We are thrilled to announce that Elastic Cloud Serverless has achieved several significant compliance certifications. This milestone reinforces our commitment to security, privacy, and regulatory compliance. Elastic Cloud Serverless is now audited or certified under the following industry-leading frameworks: SOC 2 Type 2, ISO 27001, ISO 27017, ISO 27018, Payment Card Industry … [Read more...] about Elastic Cloud Serverless achieves major compliance certifications
Major
Major Vulnerabilities Patched in SonicWall, Palo Alto Expedition, and Aviatrix Controllers
Jan 09, 2025Ravie LakshmananVulnerability / Endpoint Security Palo Alto Networks has released software patches to address several security flaws in its Expedition migration tool, including a high-severity bug that an authenticated attacker could exploit to access sensitive data. "Multiple vulnerabilities in the Palo Alto Networks Expedition migration tool enable an attacker … [Read more...] about Major Vulnerabilities Patched in SonicWall, Palo Alto Expedition, and Aviatrix Controllers
Researchers Uncover Major Security Flaw in Illumina iSeq 100 DNA Sequencers
Jan 07, 2025Ravie LakshmananFirmware Security / Malware Cybersecurity researchers have uncovered firmware security vulnerabilities in the Illumina iSeq 100 DNA sequencing instrument that, if successfully exploited, could permit attackers to brick or plant persistent malware on susceptible devices. "The Illumina iSeq 100 used a very outdated implementation of BIOS firmware … [Read more...] about Researchers Uncover Major Security Flaw in Illumina iSeq 100 DNA Sequencers
New “DoubleClickjacking” Exploit Bypasses Clickjacking Protections on Major Websites
Jan 01, 2025Ravie LakshmananWeb Security / Vulnerability Threat hunters have disclosed a new "widespread timing-based vulnerability class" that leverages a double-click sequence to facilitate clickjacking attacks and account takeovers in almost all major websites. The technique has been codenamed DoubleClickjacking by security researcher Paulos Yibelo. "Instead of relying on … [Read more...] about New “DoubleClickjacking” Exploit Bypasses Clickjacking Protections on Major Websites
U.S. and Microsoft Seize 107 Russian Domains in Major Cyber Fraud Crackdown
Oct 04, 2024Ravie LakshmananPhishing Attack / Cybercrime Microsoft and the U.S. Department of Justice (DoJ) on Thursday announced the seizure of 107 internet domains used by state-sponsored threat actors with ties to Russia to facilitate computer fraud and abuse in the country. "The Russian government ran this scheme to steal Americans' sensitive information, using seemingly … [Read more...] about U.S. and Microsoft Seize 107 Russian Domains in Major Cyber Fraud Crackdown
Europol Shuts Down Major Phishing Scheme Targeting Mobile Phone Credentials
Law enforcement authorities have announced the takedown of an international criminal network that leveraged a phishing platform to unlock stolen or lost mobile phones. The phishing-as-a-service (PhaaS) platform, called iServer, is estimated to have claimed more than 483,000 victims globally, led by Chile (77,000), Colombia (70,000), Ecuador (42,000), Peru (41,500), Spain … [Read more...] about Europol Shuts Down Major Phishing Scheme Targeting Mobile Phone Credentials
Secret Backdoor Found in XZ Utils Library, Impacts Major Linux Distros
Mar 30, 2024NewsroomLinux / Supply Chain Attack Red Hat on Friday released an "urgent security alert" warning that two versions of a popular data compression library called XZ Utils (previously LZMA Utils) have been backdoored with malicious code designed to allow unauthorized remote access. The software supply chain compromise, tracked as CVE-2024-3094, has a CVSS score of … [Read more...] about Secret Backdoor Found in XZ Utils Library, Impacts Major Linux Distros
U.S. Charges 7 Chinese Nationals in Major 14-Year Cyber Espionage Operation
The U.S. Department of Justice (DoJ) on Monday unsealed indictments against seven Chinese nationals for their involvement in a hacking group that targeted U.S. and foreign critics, journalists, businesses, and political officials for about 14 years. The defendants include Ni Gaobin (倪高彬), Weng Ming (翁明), Cheng Feng (程锋), Peng Yaowen (彭耀文), Sun Xiaohui (孙小辉), Xiong Wang (熊旺), … [Read more...] about U.S. Charges 7 Chinese Nationals in Major 14-Year Cyber Espionage Operation
Microsoft Flags Growing Cybersecurity Concerns for Major Sporting Events
Aug 03, 2023THNCyber Threat / Network Security Microsoft is warning of the threat malicious cyber actors pose to stadium operations, warning that the cyber risk surface of live sporting events is "rapidly expanding." "Information on athletic performance, competitive advantage, and personal information is a lucrative target," the company said in a Cyber Signals report shared … [Read more...] about Microsoft Flags Growing Cybersecurity Concerns for Major Sporting Events
Microsoft Fixes New Azure AD Vulnerability Impacting Bing Search and Major Apps
Apr 01, 2023Ravie LakshmananAzure / Active Directory Microsoft has patched a misconfiguration issue impacting the Azure Active Directory (AAD) identity and access management service that exposed several "high-impact" applications to unauthorized access. "One of these apps is a content management system (CMS) that powers Bing.com and allowed us to not only modify search … [Read more...] about Microsoft Fixes New Azure AD Vulnerability Impacting Bing Search and Major Apps