Microsoft Patch Tuesday, November 2024 Edition
Microsoft today released updates to plug at least 89 security holes in its Windows operating systems and other software. November's patch batch includes fixes for two zero-day vulnerabilities that are already being exploited by attackers, as well as two other flaws that were publicly disclosed prior to today. The zero-day flaw tracked as CVE-2024-49039 is a bug in the Windows Task Scheduler that allows an attacker to increase their privileges on a Windows machine. READ MORE...
2 Zero-Day Bugs in Microsoft's Nov. Update Under Active Exploit
Attackers are already actively exploiting two vulnerabilities for which Microsoft issued patches on Nov. 12 as part of its monthly security update. And they could soon begin targeting two other publicly disclosed, but as yet unexploited, flaws. The four zero-day bugs are among a set of 89 common vulnerabilities and exposures (CVEs) that Microsoft addressed in November's Patch Tuesday. The batch contains a substantially high percentage of remote code execution (RCE) vulnerabilities. READ MORE...
China's Volt Typhoon crew and its botnet surge back with a vengeance
China's Volt Typhoon crew and its botnet are back, compromising old Cisco routers once again to break into critical infrastructure networks and kick off cyberattacks, according to security researchers. The alert comes nearly ten months after the Feds claimed a victory against the Chinese government-linked miscreants, when the FBI infiltrated the operation and then remotely wiped the botnet. READ MORE...
Citrix Issues Patches for Zero-Day Recording Manager Bugs
Very swiftly after disclosing them, Citrix has issued patches for two vulnerabilities in its Citrix Virtual Apps and Desktop technology that allow a remote attacker escalate privileges or execute code of their choice on vulnerable systems. Citrix has described the remote code execution (RCE) vulnerabilities as something that only a previously authenticated attacker could abuse. However, researchers who discovered the flaws say it's a vulnerability that an attacker can exploit with ease. READ MORE...
Patch Tuesday: Critical Flaws in Adobe Commerce, Photoshop, InDesign, Illustrator
Enterprise software maker Adobe on Tuesday rolled out fixes for a wide swathe of critical security flaws across product lines, including code execution issues in the Adobe Commerce software suite. As part of its regular Patch Tuesday rollout, Adobe documented a total of 48 security bugs and called urgent attention to critical-severity bugs in the Adobe Commerce and Magento Open Source platforms, the InDesign and Photoshop suites, and the Illustrator and Substance 3D Painter products. READ MORE...
ICS Patch Tuesday: Security Advisories Released by CISA, Schneider, Siemens, Rockwell
Siemens, Schneider Electric, CISA, and Rockwell Automation have released November 2024 Patch Tuesday security advisories. Siemens has published a dozen new advisories. Based on severity score, the most important vulnerability is a critical deserialization issue in TeleControl Server Basic, which can allow an unauthenticated attacker to execute arbitrary code on the device. READ MORE...
High-Severity Vulnerabilities Patched in Zoom, Chrome
Zoom and Chrome security updates released on Tuesday patch over a dozen vulnerabilities affecting users across desktop platforms. Zoom announced fixes for six security defects, including two high-severity issues that could allow remote attackers to escalate privileges or leak sensitive information. The first bug, tracked as CVE-2024-45421 (CVSS score of 8.5), is described as a buffer overflow issue that requires authentication for successful exploitation. READ MORE...
Ivanti Patches 50 Vulnerabilities Across Several Products
IT software company Ivanti on Tuesday announced patches for close to 50 vulnerabilities, including eight critical-severity bugs in Connect Secure, Policy Secure, and Endpoint Manager. The critical issues, tracked as CVE-2024-38655, CVE-2024-38656, CVE-2024-39710 to CVE-2024-39712, and CVE-2024-11005 to CVE-2024-11007, are described as argument and command injection flaws that could allow authenticated attackers with administrator privileges to achieve remote code execution (RCE). READ MORE...
Chipmaker Patch Tuesday: Intel Publishes 44 and AMD Publishes 8 New Advisories
Intel and AMD have published November 2024 Patch Tuesday security advisories to inform customers about vulnerabilities found recently in their products. Intel has released 44 new advisories for over 80 vulnerabilities, including more than 20 high-severity issues. The exploitation of these security holes can lead to escalation of privileges, typically through local access. READ MORE...
Critical Veeam CVE targeted by new ransomware variant
A critical vulnerability in Veeam Backup and Replication is being exploited by a new ransomware variant, Sophos X-Ops said in a Friday blog post. The cybercriminal group operating Frag, the previously undocumented ransomware, used similar tactics, techniques and procedures as those used by Akira and Fog threat groups. Those groups were involved in exploitation of the same vulnerability last month. READ MORE...
North Korean hackers create Flutter apps to bypass macOS security
North Korean threat actors target Apple macOS systems using trojanized Notepad apps and minesweeper games created with Flutter, which are signed and notarized by a legitimate Apple developer ID. This means that the malicious apps, even if temporarily, passed Apple's security checks, so macOS systems treat them as verified and allow them to execute without restrictions. The app names are centered around cryptocurrency themes, which aligns with North Korean hackers' interests in financial theft. READ MORE...
- ...in 1850, author Robert Louis Stevenson ("Treasure Island", "Strange Case of Dr Jekyll and Mr Hyde") is born in Edinburgh, Scotland.
- ...in 1934, TV and film producer and director Garry Marshall ("Happy Days", "Pretty Woman") is born in the Bronx, NYC.
- ...in 1940, Disney's animated tribute to classical music "Fantasia" is released.
- ...in 1982, the Vietnam Veterans Memorial wall is dedicated in Washington, D.C.
