Here’s what you need to know of the 4 zero-days in Microsoft’s Nov. update
Microsoft issued patches for of 62 vulnerabilities, nine of which are “Critical” severity and 53 “Important”. Four of the vulnerabilities in Microsoft November 2022 security update are zero-day flaws that are being actively exploited [300 words]. Here’s what you need to know about them: Windows MoTW Bypass Vulnerability (CVE-2022-41091) • Impacts multiple Windows versions including […]
Read MoreConnectWise patches critical flaw in its Recover and R1Soft Server Backup Manager technology
Vulnerability gives attackers a way to target thousands of MSPs and their downstream customers. Company urges customers to treat issue as a top priority [298 words]. What: ConnectWise has patched a critical, remote code execution vulnerability in its ConnectWise Recover and R1Soft Server Backup Manager (SBM) software. The flaw exists in ConnectWise Recover SBM v2.9.7 […]
Read MoreAttackers actively exploiting VMware flaw that CISA deemed as posing “unacceptable risk” in May
Multiple campaigns are using CVE-2022-22954 to drop ransomware, coin miners and Mirai [299 words]. What: Multiple malicious campaigns are actively targeting a previously disclosed and now patched remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager (CVE-2022-22954). Researchers from Fortinet’s FortiGuard Labs on Thursday said they had observed threat actors exploiting the […]
Read MoreHelpSystems releases Cobalt Strike 4.7.2 to address new RCE vulnerability
Out-of-band update addresses an issue for which IBM X-Force researchers had wanted a new CVE, but which HelpSystems says is not specific to its software [300 words] What: HelpSystems on October 17 released Cobalt Strike 4.7.2, an OOB update to fix an RCE vulnerability reported to it by IBM’s X-Force threat intelligence team. IBM’s researchers […]
Read MoreGLPI warns of massive exploit activity targeting one of two critical flaws disclosed in Sept.
Key takeaway: Update now to latest versions of the IT asset management software. If you can’t, implement GLPIs recommended mitigation. Attackers are targeting the flaw to execute arbitrary code on insecure servers [241 words]. What: Organizations using GLPI’s free, open-source asset and IT management software platform should immediately update to versions 9.5.9 or 10.0.3. GLPi […]
Read More