News

Cyber Security Reviews NEWS brings you the latest daily updates on trends and happenings around the globe.

A newly designed privacy-sensitive architecture aims to enable developers to create smart home apps in a manner that addresses data sharing concerns and puts users in control over their personal information. Dubbed Peekaboo by researchers from Carnegie Mellon University, the system “leverages an in-home hub to pre-process and minimize outgoing data in a structured and
The volatility of the cyber insurance market and the threat landscape makes understanding how your company fits into both incredibly important. Cynthia James, an enterprise security executive at Microsoft, spoke at RSA Conference 2022 on Monday about what makes cyber insurance so tricky and the best ways for CISOs and others in the field to
A suspected state-aligned threat actor has been attributed to a new set of attacks exploiting the Microsoft Office “Follina” vulnerability to target government entities in Europe and the U.S. Enterprise security firm Proofpoint said it blocked attempts at exploiting the remote code execution flaw, which is being tracked CVE-2022-30190 (CVSS score: 7.8). No less than
A new critical remote code execution bug in enterprise collaboration software Atlassian Confluence is under attack, and no patch is currently available. The vulnerability, which was first discovered by incident response vendor Volexity, was made public via a Thursday security advisory from Atlassian. In the advisory, Atlassian said the flaw, CVE-2022-26134, was a “critical severity
Atlassian on Friday rolled out fixes to address a critical security flaw affecting its Confluence Server and Data Center products that have come under active exploitation by threat actors to achieve remote code execution. Tracked as CVE-2022-26134, the issue is similar to CVE-2021-26084 — another security flaw the Australian software company patched in August 2021.
As the threat landscape evolves and multiplies with more advanced attacks than ever, defending against these modern cyber threats is a monumental challenge for almost any organization. Threat detection is about an organization’s ability to accurately identify threats, be it to the network, an endpoint, another asset or an application – including cloud infrastructure and
Most organizations run their enterprise data network as though it comprises three separate and largely independent networks. The campus network includes the LANs to which most end-user and IoT devices are attached. The WAN connects campus networks to each other, to data centers and to clouds. And the data center network connects server applications to
It’s no secret that 3rd party apps can boost productivity, enable remote and hybrid work and are overall, essential in building and scaling a company’s work processes. An innocuous process much like clicking on an attachment was in the earlier days of email, people don’t think twice when connecting an app they need with their
Twitter is in the hot seat again for violating users’ privacy by misusing personal data that was submitted for security purposes. Three years ago, Twitter admitted that personal information provided by users for two-factor authentication (2FA) purposes was “inadvertently” used in targeted advertisements. Now, it might be paying the penalty. The Department of Justice (DOJ)
Details have emerged about a recently patched critical remote code execution vulnerability in the V8 JavaScript and WebAssembly engine used in Google Chrome and Chromium-based browsers. The issue relates to a case of use-after-free in the instruction optimization component, successful exploitation of which could “allow an attacker to execute arbitrary code in the context of
Quanta Cloud Technology (QCT) servers have been identified as vulnerable to the severe “Pantsdown” Baseboard Management Controller (BMC) flaw, according to new research published today. “An attacker running code on a vulnerable QCT server would be able to ‘hop’ from the server host to the BMC and move their attacks to the server management network,
Over the past decade, REST APIs have become a de facto architectural approach for modern web and mobile application platforms. They separate data and presentation layers, allowing systems to scale in size and feature sophistication over time. However, as data moves across boundaries, security becomes a key concern for REST APIs containing sensitive information. One
A year-long international investigation has resulted in the arrest of the suspected head of the SilverTerrier cybercrime group by the Nigeria Police Force. “The suspect is alleged to have run a transnational cybercrime syndicate that launched mass phishing campaigns and business email compromise schemes targeting companies and individual victims,” Interpol said in a statement. Operation
Containers revolutionized the development process, acting as a cornerstone for DevOps initiatives, but containers bring complex security risks that are not always obvious. Organizations that don’t mitigate these risks are vulnerable to attack. In this article, we outline how containers contributed to agile development, which unique security risks containers bring into the picture – and
The move toward abandoning passwords is coming closer as Apple, Google and Microsoft announced plans to expand support for the Fast Identity Online Alliance’s FIDO2 specification, enabling users to enroll in passwordless authentication with multiple devices across the three platforms. Users will soon be able to use passwordless authentication in Android and iOS, Chrome, Edge
QNAP devices have been hit by DeadBolt ransomware for at least the second time in less than six months. In January, QNAP warned users that a new ransomware strain was widely targeting its network-attached storage (NAS) devices using an alleged zero-day vulnerability. DeadBolt was encrypting users’ data and demanding bitcoin payments in ongoing attacks on