Asus lets processor security fix slip out early, AMD confirms patch in progress
Answers on a postcard to what 'Microcode Signature Verification Vulnerability' might mean
Patches23 Jan 2025 | 2
Patches
Oracle emits 603 patches, names one it wants you to worry about soon
Old flaws that keep causing trouble haunt Big Red
Patches23 Jan 2025 |
Microsoft issues out-of-band fix for Windows Server 2022 NUMA glitch
Update addresses boot failures on multi-node systems
Patches22 Jan 2025 | 4
Patch procrastination leaves 50,000 Fortinet firewalls vulnerable to zero-day
Seven days after disclosure and little action taken, data shows
Patches21 Jan 2025 | 2
Six vulnerabilities in ubiquitous rsync tool announced and fixed in a day
Turns out tool does both file transfers and security fixes fast
Patches17 Jan 2025 | 19
Windows Patch Tuesday hits snag with Citrix software, workarounds published
Microsoft starts 2025 as it hopefully doesn't mean to go on
Patches15 Jan 2025 | 8
Microsoft fixes under-attack privilege-escalation holes in Hyper-V
Patch Tuesday Plus: Excel hell, angst for Adobe fans, and life's too Snort for Cisco
Patches15 Jan 2025 | 7
Cryptojacking, backdoors abound as fiends abuse Aviatrix Controller bug
This is what happens when you publish PoCs immediately, hm?
Patches13 Jan 2025 | 1
Zero-day exploits plague Ivanti Connect Secure appliances for second year running
Factory resets and apply patches is the advice amid fortnight delay for other appliances
Patches09 Jan 2025 | 2
Mitel 0-day, 5-year-old Oracle RCE bug under active exploit
3 CVEs added to CISA's catalog
Security08 Jan 2025 | 4
Critical security hole in Apache Struts under exploit
You applied the patch that could stop possible RCE attacks last week, right?
Patches17 Dec 2024 | 3
Apache issues patches for critical Struts 2 RCE bug
More details released after devs allowed weeks to apply fixes
Patches12 Dec 2024 |
Three more vulns spotted in Ivanti CSA, all critical, one 10/10
Patch up, everyone – that admin portal is mighty attractive to your friendly cyberattacker
Patches11 Dec 2024 | 2
Microsoft holds last Patch Tuesday of the year with 72 gifts for admins
Patch Tuesday Twas the night before Christmas, and all through the house, patching was done with the click of a mouse
Security10 Dec 2024 | 24
Micropatchers share 1-instruction fix for NTLM hash leak flaw in Windows 7+
Updated Microsoft's OS sure loves throwing your creds at remote systems
Patches06 Dec 2024 | 13
PoC exploit chains Mitel MiCollab 0-day, auth-bypass bug to access sensitive files
updated Still unpatched 100+ days later, watchTowr says
Cyber-crime06 Dec 2024 | 4
Perfect 10 directory traversal vuln hits SailPoint's IAM solution
Updated 20-year-old info disclosure class bug still pervades security software
Patches03 Dec 2024 | 6
Zabbix urges upgrades after critical SQL injection bug disclosure
US agencies blasted 'unforgivable' SQLi flaws earlier this year
Patches29 Nov 2024 | 7
QNAP and Veritas dump 30-plus vulns over the weekend
Updated Just what you want to find when you start a new week
Patches26 Nov 2024 | 2
1,000s of Palo Alto Networks firewalls hijacked as miscreants exploit critical hole
Updated PAN-PAN! Intruders inject web shell backdoors, crypto-coin miners, more
CSO22 Nov 2024 | 22
Popular
Trump nukes 60 years of anti-discrimination rules for federal contractors
The (good old) boys are back in town
Atlassian's Bitbucket Cloud went down 'hard' today
Same, Big A, same
Patch procrastination leaves 50,000 Fortinet firewalls vulnerable to zero-day
Seven days after disclosure and little action taken, data shows
Trump hits undo on Biden AI safety order, EV mandate, emissions standards, and more
Also, prepare for paused wind projects and the Gulf of America from Trump 2.0 – and that's just day 1
Supply chain attack hits Chrome extensions, could expose millions
Threat actor exploited phishing and OAuth abuse to inject malicious code
Trump 'waved a white flag to Chinese hackers' as Homeland Security axed cyber advisory boards
And: America 'has never been less secure,' retired rear admiral tells Congress
China claims major fusion advance and record after 17-minute Tokamak run
1,066 seconds of steady-state high-confinement plasma operation and all that
HPE probes IntelBroker's bold data theft boasts
Incident response protocols engaged following claims of source code burglary
Infosec was literally the last item in Trump's policy plan, yet major changes are likely on his watch
Feature Everyone agrees defense matters. How to do it is up for debate
Silk Road's Dread Pirate Roberts walks free as Trump pardons dark web kingpin
Ross Ulbricht's family are now appealing for donations to support his reintegration into society
STORIES
Palo Alto Networks tackles firewall-busting zero-days with critical patches
Amazing that these two bugs got into a production appliance, say researchers
Patches19 Nov 2024 | 4
Fortinet patches VPN app flaw that could give rogue users, malware a privilege boost
Plus a bonus hard-coded local API key
Patches14 Nov 2024 |
Microsoft slips Task Manager and processor count fixes into Patch Tuesday
Sore about cores no more
Patches13 Nov 2024 | 7
Admins can give thanks this November for dollops of Microsoft patches
Patch Tuesday Don't be a turkey – get these fixed
Patches13 Nov 2024 | 21
HTTP your way into Citrix's Virtual Apps and Desktops with fresh exploit code
'Once again, we've lost a little more faith in the internet,' researcher says
CSO12 Nov 2024 | 3
Cisco scores a perfect CVSS 10 with critical flaw in its wireless system
Ultra-Reliable Wireless Backhaul doesn't live up to its name
Patches07 Nov 2024 | 16
Windows Themes zero-day bug exposes users to NTLM credential theft
Plus a free micropatch until Redmond fixes the flaw
Security30 Oct 2024 | 7
Emergency patch: Cisco fixes bug under exploit in brute-force attacks
Who doesn't love abusing buggy appliances, really?
Software24 Oct 2024 | 3
Microsoft SharePoint RCE flaw exploits in the wild – you've had 3 months to patch
Plus, a POC to make it extra easy for attackers
Security23 Oct 2024 |
VMware fixes critical RCE, make-me-root bugs in vCenter - for the second time
If the first patches don't work, try, try again
Patches22 Oct 2024 | 2
macOS HM Surf vuln might already be under exploit by major malware family
Like keeping your camera and microphone private? Patch up
Cybersecurity Month21 Oct 2024 | 16
Critical hardcoded SolarWinds credential now exploited in the wild
Another blow for IT software house and its customers
Security16 Oct 2024 | 23
Thousands of Fortinet instances vulnerable to actively exploited flaw
No excuses for not patching this nine-month-old issue
Cybersecurity Month14 Oct 2024 | 8
US and UK govts warn: Russia scanning for your unpatched vulnerabilities
in brief Also, phishing's easier over the phone, and your F5 cookies might be unencrypted, and more
Security12 Oct 2024 | 11
Mozilla patches critical Firefox vuln that attackers are already exploiting
Firefixed: It's maintenance time for low-complexity, high-impact security flaw
Cybersecurity Month10 Oct 2024 | 26
Microsoft cleans up hot mess of Patch Tuesday preview
Go forth and install your important security fixes
Cybersecurity Month09 Oct 2024 | 5
Microsoft issues 117 patches – some for flaws already under attack
Patch Tuesday Plus: SAP re-patches a failed patch for critical-rated flaw
Cybersecurity Month08 Oct 2024 | 6
Qualcomm urges device makers to push patches after 'targeted' exploitation
Given Amnesty's involvement, it's a safe bet spyware is in play
Patches08 Oct 2024 |
700K+ DrayTek routers are sitting ducks on the internet, open to remote hijacking
With 14 serious security flaws found, what a gift for spies and crooks
Cybersecurity Month02 Oct 2024 | 21
'Patch yesterday': Zimbra mail servers under siege through RCE vuln
Attacks began the day after public disclosure
Cybersecurity Month02 Oct 2024 | 5
Patch now: Critical Nvidia bug allows container escape, complete host takeover
33% of cloud environments using the toolkit impacted, we're told
Patches26 Sep 2024 | 18
HPE patches three critical security holes in Aruba PAPI
More 9.8 bugs? Ay, papi!
Patches26 Sep 2024 | 1
That doomsday critical Linux bug: It's CUPS. May lead to remote hijacking of devices
Final update No patches yet, can be mitigated, requires user interaction
Security26 Sep 2024 | 104
Ivanti patches exploited admin command execution flaw
Fears over chained attacks affecting EOL product
Patches20 Sep 2024 | 8
WhatsApp still working on making View Once chats actually disappear for all
Updated So far it's more like View Forever
Patches18 Sep 2024 | 16
VMware patches remote make-me-root holes in vCenter Server, Cloud Foundation
Bug reports made in China
Virtualization17 Sep 2024 | 1
Google Cloud Document AI flaw (still) allows data theft despite bounty payout
Updated Chocolate Factory downgrades risk, citing the need for attacker access
Security17 Sep 2024 |
Microsoft confirms IE bug squashed in Patch Tuesday was exploited zero-day
Analysis The C in these CVEs stands for Confusing
Security17 Sep 2024 | 8
Adobe fixed Acrobat bug, neglected to mention whole zero-day exploit thing
SaaS seller sets severity to 'critical'
Patches12 Sep 2024 | 4
About that Windows Installer 'make me admin' security hole. Here's how it's exploited
What kind of OS can be hijacked by clicking a link at just the right time? Microsoft's
Patches12 Sep 2024 | 23
Microsoft says it broke some Windows 10 patching – as it fixes flaws under attack
Patch Tuesday CISA wants you to leap on Citrix, Ivanti issues. Adobe, Intel, SAP vie for priority
Patches11 Sep 2024 | 24
To patch this server, we need to get someone drunk
On Call When maintenance windows are hard to open, a little lubrication helps
Patches06 Sep 2024 | 116
Cisco's Smart Licensing Utility flaws suggest it's pretty dumb on security
Two critical holes including hardcoded admin credential
Security05 Sep 2024 | 9
From Copilot to Copirate: How data thieves could hijack Microsoft's chatbot
Prompt injection, ASCII smuggling, and other swashbuckling attacks on the horizon
Patches28 Aug 2024 | 7
SolarWinds left critical hardcoded credentials in its Web Help Desk product
Why go to the effort of backdooring code when devs will basically do it for you accidentally anyway
CSO22 Aug 2024 | 18
You probably want to patch this critical GitHub Enterprise Server bug now
Unless you're cool with an unauthorized criminal enjoying admin privileges to comb through your code
Patches21 Aug 2024 |
Microsoft patches scary wormable hijack-my-box-via-IPv6 security bug and others
Patch Tuesday Plus more pain for Intel which fixed 43 bugs, SAP and Adobe also in on the action
Patches14 Aug 2024 | 24
AMD won’t patch Sinkclose security bug on older Zen CPUs
Updated Kernel mode not good enough for you? Maybe you'll like SMM of this
Patches13 Aug 2024 | 14
Using 1Password on Mac? Patch up if you don’t want your Vaults raided
Hundreds of thousands of users potentially vulnerable
Patches08 Aug 2024 | 23
Google splats device-hijacking exploited-in-the-wild Android kernel bug among others
And Qualcomm addresses 'permanent denial of service' flaw in its stuff
Patches06 Aug 2024 | 8
Ransomware gangs are loving this dumb but deadly make-me-admin ESXi vulnerability
Get those patches applied – all the big dogs are abusing it
VMware Explore30 Jul 2024 | 18
CrowdStrike meets Murphy's Law: Anything that can go wrong will
Opinion And boy, did last Friday's Windows fiasco ever prove that yet again
Patches26 Jul 2024 | 98
Progress discloses second critical flaw in Telerik Report Server in as many months
These are the kinds of bugs APTs thrive on, just ask the Feds
Patches26 Jul 2024 | 1
You should probably fix this 5-year-old critical Docker vuln fairly sharpish
For some unknown reason, initial patch was omitted from later versions
Patches25 Jul 2024 |
Patch management still seemingly abysmal because no one wants the job
Comment Are your security and ops teams fighting to pass the buck?
Malware Month25 Jul 2024 | 29
The months and days before and after CrowdStrike's fatal Friday
Analysis 'In the short term, they're going to have to do a lot of groveling'
CSO25 Jul 2024 | 46
Uncle Sam opens probe into CrowdStrike turbulence at Delta Air Lines
Concerns abound over why it has taken so long to recover compared to competitors
Security24 Jul 2024 | 10
Windows Patch Tuesday update might send a user to the BitLocker recovery screen
Not now, Microsoft
Patches24 Jul 2024 | 44
Maximum-severity Cisco vulnerability allows attackers to change admin passwords
You’re going to want to patch this one
Patches18 Jul 2024 | 17
Firms skip security reviews of major app updates about half the time
Updated Complicated, costly, time-consuming – pick three
Patches18 Jul 2024 | 18
ZDI shames Microsoft for – yet another – coordinated vulnerability disclosure snafu
Exclusive 'It seems like they really don't have a full grasp of what's going on with this patch'
Patches15 Jul 2024 | 11
You had a year to patch this Veeam flaw – and now it's going to hurt some more
LockBit variant targets backup software - which you may remember is supposed to help you recover from ransomware
Patches11 Jul 2024 | 4
Critical Windows licensing bugs – plus two others under attack – top Patch Tuesday
Patch Tuesday Citrix, SAP also deserve your attention – because miscreants are already thinking about Exploit Wednesday
Patches10 Jul 2024 | 19
Nasty regreSSHion bug in OpenSSH puts roughly 700K Linux boxes at risk
Full system takeovers on the cards, for those with enough patience to pull it off
Patches01 Jul 2024 | 59
Juniper Networks flings out emergency patches for perfect 10 router vuln
Get 'em while they're hot
Patches01 Jul 2024 | 6
Batten down the hatches, it's time to patch some more MOVEit bugs
Exploit attempts for ‘devastating’ vulnerabilities already underway
Patches26 Jun 2024 | 9
Ollama drama as 'easy-to-exploit' critical flaw found in open source AI server
About a thousand vulnerable instances still exposed online, we're told
Patches24 Jun 2024 | 9
VMware by Broadcom warns of two critical vCenter flaws, plus a nasty sudo bug
Specially crafted network packet could allow remote code execution and access to VM fleets
Patches18 Jun 2024 | 8
Ransomware crew may have exploited Windows make-me-admin bug as a zero-day
Symantec suggests Black Basta crew beat Microsoft to the patch
Malware Month12 Jun 2024 | 2
Let's kick off our summer with a pwn-me-by-Wi-Fi bug in Microsoft Windows
Patch Tuesday Redmond splats dozens of bugs as does Adobe while Arm drivers and PHP under active attack
CSO12 Jun 2024 | 7
7-year-old Oracle WebLogic bug under active exploitation
Experts say Big Red will probably re-release patch in an upcoming cycle
Malware Month06 Jun 2024 | 6
Emergency patches released for critical vulns impacting EOL Zyxel NAS boxes
That backdoor's not meant to be there?
Patches05 Jun 2024 | 3
Three-year-old Apache Flink flaw under active attack
We know IT admins have busy schedules but c'mon
Patches24 May 2024 | 11
Veeam says critical flaw can't be abused to trash backups
It's still a rough one, so patch up
Patches23 May 2024 | 1
GitHub Enterprise Server patches 10-outta-10 critical hole
On the bright side, someone made up to $30,000+ for finding it
Patches22 May 2024 | 3
Uncle Sam to inject $50M into auto-patcher for hospital IT
Boffins, why not simply invent an algorithm that autonomously fixes flaws, thereby ending ransomware forever
Public Sector22 May 2024 | 33
Microsoft fixes a bug abused in QakBot attacks plus a second under exploit
Plus: Google Chrome, Apple bugs also exploited in the wild
Patches14 May 2024 | 3
NHS Digital hints at exploit sightings of Arcserve UDP vulnerabilities
When PoC code is released within a day of disclosure, it's only a matter of time before attacks kick off
Patches14 May 2024 | 4
The truth about KEV: CISA’s vuln deadlines good influence on private-sector patching
More work to do as most deadlines are missed and worst bugs still take months to fix
Patches07 May 2024 |
Patch up – 4 critical bugs in ArubaOS lead to remote code execution
Ten vulnerabilities in total for admins to apply
Patches02 May 2024 | 4
Open source programming language R patches gnarly arbitrary code exec flaw
Updated An ACE in the hole for miscreants
Patches01 May 2024 | 1
Crooks exploit OpenMetadata holes to mine crypto – and leave a sob story for victims
'I want to buy a car. That's all'
Cyber-crime18 Apr 2024 | 6
Delinea Secret Server customers should apply latest patches
Updated Attackers could nab an org's most sensitive keys if left unaddressed
Patches15 Apr 2024 | 3
Zero-day exploited right now in Palo Alto Networks' GlobalProtect gateways
Out of the PAN-OS and into the firewall, a Python backdoor this way comes
Cyber-crime12 Apr 2024 | 13
It's 2024 and Intel silicon is still haunted by data-spilling Spectre
Go, go InSpectre Gadget
Research10 Apr 2024 | 23
Rust rustles up fix for 10/10 critical command injection bug on Windows in std lib
BatBadBut hits Erlang, Go, Python, Ruby as well
Patches10 Apr 2024 | 57
Microsoft squashes SmartScreen security bypass bug exploited in the wild
Patch Tuesday Plus: Adobe, SAP, Fortinet, VMware, Cisco issue pressing updates
Security10 Apr 2024 | 22
Easy-to-use make-me-root exploit lands for recent Linux kernels. Get patching
CVE-2024-1086 turns the page tables on system admins
Patches29 Mar 2024 | 26
JetBrains keeps mum on 26 'security problems' fixed after Rapid7 spat
Updated Vendor takes hardline approach to patch disclosure to new levels
Patches28 Mar 2024 | 14
Nvidia's newborn ChatRTX bot patched for security bugs
Flaws enable privilege escalation and remote code execution
Patches28 Mar 2024 | 1
Biting the hand that feeds IT
