The Cybersecurity and Infrastructure Security Agency has updated its Known Exploited Vulnerabilities catalog to include a use-after-free security issue impacting Linux kernel versions from 5.14 to 6.6, tracked as CVE-2024-1086, which could be leveraged to enable arbitrary code execution and privilege escalation, SecurityWeek reports.

Threat actors have been leveraging phony web browser updates to facilitate the distribution of remote access trojans and information-stealing malware, according to The Hacker News.

Organizations in the financial industry around the world were warned by cyber threat intelligence expert Anis Haboubi regarding the persistent risk of attacks exploiting the years-old Apache Log4j2 vulnerability, tracked as CVE-2021-44832, as evidenced by the recent breaches at U.S. business intelligence software company Sisense and cloud storage provider Snowflake, which have systems widely used in the sector, reports Security Affairs.

More than 100 malware servers leveraged to deploy the IcedID, Trickbot, Pikabot, Smokeloader, Bumblebee, and SystemBC payloads have been disrupted, while 2,000 domains have been sequestered as part of the international law enforcement effort Operation Endgame, which has been touted to be the biggest anti-botnet and dropper malware operation, CyberScoop reports.

As the industry relies more on open source software, it really needs to take a more proactive stance on patching vulnerabilities.

As a special treat for this week's vault episode, we set up a conversation with Derek Manky to discuss Fortinet's FortiGuard Labs Threat Report. This is a bi-annual report put out by FortiGuard Labs, and in my opinion, it just keeps getting better and better. The report is chock full of actionable information and insights. It answered all my questi...

Mounting backlogs of unanalyzed and unenriched software and hardware flaws submitted to the National Institute of Standards and Technology's National Vulnerability Database since funding cuts were conducted in early February have prompted the agency to seek a third-party vendor that would help in processing the security bugs and address the pileup by the end of the fiscal year on Sep. 30, reports The Record, a news site by cybersecurity firm Recorded Future.