HPE Warns Sudo Bug Gives Attackers Root Privileges to Aruba Platform

HPE joins Apple in warning customers of a high-severity Sudo vulnerability.

QNAP Is Latest to Get Dinged by OpenSSL Bugs Fallout

The NAS maker issued two security advisories about the RCE and DoS flaws, adding to a flurry of advisories from the vast array of companies whose products use OpenSSL.

Pegasus Spyware Uses iPhone Zero-Click iMessage Zero-Day

The new exploit was deployed against iOS versions 14.4 & 14.6, blowing past Apple's new BlastDoor sandboxing to install spyware on iPhones.

Windows 10 Admin Rights Gobbled by Razer Mouse

So much for Windows 10's security: A zero-day in the device installer software grants admin rights just by plugging in a mouse or other compatible device. UPDATE: Microsoft is investigating.

Nigerian Threat Actors Solicit Employees to Deploy Ransomware for Cut of Profits

Campaign emails company insiders and initially offers 1 million in Bitcoin if they install DemonWare on an organization’s network.

Web Censorship Systems Can Facilitate Massive DDoS Attacks

Systems are ripe for abuse by attackers who can abuse systems to launch DDoS attacks.

Kerberos Authentication Spoofing: Don’t Bypass the Spec

Yaron Kassner, CTO at Silverfort, discusses authentication-bypass bugs in Cisco ASA, F5 Big-IP, IBM QRadar and Palo Alto Networks PAN-OS.

LockBit 2.0 Ransomware Proliferates Globally

Fresh attacks target companies' employees, promising millions of dollars in exchange for valid account credentials for initial access.

Amazon’s Plan to Track Worker Keystrokes: A Sign of Controls to Come?

Amazon is considering rolling out keyboard-stroke monitoring for its customer-service reps.

Black Hat: Microsoft's Patch for Windows Hello Bypass Bug is Faulty, Researchers Say

Researchers show how to circumvent Microsoft’s Windows Hello biometric authentication using a spoofed USB camera.