Senate Leaders Plan to Prolong NSA Surveillance Using a Must-Pass Bill

Top senate officials are planning to save the Section 702 surveillance program by attaching it to a crucial piece of legislation. Critics worry a chance to pass privacy reforms will be missed...

Signal Will Leave the UK Rather Than Add a Backdoor

Totally expected, but still good to hear: Onstage at TechCrunch Disrupt 2023, Meredith Whittaker, the president of the Signal Foundation, which maintains the nonprofit Signal messaging app, reaffirmed that Signal would leave the U.K. if the countrys recently passed Online Safety Bill forced Signa...

CVE-2023-32496

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Bill Minozzi Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin = 7.31 versions...

CVE-2023-32496

CVE-2023-32496 corresponds to a stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection (StopBadBots) for versions

Apple Threatens to Pull iMessage and FaceTime from U.K. Amid Surveillance Demands

Apple has warned that it would rather stop offering iMessage and FaceTime services in the U.K. than bowing down to government pressure in response to new proposals that seek to expand digital surveillance powers available to state intelligence agencies. The development, first reported by BBC News...

Russia’s Notorious Troll Farm Disbands

Plus: A French bill would allow spying via phone cameras, ATM skimmers target welfare families, and Japan’s largest cargo port gets hit with ransomware...

GUAC 0.1 Beta: Google's Breakthrough Framework for Secure Software Supply Chains

Google on Wednesday announced the 0.1 Beta version of GUAC short for Graph for Understanding Artifact Composition for organizations to secure their software supply chains. To that end, the search giant is making available the open source framework as an API for developers to integrate their own...

CVE-2022-47134

Cross-Site Request Forgery CSRF vulnerability in Bill Erickson Gallery Metabox plugin = 1.5 versions...

CVE-2022-47134

Cross-Site Request Forgery CSRF vulnerability in Bill Erickson Gallery Metabox plugin = 1.5 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Bill Erickson Gallery Metabox plugin = 1.5 versions...

CVE-2022-47134 WordPress Gallery Metabox Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Bill Erickson Gallery Metabox plugin = 1.5 versions...

CVE-2022-47134

CVE-2022-47134 covers a Cross-Site Request Forgery in Gallery Metabox plugin for WordPress versions ≤ 1.5. The root cause stated is insufficient CSRF protection in the plugin’s request handling, enabling unauthenticated actors to induce actions on behalf of a logged-in user. Public sources in the...

A US Bill Would Ban Kids Under 13 From Joining Social Media

The legislation would insert the government into online platforms’ age-verification efforts—a move that makes some US lawmakers queasy...

UK Threatens End-to-End Encryption

In an open letter, seven secure messaging apps--including Signal and WhatsApp--point out that the UKs Online Safety Bill could destroy end-to-end encryption: As currently drafted, the Bill could break end-to-end encryption,opening the door to routine, general and indiscriminate surveillance of...

CISA Releases Two SBOM Documents

Today, CISA released two community-drafted documents around Software Bill of Materials SBOM: Types of SBOM documents and Minimum Requirements for Vulnerability Exploitability eXchange VEX. The Types of SBOM document summarizes common types of SBOMs that tools may create in the industry today, alo...

CISA and CESER Releases Software Bill of Materials (SBOM) Sharing Lifecycle Report

CISA and the U.S. Department of Energy DOE Cybersecurity, Energy Security, and Emergency Response CESER have released the SBOM Sharing Lifecycle Report to the cybersecurity and supply chain community. The purpose of this report is to enumerate and describe the different parties and phases of the...

Senator Warner on the Restrict Act and a US TikTok Ban

WIRED spoke with the coauthor of the Restrict Act, a bipartisan bill to crack down on tech from six “hostile” countries...

WhatsApp refuses to weaken encryption, would rather leave UK

WhatsApp will not comply with the UK's Online Safety Bill when it passes legislation as is. In fact, WhatsApp would rather cease serving UK users, which make up 2% of its global market, than weaken its end-to-end encryption E2EE. Will Cathcart, head of WhatsApp at parent company Meta, made these...

CVE-2023-24827 Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syft

syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...

CVE-2023-24827

Syft (CLI + Go library for SBOMs) had a password disclosure vulnerability in v0.69.0–v0.69.1 where SYFT_ATTEST_PASSWORD could leak credentials in logs (DEBUG+ levels) and in attestations/SBOM payloads when using syft-json. The issue affects users who set SYFT_ATTEST_PASSWORD; users without it are...