Sustained 'Red Deer' Phishing Attacks Impersonate Israel Post, Drop RATs

The "missed package" phishing messages, likely the work of a hacking-for-hire group, bounds into inboxes, bearing ASyncRAT.

https://www.darkreading.com/dr-global/su...-post-rats

How Do I Reduce Security Tool Sprawl in My Environment?

When it comes to tool consolidation, focus on platforms over products.

https://www.darkreading.com/edge-ask-the...nvironment

Jetpack WordPress Plug-in API Bug Triggers Mass Updates

An audit uncovers an API-related security vulnerability dating back to Jetpack version 2.0 released in 2012 — and it affects millions of websites.

https://www.darkreading.com/endpoint/jet...ss-updates

Amazon Pays $30.8M to Settle Ring Spying & Alexa Privacy Lawsuits

The global e-commerce company will pay millions of dollars in two separate lawsuits because of privacy and security violations, the FTC says.

https://www.darkreading.com/ics-ot/amazo...y-lawsuits

Tel Aviv Stock Exchange Selects CardinalOps to Reduce Risk of Breaches Due to Undete

Enables financial services firm to operationalize MITRE ATT&CK with Splunk and eliminate detection coverage gaps based on organizational risk and priorities.

https://www.darkreading.com/risk/tel-avi...ed-attacks

Cyversity and United Airlines to Provide Cybersecurity Training Scholarships to Cyve

Program designed to equip women and underrepresented individuals with the necessary skills and knowledge to succeed in cybersecurity.

https://www.darkreading.com/operations/c...ty-members

Exploit released for RCE flaw in popular ReportLab PDF library


A researcher has published a working exploit for a remote code execution (RCE) flaw impacting ReportLab, a popular Python library used by numerous projects to generate PDF files from HTML input. [...]


https://www.bleepingcomputer.com/news/se...f-library/

New MOVEit Transfer zero-day mass-exploited in data theft attacks


Hackers are actively exploiting a zero-day vulnerability in the MOVEit Transfer file transfer software to steal data from organizations. [...]


https://www.bleepingcomputer.com/news/se...t-attacks/

Google triples rewards for Chrome sandbox escape chain exploits


Google announced today that bug bounty hunters who report sandbox escape chain exploits targeting its Chrome web browser are now eligible for triple the standard reward until December 1st, 2023. [...]


https://www.bleepingcomputer.com/news/go...-exploits/

Russia says US hacked thousands of iPhones in iOS zero-click attacks


Russian cybersecurity firm Kaspersky says some iPhones on its network were hacked using an iOS vulnerability that installed malware via iMessage zero-click exploits. Russia blames these attacks on US intelligence agencies. [...]


https://www.bleepingcomputer.com/news/se...k-attacks/