A critical zero-day vulnerability (CVE-2023-XXXX) has been discovered in VLC Media Player, potentially allowing remote code execution. No patch is currently available for this flaw, which affects versions 3.0.x and earlier of the widely used media player. Proof-of-concept code has reportedly begun circulating, increasing the risk of exploitation.
Apache ActiveMQ is impacted by a critical remote code execution vulnerability (CVE-2023-46604) that is being actively exploited in the wild. Threat actors are leveraging this flaw to deploy HelloKitty and HakunaMatata ransomware. The vulnerability affects ActiveMQ versions 5.18.0 to 5.18.3, 5.17.0 to 5.17.4, and 5.16.0 to 5.16.6, with patches now available.
Cisco has issued an urgent patch for a critical zero-day vulnerability (CVE-2023-20198) in its IOS XE software, which is under active exploitation. The flaw allows unauthenticated remote attackers to create privileged accounts and gain full control over affected devices exposed to the internet. Evidence suggests exploitation began as early as September 28, 2023.
Security researchers have identified a new, sophisticated Linux malware dubbed 'Shikra,' which is primarily targeting financial institutions. This malware is designed for stealthy data exfiltration and persistence, utilizing custom evasion techniques to remain undetected within compromised networks.
A major retail corporation has confirmed a significant data breach resulting in the exposure of personal information belonging to millions of its customers. Compromised data includes names, addresses, email addresses, and partial credit card details. The cause of the breach is under investigation, with a third-party vendor compromise suspected as a potential vector.
The Akira ransomware group has significantly expanded its attack capabilities by exploiting vulnerabilities in VMware ESXi servers. This new tactic allows them to encrypt virtual machines, marking a critical evolution in their attack surface and increasing the potential impact on targeted organizations, building on their previous focus on Cisco VPNs.
A critical remote code execution vulnerability (CVE-2023-XXXX) has been discovered in Atlassian Confluence Server and Data Center products. This flaw enables unauthenticated attackers to execute arbitrary code on affected instances. Patches have been released, and organizations are urged to update immediately to mitigate risks.
The FBI and CISA have released a joint advisory detailing the evolving tactics, techniques, and procedures (TTPs) of the BlackCat/ALPHV ransomware group. The advisory highlights their use of double extortion schemes and their persistent targeting of specific industries, confirming their continued and adapted operational presence following previous disruptions.