News

Microsoft Fixes 1,094 Flaws in November, One Outlook Zero Day Under Attack

Microsoft's November Patch Tuesday on November 10 listed 1,094 security fixes, led by Windows with 726 and Office with 174. Only one flaw was exploited before the patch: an Outlook spoofing bug where a crafted message file makes Outlook connect to an attacker controlled location without the usual warning. CISA added it to its Known Exploited Vulnerabilities list. Researchers also pointed to a zero click Windows Search flaw reachable through Exchange Server and a critical Windows LDAP flaw as fixes to prioritize, especially on domain controllers.

For more, visit CyberScoop.

Critical NetScaler Flaws Prompt Urgent Update Advice From CERT-EU

CERT-EU urges NetScaler updates after critical memory flaws, including one affecting default deployments. No exploitation was reported in its November 12 advisory.

Attacker Uses 4,837 Hijacked GitHub Accounts to Run a Secret Stealer

Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a CI secret stealer in repositories those accounts could write to, according to Aikido Security. The stealer ran in at least 1,806 repositories, putting build secrets and cloud keys at risk. Teams should rotate any

SCKit Malware Hits 288 Endpoints Across 48 Organizations Through ScreenConnect

Attackers abused ConnectWise ScreenConnect access to push rogue clients and the SCKit malware onto at least 288 endpoints at 48 organizations. Reporting says the campaign relies on a critical flaw that is already patched, not a new one. As a precaution, ConnectWise disabled five third party extensions in partner environments

New SignDrop Exploit Turns a Windows Logging Feature Into SYSTEM Access

Public exploit code released this week claims a local Windows user can gain SYSTEM privileges by abusing log authentication in the Common Log File System driver. Microsoft has not shipped a fix yet, so the flaw is a zero day. An attacker needs a foothold on the machine first, which

Read more

Critical NetScaler Flaws Prompt Urgent Update Advice From CERT-EU

Attacker Uses 4,837 Hijacked GitHub Accounts to Run a Secret Stealer

SCKit Malware Hits 288 Endpoints Across 48 Organizations Through ScreenConnect

New SignDrop Exploit Turns a Windows Logging Feature Into SYSTEM Access