PharMerica breach impacts almost 6 million people

US pharmacy giant PharMerica has notified over 5.8 million people about a security incident in which it says personal information and medical information may have been obtained by cybercriminals. The Data Breach Notification lists the total number of persons affected as 5,815,591. An investigatio...

The vulnerability of the nf_tables_commit() function in the kernel’s net/netfilter/nf_tables_api.c file in the Linux operating system allows a attacker to compromise data confidentiality, integrity, and accessibility, or to enhance their privileges within the system and execute arbitrary code.

The vulnerability of the nftablescommit function in the net/netfilter/nftablesapi.c module of the Linux operating system is related to improper deletion of lists. Exploiting this vulnerability can allow an attacker to compromise data confidentiality, integrity, and accessibility, or enhance their...

Debt Collection Firm Credit Control Corporation Hit by Major Data Breach

By Habiba Rashid Credit Control Corporation CCC is a Newport News, Virginia based debt collection firm. This is a post from HackRead.com Read the original post: Debt Collection Firm Credit Control Corporation Hit by Major Data Breach...

U.S. Dept Of Defense: Docker Registry without authentication leads to docker images download

An exposed Docker Registry HTTP API allowed attackers to download Docker images and potentially access confidential source code without authentication. The vulnerability was caused by a lack of access control on the registry and could have been mitigated by implementing proper access controls or...

Aruba Networks EdgeConnect 安全漏洞

Aruba Networks EdgeConnect is an edge connectivity management platform from Aruba Networks, USA. A security vulnerability exists in Aruba Networks EdgeConnect Enterprise. An attacker exploited the vulnerability to cause a data breach...

Why we should be more open about ransomware attacks

The UKs National Cyber Security Centre NCSC has published an article that reflects on why its so concerning when cyberattacks go unreported, saying: ...we are increasingly concerned about what happens behind the scenes of the attacks we dont hear about, particularly the ransomware ones. One of th...

A week in security (May 8-14)

Last week on Malwarebytes Labs: The rise of "Franken-ransomware," with Allan Liska: Lock and Code S04E11 Ransomware review: May 2023 Brightline breach hits at least 964,000 people, US records show Ransomware attack on MSI led to compromised Intel Boot Guard private keys Fake system update drops...

Why High Tech Companies Struggle with SaaS Security

It's easy to think high-tech companies have a security advantage over other older, more mature industries. Most are unburdened by 40 years of legacy systems and software. They draw some of the world's youngest, brightest digital natives to their ranks, all of whom consider cybersecurity issues...

Vulnerability fixed in Netapp SnapCenter

Netapp has fixed a vulnerability in SnapCenter. A unauthenticated malicious party could exploit the vulnerability to gain access to the backup environment with administrator privileges. This allows the malicious party to gain access to sensitive information, manipulate data or cause a...

MAL-2023-504 Malicious code in hopelessly-devoted-bayou-devils-mc-1-by-am-myers-on-iphone-full-chapters- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21029738b9431b9b77dbba20f828a2cd520190f7b589a87f3d8a9deff5bf0c9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Spryker Commerce OS 1.0 SQL Injection Vulnerability

An SQL injection vulnerability affecting Spryker-based webshops was discovered in the order history search form. It can be exploited by authenticated attackers in order to retrieve information from the database e.g. customer and administrator login information, order details, etc.. Depending on t...

Brightline breach hits at least 964,000 people, US records show

A pediatric behavioral health startup called Brightline informed its customers that their protected health data may have been stolen as part of a separate ransomware attack on a Brightline third-party service provider. "Based on the investigation, we identified a limited amount of protected healt...

MSI Data Breach: Private Code Signing Keys Leaked on the Dark Web

The threat actors behind the ransomware attack on Taiwanese PC maker MSI last month have leaked the company's private code signing keys on their dark website. "Confirmed, Intel OEM private key leaked, causing an impact on the entire ecosystem," Alex Matrosov, founder and CEO of firmware security...

Western Digital Confirms Customer Data Stolen by Hackers in March Breach

Digital storage giant Western Digital confirmed that an "unauthorized third party" gained access to its systems and stole personal information belonging to the company's online store customers. "This information included customer names, billing and shipping addresses, email addresses and telephon...

Western Digital Confirms Customer Data Stolen by Hackers in March Breach

Digital storage giant Western Digital confirmed that an "unauthorized third party" gained access to its systems and stole personal information belonging to the company's online store customers. "This information included customer names, billing and shipping addresses, email addresses and telephon...

SQL Injection Vulnerability in RPCMS

RPCMS is an open source PHP content management system based on PHP language and MYSQL database. RPCMS has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

Why the Things You Don't Know about the Dark Web May Be Your Biggest Cybersecurity Threat

IT and cybersecurity teams are so inundated with security notifications and alerts within their own systems, it's difficult to monitor external malicious environments – which only makes them that much more threatening. In March, a high-profile data breach hit national headlines when personally...

Google Authenticator WILL get end-to-end encryption. Eventually.

Following criticism, Google has decided to bring end-to-end encryption E2EE to its Google Authenticator cloud backups. The search giant recently introduced a feature that allows users back up two-factor authentication 2FA tokens to the cloud, but the lack of encryption caused some commentators to...

With Imperva’s DRA and ServiceNow, you can avoid burning out your cyber security employees

In todays world, CIOs and CISOs are facing a tough reality when it comes to the security staff shortage situation. With the deflating economy, nationalism, cybercrime, and nation-led adversaries, the demand for security personnel has increased, making it challenging for organizations to find and...

The Bug Report – April 2023 Edition

The Bug Report – April 2023 Edition By Trellix · May 03, 2023 This story was also written by John Rodriguez. It’s never easy coming back. Why am I here? Seems as if some of us should have stayed at our tropical vacation getaway. Nothing like coming back to the cyber world screeching about...