vulnerabilities
Issues include a faulty fix to an issue disclosed two years ago.
Attacks appear to be "linked to legacy credential use during migrations from Gen 6 to Gen 7 firewalls"
"Once on the network, the attackers don't waste time. Their actions are a mix of automated scripts for speed and hands-on-keyboard activity"
“Someone intentionally slipped a live grenade into prod and AWS gave it version release notes.”
All exploitation takes is a “crafted API request”. The bug affects Cisco ISE and ISE-PIC releases 3.3 and 3.4, “regardless of device configuration.”
"A modern zero-day chain with automatic shell drop, full persistence, and zero authentication"
The UK’s National Cyber Security Centre (NCSC) is keen to bring in fresh blood to its Vulnerability Research Initiative, including across AI. Contrary to a flurry of press releases from excited cybersecurity vendors hitting The Stack’s inbox this week, the VRI is not new and has been running
Exploits date back as early as June 23...
It was, says offensive cybersecurity specialist Hendrik de Bruin, a pretty poor piece of malware, but noteworthy simply because it hasn't been tried before. "This is definitely not at a nation-state level of sophistication," de Bruin, a security consulting unit head at Check Point, told The