Android apps with spyware installed 421 million times from Google Play


A new Android malware distributed as an advertisement SDK has been discovered in multiple apps, many previously on Google Play and collectively downloaded over 400 million times. [...]


https://www.bleepingcomputer.com/news/se...ogle-play/

Microsoft shares fix for cameras not working on Surface laptops


Microsoft has shared a temporary fix for a widespread issue triggered by a buggy driver that causes built-in cameras on some ARM-based Windows devices (including Surface Pro X laptops) to stop working. [...]


https://www.bleepingcomputer.com/news/mi...e-laptops/

RomCom malware spread via Google Ads for ChatGPT, GIMP, more


A new campaign distributing the RomCom backdoor malware is impersonating the websites of well-known or fictional software, tricking users into downloading and launching malicious installers. [...]


https://www.bleepingcomputer.com/news/se...gimp-more/

Microsoft finds macOS bug that lets hackers bypass SIP root restrictions


Apple has recently addressed a vulnerability that lets attackers with root privileges bypass System Integrity Protection (SIP) to install "undeletable" malware and access the victim's private data by circumventing Transparency, Consent, and Control (TCC) security checks. [...]


https://www.bleepingcomputer.com/news/se...trictions/

WordPress plugin ‘Gravity Forms’ vulnerable to PHP object injection


The premium WordPress plugin 'Gravity Forms,' currently used by over 930,000 websites, is vulnerable to unauthenticated PHP Object Injection. [...]


https://www.bleepingcomputer.com/news/se...injection/

Barracuda zero-day abused since 2022 to drop new malware, steal data


Network and email security firm Barracuda today revealed that a recently patched zero-day vulnerability had been exploited for at least seven months to backdoor customers' Email Security Gateway (ESG) appliances with custom malware and steal data. [...]


https://www.bleepingcomputer.com/news/se...teal-data/

WordPress force installs critical Jetpack patch on 5 million sites


Automattic, the company behind the open-source WordPress content management system, has started force installing a security patch on millions of websites today to address a critical vulnerability in the Jetpack WordPress plug-in. [...]


https://www.bleepingcomputer.com/news/se...ion-sites/

Dark Pink hackers continue to target govt and military organizations


The Dark Pink APT hacking group continues to be very active in 2023, observed targeting government, military, and education organizations in Indonesia, Brunei, and Vietnam. [...]


https://www.bleepingcomputer.com/news/se...nizations/

7 Stages of Application Testing: How to Automate for Continuous Security


There are seven main stages of a complex pen testing process that must be followed in order to effectively assess an application's security posture. Learn more from OutPost24 about these stages and how PTaaS can find flaws in web applications, [...]


https://www.bleepingcomputer.com/news/se...-security/

Toyota finds more misconfigured servers leaking customer info

Toyota Motor Corporation has discovered two additional misconfigured cloud services that leaked car owners' personal information for over seven years. [...]


https://www.bleepingcomputer.com/news/se...omer-info/