For providers

Just a day after Cisco disclosed CVE-2023-20198, it remains unpatched, and one vendor says a Shodan scan shows at least 10,000 Cisco devices with an implant for arbitrary code execution on them. The vendor meanwhile has updated the advisory with more mitigation steps.

The ClearFake campaign uses fake browser updates to lure victims and spread RedLine, Amadey, and Lumma stealers.

Security pros say developers share Confluence across their teams, so once exploited, attackers can have access to sensitive design and vulnerability information they can use to launch future attacks.

Ukrainian telcos subjected to Sandworm attacks BleepingComputer reports that Ukraine had 11 of its telecommunications service providers breached by the Russian state-backed hacking operation Sandworm from May to September, resulting in service disruptions and possible data compromise.

Updating your browser when prompted is a good practice, just make sure the notification comes from the vendor themselves.

Small- to medium-sized businesses can depend on MSPs to deliver the foundational security basics, but when it comes to in-the-weeds incident response, MSPs really need to partner with a managed security operations provider (MSOP).

Spam and phishing SMS messages (sometimes called "smishing") have been problematic in recent years. These messages often bypass security controls and are more challenging to identify as malicious by users. Moreover, they can be just simply annoying.

Avoid these errors to get the greatest value from your incident response training sessions.