Truesec

It sounds like a disaster. So far, it isn’t. Of the thousands of alleged exploits on GitHub, most are either broken or assume the server already has another serious vulnerability. Several of them, it turns out, were built with AI models that quietly made the test server vulnerable to prove the point. Working examples exist, but they require PHP to run as an Apache module and ...

Recent incidents indicate that Russia is now targeting Starlink infrastructure in Eastern Europe. On 23 September, power equipment at a Starlink ground station near Warsaw was set on fire. Polish authorities suspect that the perpetrators acted on behalf of Russian intelligence. On 9 October, attackers damaged Starlink antennas at the Plana Teleport facility south of Sofia. A ...

Security researchers reports that both vulnerabilities seems to be remote code execution (RCE) vulnerabilities. As no technical details are currently available for the vulnerabilities, apart from their CVSS scores of 9.2, which indicate the potential for unauthenticated remote code execution, it is currently unknown which part of PHP is involved, whether it’s reachable over a...

This issue affects firewalls with GlobalProtect portal or gateway configured when authentication override cookies are enabled and a specific certificate configuration exists.

Since October 19, Palo Alto’s Unit42 has observed ransomware groups leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authen...

One campaign method is to attach a malicious .ics file to a fake calendar invite. Another is to send a fake Teams meeting invite whose “Join” link leads to a phishing site at login.microsoft.com, users can reveal the actual URL by hovering over the link. The phishing site is used to harvest credentials. More than 40,000 organizations have received these emails.

The ...