security update

Apple patches two zero-days used to target iOS users (CVE-2023-42916 CVE-2023-42917)

December 1, 2023

With the latest round of security updates, Apple has fixed two zero-day WebKit vulnerabilities (CVE-2023-42916, CVE-2023-42917) that “may have been exploited against …

Google fixes Chrome zero day exploited in the wild (CVE-2023-6345)

November 29, 2023

Google has released an urgent security update to fix a number of vulnerabilities in Chrome browser, including a zero-day vulnerability (CVE-2023-6345) that is being actively …

Why it’s the perfect time to reflect on your software update policy

November 27, 2023

The threat landscape is evolving by the minute, with both malicious actors and well-intentioned researchers constantly on the hunt for new attack vectors that bypass security …

MOVEit hackers leverage new zero-day bug to breach organizations (CVE-2023-47246)

November 9, 2023

A critical zero-day vulnerability (CVE-2023-47246) in the SysAid IT support and management software solution is being exploited by Lace Tempest, a ransomware affiliate known …

Attackers exploiting Apache ActiveMQ flaw to deliver ransomware (CVE-2023-46604)

November 2, 2023

Ransomware-wielding attackers are trying to break into servers running outdated versions of Apache ActiveMQ by exploiting a recently fixed vulnerability (CVE-2023-46604). …

Atlassian patches critical Confluence bug, urges for immediate action (CVE-2023-22518)

October 31, 2023

Atlassian is urging enterprise administrators to update their on-premises Confluence Data Center and Server installations quickly to plug a critical security vulnerability …

VMware patches critical vulnerability in vCenter Server (CVE-2023-34048)

October 25, 2023

VMware has fixed a critical out-of-bounds write vulnerability (CVE-2023-34048) and a moderate-severity information disclosure flaw (CVE-2023-34056) in vCenter Server, its …

“Disappearing” implants, followed by first fixes for exploited Cisco IOS XE zero-day

October 23, 2023

Cisco has released the first fixes for the IOS XE zero-day (CVE-2023-20198) exploited by attackers to ultimately deliver a malicious implant. The fixes were made available on …

Citrix NetScaler bug exploited in the wild since August (CVE-2023-4966)

October 18, 2023

A recently patched Citrix NetScaler ADC/Gateway information disclosure vulnerability (CVE-2023-4966) has been exploited by attackers in the wild since late August 2023, …

Valve introduces SMS-based confirmation to prevent malicious games on Steam

October 17, 2023

Video game publisher/digital distribution company Valve is forcing developers who publish games on its Steam platform to “validate” new builds with a confirmation …

Curl project squashes high-severity bug in omnipresent libcurl library (CVE-2023-38545)

October 11, 2023

Curl v8.4.0 is out, and fixes – among other things – a high-severity SOCKS5 heap buffer overflow vulnerability (CVE-2023-38545). Appropriate patches for some older …

Microsoft fixes exploited WordPad, Skype for Business zero-days (CVE-2023-36563, CVE-2023-41763)

October 10, 2023

On this October 2023 Patch Tuesday, Microsoft has released 103 patches and has fixed three actively exploited vulnerabilities (CVE-2023-36563, CVE-2023-41763, CVE-2023-44487). …