2024-03-14 Post a Comment

Fortinet warns of critical RCE bug in endpoint management software

By Sergiu Gatlan: Fortinet patched a critical vulnerability in its FortiClient Enterprise Management Server (EMS) software that can allow attackers to gain remote code execution (RCE) on vulnerable servers. FortiClient EMS enables admins to manage endpoints connected to an enterprise network, allowing them to deploy FortiClient software and assign security profiles on Windows devices. The security flaw (CVE-2023-48788) is an SQL injection in the DB2 Administration Server (DAS) component, which […]

alt=Fortinet's security platform safeguards business data.

Cyber security

2024-03-13 Post a Comment

Vulnerability in 150K+ Fortinet Devices Let Hackers Execute Arbitary Code Remotely

By Guru Baran A critical security flaw identified as CVE-2024-21762 has been discovered in Fortinetâ€™s FortiOS and FortiProxy secure web gateway systems, potentially impacting around 150,000 devices worldwide. The vulnerability allows for unauthenticated remote code execution (RCE) by sending specially crafted HTTP requests to the affected machines. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers actively exploit the flaw, adding it to its Known Exploited Vulnerabilities […]

Cyber security

2024-03-10 Post a Comment

Top US cybersecurity agency hacked and forced to take some systems offline

ByÂ Sean Lyngaas, CNN Â 2 minute read Published 7:37 PM EST, Fri March 8, 2024 A federal agency in charge of cybersecurity discovered it was hacked last month and was forced to take two key computer systems offline, an agency spokesperson and US officials familiar with the incident told CNN. One of the US Cybersecurity and Infrastructure Security Agencyâ€™s affected systems runs a program that allows federal, state and local officials […]

Cyber security

2024-03-10 Post a Comment

NSA shares zero-trust guidance to limit adversaries on the network

By Ionut Ilascu The National Security Agency is sharing new guidance to help organizations limit an adversary’s movement on the internal network by adopting zero-trust framework principles. A zero-trust security architecture requires strict controls for accessing resources on the network, be they inside or outside the physical perimeter, to minimize the impact of a breach. Top StoriesREAD MOREThe Week in Ransomware – March 8th 2024 -Waiting for the BlackCat rebrand […]

Cyber security

2024-02-10 Post a Comment

Government hackers targeted iPhone owners with zero-days, Google says

Lorenzo Franceschi-Bicchierai@lorenzofb Government hackers last year exploited three unknown vulnerabilities in Appleâ€™s iPhone operating system to target victims with spyware developed by a European startup, according to Google. On Tuesday, Googleâ€™s Threat Analysis Group, the companyâ€™s team that investigates nation-backed hacking,Â published a reportÂ analyzing several government campaigns conducted with hacking tools developed by several spyware and exploit sellers, including Barcelona-based startup Variston. In one of the campaigns, according to Google, government […]