fileless malware

Adobe Patches Actively Exploited ColdFusion Zero-Day Flaw

Adobe Systems released an emergency update for the ColdFusion application server to fix a critical remote code execution that’s already being exploited by attackers. The vulnerability, tracked as CVE-2019-7816, is located in the upload functionality and is described as an upload restriction bypass. Attackers can exploit the flaw to upload ... Read More
Security Boulevard
phishing attack

Attackers Host Phishing Pages on Azure

Researchers have recently seen phishing attacks against Office 365 users wherein fake log-in pages were hosted on Microsoft Azure to give them more credibility. According to researchers from security firm EdgeWave, the rogue emails claim to be from Microsoft’s Outlook or Facebook’s Workplace services and inform recipients that they have ... Read More
Security Boulevard
threat report

New Service Scans Chrome Extensions for Vulnerabilities and Privacy Risks

Over the past few years, hackers have increasingly abused Google Chrome extensions to steal people’s data, inject rogue ads into websites or hijack CPU power to mine cryptocurrency. Now, a new online scanning service aims to shed more light on the risks associated with browser extensions. Called CRXcavator, from the ... Read More
Security Boulevard
backdoor

Drupal Patches Highly Critical Remote Code Execution Vulnerability

Websites based on the Drupal content management system might be affected by a highly critical vulnerability that could result in remote code execution. The vulnerability affects websites running Drupal 8 with RESTful Web Services (rest) module enabled if they allow PATCH or POST requests. Websites running Drupal with other services ... Read More
Security Boulevard
Safeguard Against APT Attacks

North Korean Lazarus Group Starts Targeting Russian Organizations

In an unusual move, the Lazarus hacking group associated with the North Korean government has recently started targeting organizations from Russia. The group’s primary targets until now have been organizations from countries with which North Korea has geopolitical tensions, such as South Korea, Japan and the United States. Researchers from ... Read More
Security Boulevard
frraud

WordPress Sites Hacked Through Vulnerable Payment Forms Plug-in

Hackers are exploiting vulnerabilities in a WordPress plug-in that was patched months ago without being publicly announced. A different vulnerability has been found in the same plug-in during a recent forensic investigation and has now been patched. In late January, security researchers from security firm Defiant investigated a compromised website ... Read More
Security Boulevard
Zero-day Threats Detection

New Shlayer Malware Variant Targeting Macs

Security researchers have found a new variant of a trojan program dubbed Shlayer that infects Mac computers and disables the macOS Gatekeeper security agent. Shlayer was discovered a year ago by researchers from Intego and was typically distributed through BitTorrent sites under the guise of a Flash Player update warning ... Read More
Security Boulevard
Microsoft Fixes 50 Flaws

Container Escape Vulnerability Puts Cloud Infrastructure at Risk

A serious vulnerability in runC, a tool used to spawn and run Linux containers, allows attackers to break out of containerized environments and gain full access to the underlying servers. RunC is a container runtime that makes use of Linux’s built-in capabilities to create sandboxes in which applications can run ... Read More
Security Boulevard
Apple Fixes Two Zero-Day iOS Vulnerabilities Exploited in the Wild

Apple Fixes Two Zero-Day iOS Vulnerabilities Exploited in the Wild

Apple’s newly released iOS 12.1.4 includes fixes for two serious vulnerabilities that are already used by hackers. The update also fixes the FaceTime bug that allowed users to remote enable other peoples’ microphones. The two vulnerabilities, tracked as CVE-2019-7286 and CVE-2019-7287, from the iOS advisory were exploited in the wild ... Read More
Security Boulevard
insider threat

Serious Vulnerability Found in Lifesize Business Videoconferencing Devices

A security researcher from security firm Trustwave has found a vulnerability that could allow hackers to take over videoconferencing devices made by Lifesize. Some of the affected products have reached end-of-sale or end-of-support, but are still widely used by organizations around the world in meeting rooms. The vulnerability is located ... Read More
Security Boulevard