We are talking about the CVE-2022-3236 issue (9.8 points on the CVSS vulnerability rating scale), which was found in the User Portal and the Sophos Firewall web admin. In fact, this bug allows attackers to achieve arbitrary code execution (RCE).

Hotfixes for all versions of Sophos Firewall affected by this bug (v19.0 MR1, 19.0.1 and older) were released back in September last year, and full patches were submitted in December. At the same time, back in the fall, the manufacturer warned that [...]

The company warned that hackers are successfully cracking Norton Password Manager accounts using credential stuffing attacks.

We also wrote about Student Found Bug in Cloudflare Email Routing Closed Beta, and also that Critical Bug in VMware Products Is Used to Install Miners and Ransomware.

Note also that the researchers report that only 26% of users agreed to change their password when they learned that it was compromised.

Let me remind you that the term credential stuffing usually refers to situations [...]

The creation of this tool for decrypting infected files is the result of the joint work of Bitdefender experts, Europol analysts, the NoMoreRansom project, the Zurich prosecutor’s office and the Swiss cantonal police.

Let me remind you that we also said that Avast introduced free decryptors for AtomSilo, Babuk and LockFile ransomware, and also that During five years of operation, the No More Ransom project helped to save $900 million from ransomware.

Although experts have published a guide on how to [...]

Or Yair of SafeBreach writes that attackers can exploit the security solutions already in the target system for their destructive attacks.

Let me remind you that we also said about Critical Bug in VMware Products, and also that PoC Exploit for Critical Vulnerability in Fortinet Products Appeared.

Or Yair

This will make attacks stealthier, and hackers won’t have [...]

As a reminder, Let’s Encrypt has been providing sites with the X.509 digital certificates required to enable HTTPS (SSL/TLS) and encrypted communication for free since September 2015, when the first certificate for the helloworld.letsencrypt.org domain was issued.

Since August 2018, Let’s Encrypt has been trusted by all major browsers and operating systems, as well as by all major root certificate authorities (including those from Microsoft, Google, Apple, [...]

The issue was identified in the XStream open-source library used by Cloud Foundation and scored 9.8 out of 10 on the CVSS vulnerability rating scale.

By the way, we also said that Some Versions of VMware Carbon Black Cause BSODs on Windows.

The vulnerability, which received the identifier CVE-2021-39144, was discovered by experts from Source Incite and can lead to remote execution of arbitrary code without requiring authentication and any user interaction. The developers also warn that the operation of the bug difficult is not difficult at [...]

We also wrote that Some Versions of VMware Carbon Black Cause BSODs on Windows.

Let me remind you that the CVE-2022-22954 vulnerability is associated with remote arbitrary code execution and affects VMware Workspace ONE Access. The bug scored 9.8 out of 10 on the CVSS vulnerability rating scale, and VMware discovered and fixed the issue on April 6 this year. However, the attackers reversed this fix and within 48 hours created an exploit, which was then used to compromise yet unpatched servers.

In [...]

Let me remind you that we also wrote that Hackers leaked credentials of 500,000 Fortinet VPN accounts to the public.

Fortinet developers reported a critical vulnerability in their products earlier this week, and released patches for a dangerous problem that was already under attack at that time.

Let me remind you that we also reported that Microsoft Defender Mistakenly Saw a Threat in Chrome and Electron Apps, and also that Experts Found Long-Standing Bugs in Avast and AVG Antiviruses.

Last Wednesday, social networks received an avalanche of complaints from users of Malwarebytes antivirus who could not log into Google sites, YouTube, or use services such as G Suite, Gmail or the Google Play Store. At the same time, [...]

Let me remind you that we also wrote that Apple Introduces Lockdown Mode to Protect against Spying.

The device is based on the Raspberry Pi 4 Model B, but in the future, they want to make it look like a regular USB flash drive.

The gadget and the process of its creation are described in detail in a document published on ArXiv. The authors of the development note that remote “spy” attacks are becoming more and more [...]