Microsoft Issues Patches for 2 Windows Zero-Days and 126 Other Vulnerabilities

Microsoft Issues Patches for 2 Windows Zero-Days and 126 Other Vulnerabilities,

Microsoft’s Patch Tuesday updates for the month of April have addressed a total of 128 security vulnerabilities spanning across its software product portfolio, including Windows, Defender, Office, Exchange Server, Visual Studio, and Print Spooler, among others.
10 of the 128 bugs fixed are rated Critical, 115 are rated Important, and three are rated Moderate in severity, with one of the flaws

,

Microsoft’s Patch Tuesday updates for the month of April have addressed a total of 128 security vulnerabilities spanning across its software product portfolio, including Windows, Defender, Office, Exchange Server, Visual Studio, and Print Spooler, among others.
10 of the 128 bugs fixed are rated Critical, 115 are rated Important, and three are rated Moderate in severity, with one of the flaws

, ,
https://thehackernews.com/2022/04/microsoft-issues-patches-for-2-windows.html

Cross-Regional Disaster Recovery with Elasticsearch

Cross-Regional Disaster Recovery with Elasticsearch,

Unsurprisingly, here at Rewind, we’ve got a lot of data to protect (over 2 petabytes worth). One of the databases we use is called Elasticsearch (ES or Opensearch, as it is currently known in AWS). To put it simply, ES is a document database that facilitates lightning-fast search results. Speed is essential when customers are looking for a particular file or item that they need to restore using 

,

Unsurprisingly, here at Rewind, we’ve got a lot of data to protect (over 2 petabytes worth). One of the databases we use is called Elasticsearch (ES or Opensearch, as it is currently known in AWS). To put it simply, ES is a document database that facilitates lightning-fast search results. Speed is essential when customers are looking for a particular file or item that they need to restore using 

, ,
https://thehackernews.com/2022/04/cross-regional-disaster-recovery-with.html

Critical LFI Vulnerability Reported in Hashnode Blogging Platform

Critical LFI Vulnerability Reported in Hashnode Blogging Platform,

Researchers have disclosed a previously undocumented local file inclusion (LFI) vulnerability in Hashnode, a developer-oriented blogging platform, that could be abused to access sensitive data such as SSH keys, server’s IP address, and other network information.
« The LFI originates in a Bulk Markdown Import feature that can be manipulated to provide attackers with unimpeded ability to download

,

Researchers have disclosed a previously undocumented local file inclusion (LFI) vulnerability in Hashnode, a developer-oriented blogging platform, that could be abused to access sensitive data such as SSH keys, server’s IP address, and other network information.
« The LFI originates in a Bulk Markdown Import feature that can be manipulated to provide attackers with unimpeded ability to download

, ,
https://thehackernews.com/2022/04/critical-lfi-vulnerability-reported-in.html

EU Officials Reportedly Targeted with Israeli Pegasus Spyware

EU Officials Reportedly Targeted with Israeli Pegasus Spyware,

Senior officials in the European Union were allegedly targeted with NSO Group’s infamous Pegasus surveillance tool, according to a new report from Reuters.
At least five individuals, including European Justice Commissioner Didier Reynders, are said to have been singled out in total, the news agency said, citing documents and two unnamed E.U. officials. However, it’s not clear who used the

,

Senior officials in the European Union were allegedly targeted with NSO Group’s infamous Pegasus surveillance tool, according to a new report from Reuters.
At least five individuals, including European Justice Commissioner Didier Reynders, are said to have been singled out in total, the news agency said, citing documents and two unnamed E.U. officials. However, it’s not clear who used the

, ,
https://thehackernews.com/2022/04/eu-officials-reportedly-targeted-with.html

NGINX Shares Mitigations for Zero-Day Bug Affecting LDAP Implementation

NGINX Shares Mitigations for Zero-Day Bug Affecting LDAP Implementation,

The maintainers of the NGINX web server project have issued mitigations to address security weaknesses in its Lightweight Directory Access Protocol (LDAP) Reference Implementation.
« NGINX Open Source and NGINX Plus are not themselves affected, and no corrective action is necessary if you do not use the reference implementation, » Liam Crilly and Timo Stark of F5 Networks said in an advisory

,

The maintainers of the NGINX web server project have issued mitigations to address security weaknesses in its Lightweight Directory Access Protocol (LDAP) Reference Implementation.
« NGINX Open Source and NGINX Plus are not themselves affected, and no corrective action is necessary if you do not use the reference implementation, » Liam Crilly and Timo Stark of F5 Networks said in an advisory

, ,
https://thehackernews.com/2022/04/nginx-shares-mitigations-for-zero-day.html

Finding Attack Paths in Cloud Environments

Finding Attack Paths in Cloud Environments,

The mass adoption of cloud infrastructure is fully justified by innumerable advantages. As a result, today, organizations’ most sensitive business applications, workloads, and data are in the cloud.
Hackers, good and bad, have noticed that trend and effectively evolved their attack techniques to match this new tantalizing target landscape. With threat actors’ high reactivity and adaptability, it

,

The mass adoption of cloud infrastructure is fully justified by innumerable advantages. As a result, today, organizations’ most sensitive business applications, workloads, and data are in the cloud.
Hackers, good and bad, have noticed that trend and effectively evolved their attack techniques to match this new tantalizing target landscape. With threat actors’ high reactivity and adaptability, it

, ,
https://thehackernews.com/2022/04/finding-attack-paths-in-cloud.html

Google Sues Scammer for Running ‘Puppy Fraud Scheme’ Website

Google Sues Scammer for Running ‘Puppy Fraud Scheme’ Website

,

Google on Monday disclosed that it’s taking legal action against a nefarious actor who has been spotted operating fraudulent websites to defraud unsuspecting people into buying non-existent puppies.
« The actor used a network of fraudulent websites that claimed to sell basset hound puppies — with alluring photos and fake customer testimonials — in order to take advantage of people during the

,

Google on Monday disclosed that it’s taking legal action against a nefarious actor who has been spotted operating fraudulent websites to defraud unsuspecting people into buying non-existent puppies.
« The actor used a network of fraudulent websites that claimed to sell basset hound puppies — with alluring photos and fake customer testimonials — in order to take advantage of people during the

, ,
https://thehackernews.com/2022/04/google-sues-scammer-for-running-puppy.html

Over 16,500 Sites Hacked to Distribute Malware via Web Redirect Service

Over 16,500 Sites Hacked to Distribute Malware via Web Redirect Service,

A new traffic direction system (TDS) called Parrot has been spotted leveraging tens of thousands of compromised websites to launch further malicious campaigns.
« The TDS has infected various web servers hosting more than 16,500 websites, ranging from adult content sites, personal websites, university sites, and local government sites, » Avast researchers Pavel Novák and Jan Rubín said in a report

,

A new traffic direction system (TDS) called Parrot has been spotted leveraging tens of thousands of compromised websites to launch further malicious campaigns.
« The TDS has infected various web servers hosting more than 16,500 websites, ranging from adult content sites, personal websites, university sites, and local government sites, » Avast researchers Pavel Novák and Jan Rubín said in a report

, ,
https://thehackernews.com/2022/04/over-16500-sites-hacked-to-distribute.html

Le harcèlement par Apple AirTag prend de l’ampleur

Le harcèlement par Apple AirTag prend de l’ampleur,

Les plaintes se multiplient dans les postes de police américains. La balise est généralement cachée dans la voiture de la victime. Et l’auteur est souvent un ex-conjoint jaloux et revanchard.

,

Les plaintes se multiplient dans les postes de police américains. La balise est généralement cachée dans la voiture de la victime. Et l’auteur est souvent un ex-conjoint jaloux et revanchard.

, ,
https://www.01net.com/actualites/le-harcelement-par-apple-airtag-prend-de-l-ampleur-2055842.html

Researchers warn of FFDroider and Lightning info-stealers targeting users in the wild

Researchers warn of FFDroider and Lightning info-stealers targeting users in the wild,

Cybersecurity researchers are warning of two different information-stealing malware, named FFDroider and Lightning Stealer, that are capable of siphoning data and launching further attacks.
« Designed to send stolen credentials and cookies to a Command & Control server, FFDroider disguises itself on victim’s machines to look like the instant messaging application ‘Telegram,' » Zscaler ThreatLabz

,

Cybersecurity researchers are warning of two different information-stealing malware, named FFDroider and Lightning Stealer, that are capable of siphoning data and launching further attacks.
« Designed to send stolen credentials and cookies to a Command & Control server, FFDroider disguises itself on victim’s machines to look like the instant messaging application ‘Telegram,' » Zscaler ThreatLabz

, ,
https://thehackernews.com/2022/04/researchers-warn-of-ffdroider-and.html