CYBER45

Sivilya brings deep cybersecurity and technology leadership to Checkmarx as AI transforms software development.

Newly open sourced XSE handles six million queries a second across services including Search, Ads, and YouTube Shorts

Google Cloud VMs on AMD Turin chips need a guest OS patch and a stop-and-start to protect against three CPU side-channel flaws, Google said this week.

The company has already applied mitigations against attacks between VMs, and between VMs and the host. Inside a VM, the flaws may let an attacker with code on the same processor core infer data from other processes or the kernel.

The affected

A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines. A second HTTP/2 flaw can cause a server to send a client pieces of its memory, including responses intended for other connections.

Fixed versions were released for all three supported lines: 22.23.5, 24.22.3, and 26.13.1.

The crash

Lockbit is by far this summer’s most prolific ransomware group, trailed by two offshoots of the Conti group.

ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices. [...]

Over 130 companies tangled in sprawling phishing campaign that spoofed a multi-factor authentication system.

Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain access to Linux servers even after patching the vulnerabilities exploited to gain initial access. [...]

Researchers dubbed an attack chain "Greeter" after discovering that attackers deliberately covered their trail by leaving "hello" messages in logs.

Attackers are using Alibaba Cloud to host self-managed instances of AntiFox, an open-source agentic penetration testing platform, to target web services and AWS environments. [...]