Apple Hit By 2 No-Click Zero-Days in Blastpass Exploit Chain

Researchers at Citizen Lab recommend immediately updating any iPhones and iPads to the latest OSes.

https://www.darkreading.com/vulnerabilit...loit-chain

North Korean Hackers Target Security Researchers — Again

This time, they're creating elaborate impostor profiles and using a fresh zero-day and a fake Windows tool to lure in the suspecting.

https://www.darkreading.com/threat-intel...hers-again

Microsoft IDs Security Gaps that Let Threat Actors Steal Signing Key

China's Storm-0558 accessed user emails at some 25 enterprise organizations earlier this year using forged tokens.

https://www.darkreading.com/attacks-brea...igning-key

Thoma Bravo Makes 'Practical' Decision to Merge ForgeRock Into Ping Identity

The private equity from has invested billions of dollars in identity and access management (IAM), but now it's on Ping founder and CEO Andre Durand and his team to rationalize overlapping product lines.

https://www.darkreading.com/dr-tech/thom...g-identity

Software Supply Chain Strategies to Parry Dependency Confusion Attacks

Bad actors practice to deceive package managers with a tangled web of methods. Here's how to hoist them by their own petard.

https://www.darkreading.com/edge-article...on-attacks

3 Strategies to Defend Against Resurging Infostealers

Infostealer incidents have more than doubled recently, making it critical to bolster your defenses to mitigate this growing threat.

https://www.darkreading.com/vulnerabilit...fostealers

Trickbot, Conti Sanctions Affect Top Cybercrime Brass

US Treasury officials said the sanctions move is part of its effort to combat Russian state-sponsored cybercrime.

https://www.darkreading.com/threat-intel...rime-brass

Kenya Initiates Public Sector Digital Skills Training, No Mention of Cybersecurity

Training will cover cloud skills and working in a paperless environment, but any mention of a cybersecurity element is conspicuously lacking.

https://www.darkreading.com/dr-global/ke...n-of-cyber

Microsoft, Google Take on Obsolete TLS Protocols

Google shortened the lifetime of Transport Layer Security (TLS) certificates, and Microsoft plans to downgrade support for older versions, giving companies more data security but also removing visibility into their own traffic.

https://www.darkreading.com/dr-tech/micr...-protocols

'Evil Telegram' Spyware Campaign Infects 60K+ Mobile Users

Legitimate-seeming Telegram "mods" available in the official Google Play store for the encrypted messaging app signal the rise of a new enterprise threat.

https://www.darkreading.com/attacks-brea...bile-users