC Shop: Where Has All the Talent Gone?
[Security Nation] Taki Uchiyama of Panasonic on Product Security and Incident Response
What’s New in InsightVM and Nexpose: Q3 2022 in Review
How to Deploy a SIEM That Actually Works
One Year After IntSights Acquisition, Threat Intel’s Value Is Clear
Prioritizing XDR in 2023: Stronger Detection and Response With Less Complexity
How to Accelerate Your SOAR Program to Full Speed in Less Than a Year
CVE-2022-36804: Easily Exploitable Vulnerability in Atlassian Bitbucket Server and Data Center
[Security Nation] Chris Levendis and Lisa Olson on Cloud CVEs
The 2022 SANS Top New Attacks and Threats Report Is In, and It's Required Reading
digitalmunition
Hacker News (YCombinator) - Security
Bruce Willis Sells Deepfake Likeness Rights So His 'Twin' Can Star in Movies new
Hacking Google new
AMD Zen 4 is faster with CPU security mitigations enabled on Linux
'Big short' investor says white-collar jobs bubble is 'bursting'
'Big Short' investor says white-collar jobs bubble is 'bursting'
Hacker group Guacamaya leaks military and police emails from various countries
Rust and Elixir libraries for end-to-end encrypted secure communication
House Democrats debut new bill to limit US police use of facial recognition
Microsoft bakes a VPN into Edge and turns it on
Medtronic's MiniMed 600 insulin pumps potentially at risk of compromise
US expected to publish Privacy Shield executive order next week
Kubernetes Security: 10 Best Practices from the Industry and Community
eHacking News
Hacker Noon #Security
Wired - Security
Microsoft Exchange Server Has a Zero-Day Problem new
The Challenge of Cracking Iran’s Internet Blockade new
Go Update iOS, Chrome, and HP Computers to Fix Serious Flaws
A Matrix Update Patches Serious End-to-End Encryption Flaws
Mystery Hackers Are ‘Hyperjacking’ Targets for Insidious Spying
The Race to Find the Nord Stream Saboteurs
Cloudflare Takes a Stab at a Captcha That Doesn’t Suck
This Chatbot Aims to Steer People Away From Child Abuse Material
How to Advocate for Data Privacy and Users' Rights
The Dire Warnings in the Lapsus$ Hacker Joyride
The Best VPNs to Protect Yourself Online
This Vote Could Change the Course of Internet History
Krebs on Security
Microsoft: Two New 0-Day Flaws in Exchange Server
Accused Russian RSOCKS Botmaster Arrested, Requests Extradition to U.S.
Botched Crypto Mugging Lands Three U.K. Men in Jail
Say Hello to Crazy Thin ‘Deep Insert’ ATM Skimmers
Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
Transacting in Person with Strangers from the Internet
Violence-as-a-Service: Brickings, Firebombings & Shootings for Hire
Final Thoughts on Ubiquiti
How 1-Time Passcodes Became a Corporate Liability
PayPal Phishing Scam Uses Invoices Sent Via PayPal
When Efforts to Contain a Data Breach Backfire
Sounding the Alarm on Emergency Alert System Flaws
Naked Security
S3 Ep102.5: “ProxyNotShell” Exchange bugs – an expert speaks [Audio + Text] new
URGENT! Microsoft Exchange double zero-day – “like ProxyShell, only different”
S3 Ep102: How to avoid a data breach [Audio + Transcript]
Optus breach – Aussie telco told it will have to pay to replace IDs
WhatsApp “zero-day exploit” news scare – what you need to know
Uber and Rockstar – has a LAPSUS$ linchpin just been busted (again)?
Morgan Stanley fined millions for selling off devices full of customer PII
S3 Ep101: Uber and LastPass breaches – is 2FA all it’s cracked up to be? [Audio + Text]
Interested in cybersecurity? Join us for Security SOS Week 2022!
LastPass source code breach – incident response report released
S3 Ep100.5: Uber breach – an expert speaks [Audio + Text]
UBER HAS BEEN HACKED, boasts hacker – how to stop it happening to you
Schneier on Security
Friday Squid Blogging: Breeding the Oval Squid new
Security Vulnerabilities in Covert CIA Websites
Differences in App Security/Privacy Based on Country
Cold War Bugging of Soviet Facilities
New Report on IoT Security
Leaking Passwords through the Spellchecker
Friday Squid Blogging: Another Giant Squid Washes Up on New Zealand Beach
Leaking Screen Information on Zoom Calls through Reflections in Eyeglasses
Prompt Injection/Extraction Attacks against AI Systems
Automatic Cheating Detection in Human Racing
Credit Card Fraud That Bypasses 2FA
Large-Scale Collection of Cell Phone Data at US Borders
Linux Security
Star Labs Shares More Details on Its Upcoming StarFighter 4K Linux Laptop
Rust Is Eating into our Systems, and It's a Good Thing
LibreWolf 105.0.1-1
Official Guide on Rocky Linux & How to Install It
The 6 Best Private Encrypted Chat Apps for Linux Users
A Match Made in Heaven: systemd Comes to Windows Subsystem for Linux
Enterprise Encryption for Linux
LLVM 15.0.1 Released With Nearly Three Dozen Fixes
Alert: 15-year-old Python tarfile Flaw Lurks in 'Over 350,000' Code Projects
Business VPNs: Now More Important Than Ever
Linux Log Analysis
Linus Torvalds: Rust will go into Linux 6.1
Dark Reading
Worried About the Exchange Zero-Day? Here's What to Do new
LA School District Ransomware Attackers Now Threaten to Leak Stolen Data
Reshaping the Threat Landscape: Deepfake Cyberattacks Are Here
Cybercriminals See Allure in BEC Attacks Over Ransomware
Trojanized, Signed Comm100 Chat Installer Anchors Supply Chain Attack
Microsoft Confirms Pair of Blindsiding Exchange Zero-Days, No Patch Yet
SolarMarker Attack Leverages Weak WordPress Sites, Fake Chrome Browser Updates
With the Software Supply Chain, You Can't Secure What You Don't Measure
Onyxia Raises $5M to Help Companies Proactively Manage Cybersecurity Risks Using AI
Cyera Survey Finds One in Three Respondents Want to Minimize Cloud Data Risk
Safous Adds Browser Isolation to Its Zero-Trust Network Access Service
Israel Cybersecurity Enterprise (ICE) Teams with CybeReady to Deliver World-Class Security Training
Securelist
The secrets of Schneider Electric’s UMAS protocol
Prilex: the pricey prickle credit card complex
NullMixer: oodles of Trojans in a single dropper

Security in Mainstream Media

Google News Hacking
Colorado county mistakenly sends $238K to hackers after cyberattack - FOX 10 News Phoenix new
Woman registers FIR against husband for hacking her e-mail - The Statesman new
TDP Twitter account targetted by hackers.. - Greatandhra new
Hackers Uncovered Elden Ring's Darkest Wildlife Mystery - Cracked.com new
M'luru: School of Social Work Roshni Nilaya holds workshop on digital forensics, ethical hacking - Daijiworld.com new
A Security Expert Tells Us How To Protect Your Personal Data From Hackers - SheFinds new
Soul Hackers 2 Fails to Surpass Its Predecessor - CBR - Comic Book Resources new
Polish PM's aide, target of email hacking, resigns - ABC News
Polish PM's aide, target of email hacking, resigns - The Associated Press - en Español
DoD Announces Final Results of 'Hack US' Bug Bounty Program - SecurityWeek
Israeli spyware said used to hack senior Indonesian officials last year - The Times of Israel
Nadia rejects Censor’s ‘proposal’ after hacking claims - Dexerto
Google Cyber Security
Measures proposed to ensure cyber security - newagebd.net new
One cyber attack can cause a $100000 loss to over 40% of businesses - Digital Information World new
Adams Brown launches cybersecurity division - GREAT BEND TRIBUNE - Great Bend Tribune new
Contrast Security Champions Cybersecurity Awareness Month 2022 - PR Newswire new
Cybersecurity Awareness Month Champion | See Yourself in Cyber | Contrast Security - Security Boulevard new
BBB: Protect your PII this National Cybersecurity Awareness Month - Tyler Morning Telegraph new
Cybersecurity Awareness Month – Mike Dunleavy - Alaska Governor Office new
Qatar Rail Cyber Security Operations Centre ready for World Cup - The Peninsula new
Why your business could be denied cybersecurity coverage by insurance carriers - Kansas City Business Journal - The Business Journals new
Scarborough set to become 'national centre of excellence' for cyber security - The Yorkshire Post new
LMG Security expands its cybersecurity solutions and services - Help Net Security new
How cybersecurity frameworks apply to web application security - Security Boulevard new