Podcasts – Security

Episode 125: Critical SQL Injection Vulnerability Patched in WooCommerce

July 16, 2021 by Ram Gall

Ram Gall

A critical SQL injection vulnerability was discovered in WooCommerce, the most popular e-Commerce plugin used by over 5 million WordPress sites. The WordPress.org team pushed a forced security update ensuring that over 90 versions of WooCommerce were patched. The REvil ransomware gang targeted a zero-day vulnerability in Kaseya, used by…

Popular Podcast App Pocket Casts Joins Automattic

July 16, 2021 by Eli Budelli

Eli Budelli

We’re excited to announce that Pocket Casts will be joining Automattic, the parent company of WordPress.com. More than 80M people in the US listen to a podcast weekly, and this critically acclaimed podcast app makes it easier for fans to discover podcasts and customize their listening experience. Pocket Casts has…

Episode 124: PrintNightmare 0Day Exploit Accidentally Leaked Online

July 2, 2021 by Kathy Zant

Kathy Zant

Security researchers accidentally leaked zero-day exploit code for a new Windows bug, now called PrintNightmare, while easily exploitable vulnerabilities in the ProfilePress plugin, previously called WP User Avatar, were patched quickly. An unprotected cloud database containing over 814 million DreamHost user records was found online. Google Chrome is getting a…

Episode 123: Over 30 Million Dell Devices at Risk for Remote BIOS Attacks

June 24, 2021 by Ram Gall

Ram Gall

Over 30 million Dell devices are at risk for remote BIOS attacks due to four separate security bugs, which can have far reaching effects for enterprise organizations heavily invested in Dell devices. VMware Carbon Black App Control has been updated this week to fix a critical-severity vulnerability that allows authentication…

Episode 122: Largest Password Dump in History Fuels Credential Stuffing Extravaganza

June 18, 2021 by Ram Gall

Ram Gall

Sites running Jetpack are being infected via compromised WordPress.com credentials. The largest password dump ever with 8.4 billion passwords is used in credential stuffing attacks. Wordfence Threat Intelligence discloses new plugin vulnerabilities as well as a vulnerability at tsoHost. Data Breaches impact VW and EA, REvil compromises a nuclear weapons…

Episode 120: Jetpack Autoupdate Security Patch Bypasses Local Settings

June 4, 2021 by Kathy Zant

Kathy Zant

A security fix for an information leak vulnerability was pushed out to WordPress sites using Jetpack that bypassed local settings preventing autoupdates. A ransomware attack on JBS that shut down meat processing operations in the United States has been attributed to REvil, a private Russian ransomware-as-a-service operation. A critical zero-day…

Podcast: The State of Ransomware

June 2, 2021 by Threatpost

Threatpost

In this Threatpost podcast, Fortinet’s top researcher sketches out the ransom landscape, with takeaways from the DarkSide attack on Colonial Pipeline.

Effective Adoption of SASE in 2021

June 2, 2021 by Threatpost

Threatpost

In this Threatpost podcast, Forcepoint’s SASE and Zero Trust director describes how the pandemic jump-started SASE adoption.

Where Bug Bounty Programs Fall Flat

June 1, 2021 by Lisa Vaas

Lisa Vaas

Some criminals package exploits into bundles to sell on cybercriminal forums years after they were zero days, while others say bounties aren't enough .

Episode 119: Critical VMWare Vulnerability Threatens Data Centers

May 28, 2021 by Ram Gall

Ram Gall

A Critical Vulnerability in VMWare’s vCenter Server threatens some of the largest data centers in the world. An actively exploited 0-day in macOS was used to take screen shots of infected computers. CodeCov claims another victim as Japanese e-Commerce unicorn Mercari reports a massive data breach. Domino’s India and Air…

Episode 118: Four Android Vulnerabilities Under Active Attack

May 21, 2021 by Ram Gall

Ram Gall

Four memory corruption vulnerabilities are being actively exploited on Android devices and nearly 2 dozen popular Android apps exposed over 100 Million users’ sensitive information in cloud databases. Over 600,000 sites using WP Statistics required a patch to fix a blind SQL injection vulnerability. WP User Avatar undergoes a dramatic…

Podcast 117: Cyber Attack on Colonial Pipeline Affects Fuel Availability in 17 States

May 14, 2021 by Kathy Zant

Kathy Zant

A ransomware attack on Colonial Pipeline affected fuel availability in 17 southeastern US states, and Bloomberg reported that Colonial Pipeline paid $5 million to DarkSide, a Russian ransomware service provider. The Biden Administration issued an executive order to increase US cybersecurity defenses. WordPress 5.7.2 was released to patch a critical…

Episode 116: Packagist Patch Shows How Supply Chain Threats Could Impact WordPress

May 6, 2021 by Ram Gall

Ram Gall

A vulnerability discovered in Packagist, which is used by Composer to manage PHP package requests, could have allowed attackers to trick Composer into downloading backdoored source code, potentially affecting all WordPress sites. Packagist reports that it’s not aware of any exploits. A SQL injection vulnerability was patched in the CleanTalk…

Episode 115: Update Your Mac: Gatekeeper Bypass Vulnerability Exploited in the Wild

April 30, 2021 by Ram Gall

Ram Gall

Apple patches a gatekeeper bypass vulnerability that has been exploited in the wild on MacOS. Though this vulnerability requires some social engineering to exploit, it is believed to have been actively exploited since January 9, 2021. Some Digital Ocean customers were affected by a data breach exposing personally identifiable information.…

Episode 114: Trifecta of Compromises Affect Enterprise Systems

April 23, 2021 by Kathy Zant

Kathy Zant

Attacks on unpatched SolarWinds systems continue. We’re now learning of a supply chain attack that started in late January 2021 affecting 29,000 customers of Codecov, as well as a zero-day under active attack affecting customers of PulseSecure VPN. Customers of these three services are well known enterprise and government organizations.…

1 2 3 … 11 Next »