New Patch Released for Actively Exploited 0-Day Apache Path Traversal to RCE Attacks

Blog WriterThe Hacker News - Original news source is thehackernews.com

The Apache Software Foundation on Thursday released additional security updates for its HTTP Server product to remediate what it says is an “incomplete fix” for an actively exploited path traversal and remote code execution flaw that it patched earlier this week. CVE-2021-42013, …

Penetration Testing Your AWS Environment – A CTO’s Guide

Blog WriterThe Hacker News - Original news source is thehackernews.com

So, you’ve been thinking about getting a Penetration Test done on your Amazon Web Services (AWS) environment. Great! What should that involve exactly?  There are many options available, and knowing what you need will help you make your often limited …

Code Execution Bug Affects Yamale Python Package — Used by Over 200 Projects

Blog WriterThe Hacker News - Original news source is thehackernews.com

A high-severity code injection vulnerability has been disclosed in 23andMe’s Yamale, a schema and validator for YAML, that could be trivially exploited by adversaries to execute arbitrary Python code. The flaw, tracked as CVE-2021-38305 (CVSS score: 7.8), involves manipulating the schema file …

New U.S. Government Initiative Holds Contractors Accountable for Cybersecurity

Blog WriterThe Hacker News - Original news source is thehackernews.com

The U.S. government on Wednesday announced the formation of a new Civil Cyber-Fraud Initiative that aims to hold contractors accountable for failing to meet required cybersecurity requirements in order to safeguard public sector information and infrastructure. “For too long, companies …

Apple now requires all apps to make it easy for users to delete their accounts

Blog WriterThe Hacker News - Original news source is thehackernews.com

All third-party iOS, iPadOS, and macOS apps that allow users to create an account should also provide a method for terminating their accounts from within the apps beginning next year, Apple said on Wednesday. “This requirement applies to all app …

Twitch Suffers Massive 125GB Data and Source Code Leak Due to Server Misconfiguration

Blog WriterThe Hacker News - Original news source is thehackernews.com

Interactive livestreaming platform Twitch acknowledged a “breach” after an anonymous poster on the 4chan messaging board leaked its source code, an unreleased Steam competitor from Amazon Game Studios, details of creator payouts, proprietary software development kits, and other internal tools. The Amazon-owned …

Cyber Security WEBINAR — How to Ace Your InfoSec Board Deck

Blog WriterThe Hacker News - Original news source is thehackernews.com

Communication is a vital skill for any leader at an organization, regardless of seniority. For security leaders, this goes double. Communicating clearly works on multiple levels. On the one hand, security leaders and CISOs must be able to communicate strategies …

Iranian Hackers Abuse Dropbox in Cyberattacks Against Aerospace and Telecom Firms

Blog WriterThe Hacker News - Original news source is thehackernews.com

Details have emerged about a new cyber espionage campaign directed against the aerospace and telecommunications industries, primarily in the Middle East, with the goal of stealing sensitive information about critical assets, organizations’ infrastructure, and technology while remaining in the dark …

Google to turn on 2-factor authentication by default for 150 million users

Blog WriterThe Hacker News - Original news source is thehackernews.com

Google has announced plans to automatically enroll about 150 million users into its two-factor authentication scheme by the end of the year as part of its ongoing efforts to prevent unauthorized access to accounts and improve security. In addition, the …

Multiple Critical Flaws Discovered in Honeywell Experion PKS and ACE Controllers

Blog WriterThe Hacker News - Original news source is thehackernews.com

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday released an advisory regarding multiple security vulnerabilities affecting all versions of Honeywell Experion Process Knowledge System C200, C200E, C300, and ACE controllers that could be exploited to achieve remote code execution and …