Frank Crast, Author at Securezoo

Deep Panda APT group launches new attacks against Log4Shell vulnerability to install Fire Chili rootkits

Cybersecurity Attacks, Malware, Vulnerabilities & Exploits / Frank Crast / April 2, 2022 / APT, CVE-2021-44228, Deep Panda, FortiLabs, Log4j, log4Shell

In the past month, researchers from FortiLabs have detected a new cyber campaign involving Chinese Advanced Persistent Threat (APT) group Deep Panda that has exploited the Log4Shell (log4j) vulnerability CVE-2021-44228 on vulnerable VMware Horizon servers to install digitally signed Fire Chili rootkits.

Deep Panda APT group launches new attacks against Log4Shell vulnerability to install Fire Chili rootkits Read More »

CISA adds 7 vulnerabilities to Known Exploited Vulnerabilities Catalog (to include Trend Micro, Sophos, Dell, QNAP)

Security Updates & Patches, Vulnerabilities & Exploits / Frank Crast / April 2, 2022 / CVE-2018-10561, CVE-2018-10562, CVE-2021-21551, CVE-2021-28799, CVE-2021-34484, CVE-2022-1040, CVE-2022-26871, Dasan, Dell, QNAP, Sophos, Trend Micro, Windows

The Cybersecurity and Infrastructure Security Agency (CISA) has added 7 vulnerabilities to its Known Exploited Vulnerabilities Catalog. Recent additions include vulnerabilities affecting Trend Micro, Sophos, Windows, QNAP, Dell, and Dasan products.

CISA adds 7 vulnerabilities to Known Exploited Vulnerabilities Catalog (to include Trend Micro, Sophos, Dell, QNAP) Read More »

Spring fixes Critical Spring Framework “Spring4Shell” and Spring Cloud Function vulnerabilities

Security Updates & Patches, Vulnerabilities & Exploits / Frank Crast / April 1, 2022 / CVE-2022-22963, CVE-2022-22965, Spring, Spring4Shell

Spring has published new security fixes for Spring Framework “Spring4Shell” and Spring Cloud Function vulnerabilities.

Spring fixes Critical Spring Framework “Spring4Shell” and Spring Cloud Function vulnerabilities Read More »

Apple fixes zero-day vulnerabilities in iOS 15.4.1 and macOS Monterey 12.3.1 (with active exploits in the wild)

Security Updates & Patches, Vulnerabilities & Exploits, Zero-days / Frank Crast / April 1, 2022 / CVE-2022-22675, CVE-2022-22676, iOS, iOS154, macOS, Monterey

Apple has released security updates for Apple iOS 15.4.1, iPadOS 15.4.1 and macOS Monterey 12.3.1 products. Apple is aware of known exploits in the wild for a zero-day vulnerabilities CVE-2022-22675 and CVE-2022-22674.

Apple fixes zero-day vulnerabilities in iOS 15.4.1 and macOS Monterey 12.3.1 (with active exploits in the wild) Read More »

Google releases Chrome 100 security update (100.0.4896.60) with fixes for 9 High risk vulnerabilities

Security Updates & Patches, Vulnerabilities & Exploits / Frank Crast / March 30, 2022 / Chrome, Chrome 100, CVE-2022-1125, CVE-2022-1127, CVE-2022-1128, CVE-2022-1129, CVE-2022-1130, CVE-2022-1131, CVE-2022-1132, CVE-2022-1133, CVE-2022-1134

Google has released Chrome 100.0.4896.60 for Windows, Mac and Linux with fixes for multiple High risk vulnerabilities. In addition, Google also issued security updates for Chrome for iOS, Chrome for Android and Chrome OS.

Google releases Chrome 100 security update (100.0.4896.60) with fixes for 9 High risk vulnerabilities Read More »

VMware patches Critical Carbon Black App Control vulnerabilities

Security Updates & Patches, Vulnerabilities & Exploits / Frank Crast / March 27, 2022 / Carbon Black, CVE-2022-22951, CVE-2022-22952, VMware

VMware has patched two Critical vulnerabilities (CVE-2022-22951, CVE-2022-22952) in VMware Carbon Black App Control (AppC).

VMware patches Critical Carbon Black App Control vulnerabilities Read More »

Google releases Chrome 99 security update with fix for zero-day vulnerability (CVE-2022-1096) exploited in the wild

Security Updates & Patches, Vulnerabilities & Exploits, Zero-days / Frank Crast / March 26, 2022 / Chrome 99, Chrome V8, CVE-2022-1096, JavaScript

Google has released Chrome 99.0.4844.84 for Windows, Mac and Linux with fixes for multiple vulnerabilities, to include one zero-day (CVE-2022-1096) exploited in the wild.

Google releases Chrome 99 security update with fix for zero-day vulnerability (CVE-2022-1096) exploited in the wild Read More »

CISA adds 66 vulnerabilities to Known Exploited Vulnerabilities Catalog (to include WatchGuard and Mitel)

Security Updates & Patches, Vulnerabilities & Exploits / Frank Crast / March 26, 2022 / CVE-2022-21999, CVE-2022-26143, CVE-2022-26318, Mitel, WatchGuard, Windows

The Cybersecurity and Infrastructure Security Agency (CISA) has added 66 vulnerabilities to its Known Exploited Vulnerabilities Catalog. Recent additions include WatchGuard, Mitel, Windows and many other product vulnerabilities.

CISA adds 66 vulnerabilities to Known Exploited Vulnerabilities Catalog (to include WatchGuard and Mitel) Read More »

Drupal patches Guzzle third-party library vulnerability (CVE-2022-24775)

Security Updates & Patches, Vulnerabilities & Exploits / Frank Crast / March 23, 2022 / CVE-2022-24775, Drupal, Guzzle

Drupal has patched a Guzzle third-party library vulnerability (CVE-2022-24775) that affects multiple versions of Drupal Core.

Drupal patches Guzzle third-party library vulnerability (CVE-2022-24775) Read More »

Okta investigating reports of data breach by Lapsus$ ransomware cybercriminal group (updated)

Authentication, Data Breach, Data Privacy, Identity & Access Management / Frank Crast / March 22, 2022 / authentication, Breach, Data Breach, Okta

Identity and authentication services firm Okta is investigating reports that the firm has been breached by the Lapsus$ ransomware cybercriminal group.

Okta investigating reports of data breach by Lapsus$ ransomware cybercriminal group (updated) Read More »