Critical Siemens RTU Vulnerability Could Allow Hackers to Destabilize Power Grid
A critical vulnerability affecting some of Siemens' industrial control systems (ICS) designed for the energy sector could allow malicious hackers to destabilize a power grid, according to the researchers who found the security hole. The vulnerability, tracked as CVE-2023-28489, impacts the CPCI85 firmware of Sicam A8000 CP-8031 and CP-8050 products, and it can be exploited by an unauthenticated attacker for remote code execution. READ MORE...
Capita admits some pension data 'likely' to have been accessed in March breach
Capita is telling pension customers that some data contained within its systems was potentially accessed when criminals broke into the outsourcing giant's tech infrastructure earlier this year. The business admitted to a "cyber incident" - that nebulous phrase which downplays the significance of an attack - in March, when miscreants spent nine days inside the company's systems. READ MORE...
AI-powered content farms start clogging search results with ad-stuffed spam
A recent study by NewsGuard, trackers of online misinformation, makes some alarming discoveries about the role of artificial intelligence (AI) in content farm generation. If you've previously held your nose at the content mill grind, it's probably going to become a lot more unpleasant. Content farms are the pinnacle of search engine optimisation (SEO) shenanigans. Take a large collection of likely underpaid writers, set up a bunch of similar looking sites, and then plaster them with adverts. READ MORE...
May 2023 Patch Tuesday forecast: Dealing with End-of-Support (EOS)
The April Patch Tuesday releases were unusual because we saw a whopping 62 vulnerabilities addressed in the Microsoft Server 2012 KBs. Granted there was a lot of overlap with the CVEs addressed in Windows 10 and 11, but compared to the typical 30-40 CVEs addressed in the months prior, this number was unusually aggressive. Is this a coincidence or is there a push to prepare Server 2012 for its upcoming EOS in October? READ MORE...
World Password Day: 2 + 2 = 4
World Password Day is always hard to write tips for, because the primary advice you'll hear has been the same for many years. That's because the "passwordless future" that we've all been promised is still some time away, even if some services already support it. Simply put, we're stuck with the old, while at the same time preparing for the new. That's why we've come up with four tips for 2023, but split them into two halves. READ MORE...
The one and only password tip you need
OK, it's time for me to keep a promise. Back in October 2022, I wrote an article called Why (almost) everything we told you about passwords was wrong. The article summarizes how a lot of what you've been told about passwords over the years was either wrong (change your passwords as often as your underwear), misguided (choose long, complicated passwords), or counterproductive (don't reuse passwords). READ MORE...
How to Spot a ChatGPT Phishing Website
Hackers will always take advantage of the hot thing: COVID-19, crypto, tax season, or what have you. And with the rise of ChatGPT, they've not missed a beat. Through the first four months of 2023, researchers from Check Point tracked 13,296 newly registered domains relating to Open AI and ChatGPT. According to new research from the company, one in 25 of those domains were malicious. READ MORE...
Vulnerability Could Have Been Exploited for 'Unlimited' Free Credit on OpenAI Accounts
A vulnerability in OpenAI's account validation process allowed anyone to obtain virtually unlimited free credit for the company's services by registering new accounts using the same phone number, application security firm Checkmarx says. An artificial intelligence company, OpenAI has been making the news over the past several months, especially due to its ChatGPT project. When users sign up for a new account, OpenAI provides them with free credit as part of a trial period. READ MORE...
Critical RCE vulnerability in Cisco phone adapters, no update available (CVE-2023-20126)
Cisco has revealed the existence of a critical vulnerability (CVE-2023-20126) in the web-based management interface of Cisco SPA112 2-Port Phone Adapters. The adapters are widely used to integrate analog phones into VoIP networks without the need for an upgrade. CVE-2023-20126 can be exploited without prior authentication. "A successful exploit could allow the attacker to execute arbitrary code on the affected device with full privileges," Cisco's security advisory explains. READ MORE...
- ...in 1816, John Keats' first published poem, "O Solitude" , appears in The London Examiner.
- ...in 1904, Cy Young throws a perfect game against the Philadelphia Athletics in Boston, MA.
- ...in 1943, comedic actor Michael Palin from "Monty Python's Flying Circus" is born in Sheffield, England.
- ...in 1961, Alan Shepard becomes the first American in space when his Freedom 7 craft achieves Earth orbit.
