Security Bulletin

SiliconAngle reports that threat actors could exploit Microsoft's Dynamic Host Configuration Protocol DNS Dynamic Updates functionality to facilitate the spoofing of Active Directory DNS records without additional user authentication.

Modern CPUs, including current AMD processors, as well as upcoming offerings from Arm, AMD, and Intel with support for the Top Byte Ignore, Upper Access Ignore, and Linear Address Masking hardware-based security features are at risk of a new side...

SecurityWeek reports that while all 23 U.S. federal agencies have worked to integrate the Cybersecurity and Infrastructure Security Agency's vulnerability and incident response playbook into their incident response plans, as well as commenced...

Defense industry organizations in South Korea had data concerning anti-aircraft weapon systems exfiltrated by North Korean state-sponsored threat operation Andariel, a sub-cluster of Lazarus Group, reports The Record, a news site by cybersecurity...

BleepingComputer reports that telecommunications firms in Thailand had their Linux systems stealthily compromised with the Krasue remote access trojan, which sought persistent host access, since 2021.

At least 30 organizations across 14 countries, most of which are part of NATO, and a NATO Rapid Deployable Corps have been targeted by Russian state-sponsored threat operation APT28, also known as Fancy Bear, Fighting Ursa, and Sofacy, in attacks...

Data breaches are rapidly accelerating, according to a number-crunching report from Apple this week — heightening the need to finally implement end-to-end data encryption.

Cyber insurance companies are moving down-market to offer policies to help protect remote employees, independent contractors, and small businesses from the cost of cyberattacks.

Cybersecurity could be heading for a Sarbanes Oxley-type of regulation in light of escalating attacks, but the devil is in the details.

Security researchers say the emergence of the macOS trojan-proxy shows that all operating systems are under attack as hackers don't discriminate.

State-sponsored actors continue to exploit CVE-2023-23397, a dangerous no-interaction vulnerability in Microsoft's Outlook email client that was patched in March, in a widespread global campaign.

Generative artificial intelligence tools intensify the phishing arms race this holiday season between hackers and inbox defenders.