Update now! April’s Patch Tuesday includes a fix for one zero-day

Categories: Exploits and vulnerabilities

Categories: News

Tags: Microsoft

Tags: Apple

Tags: Google

Tags: Adobe

Tags: Cisco

Tags: SAP

Tags: Mozilla

Tags: CVE-2023-28252

Tags: CVE-2023-28231

Tags: CVE-2023-21554

Tags: Word

Tags: Publisher

Tags: Office

One fixed vulnerability is being actively exploited by a ransomware gang and many others were fixed in this month’s Patch Tuesday updates.

(Read more…)

The post Update now! April’s Patch Tuesday includes a fix for one zero-day appeared first on Malwarebytes Labs.

Read more

DEV-0196: QuaDream’s “KingsPawn” malware used to target civil society in Europe, North America, the Middle East, and Southeast Asia

Credit to Author: Microsoft Security Threat Intelligence| Date: Tue, 11 Apr 2023 16:00:00 +0000

Microsoft analyzes a threat group tracked as DEV-0196, the actor’s iOS malware “KingsPawn”, and their link to an Israel-based private sector offensive actor (PSOA) known as QuaDream, which reportedly sells a suite of exploits, malware, and infrastructure called REIGN, that’s designed to exfiltrate data from mobile devices.

The post DEV-0196: QuaDream’s “KingsPawn” malware used to target civil society in Europe, North America, the Middle East, and Southeast Asia appeared first on Microsoft Security Blog.

Read more

Tech bigwigs: Hit the brakes on AI rollouts

More than 1,100 technology luminaries, leaders, and scientists have issued a warning against labs performing large-scale experiments with artificial intelligence (AI) more powerful than ChatGPT, saying the technology poses a grave threat to humanity.

In an open letter published by Future of Life Institute, a nonprofit organization with the mission to reduce global catastrophic and existential risks to humanity, Apple co-founder Steve Wozniak and SpaceX and Tesla CEO Elon Musk joined other signatories in agreeing AI poses “profound risks to society and humanity, as shown by extensive research and acknowledged by top AI labs.”

To read this article in full, please click here

Read more

MERCURY and DEV-1084: Destructive attack on hybrid environment

Credit to Author: Microsoft Security Threat Intelligence| Date: Fri, 07 Apr 2023 16:00:00 +0000

Microsoft detected a unique operation where threat actors carried out destructive actions in both on-premises and cloud environments.

The post MERCURY and DEV-1084: Destructive attack on hybrid environment appeared first on Microsoft Security Blog.

Read more

DevOps threat matrix

Credit to Author: Microsoft Security Threat Intelligence| Date: Thu, 06 Apr 2023 17:00:00 +0000

In this blog, we discuss threats we face in our DevOps environment, introducing our new threat matrix for DevOps. Using this matrix, we show the different techniques an adversary might use to attack an organization from the initial access phase and forward.

The post DevOps threat matrix appeared first on Microsoft Security Blog.

Read more

Super FabriXss: an RCE vulnerability in Azure Service Fabric Explorer

Categories: Exploits and vulnerabilities

Categories: News

Tags: Azure

Tags: Microsoft

Tags: Super FabriXss

Tags: RCE

Tags: vulnerability

Tags: CVE-2023-23383

Researchers disclosed how they found a remote code execution vulnerability in Azure Service Fabric Explorer.

(Read more…)

The post Super FabriXss: an RCE vulnerability in Azure Service Fabric Explorer appeared first on Malwarebytes Labs.

Read more

“BingBang” flaw enabled altering of Bing search results, account takeover

Categories: News

Tags: bing

Tags: microsoft

Tags: azure

Tags: takeover

Tags: search

Tags: results

Tags: access

We take a look at the BingBang flaw which allowed for search engine manipulation in Bing.

(Read more…)

The post “BingBang” flaw enabled altering of Bing search results, account takeover appeared first on Malwarebytes Labs.

Read more