DDoS
ChatGPT says major outages may be due to DDoS attacks
Incident follows record HTTP2 "Rapid Reset" attack warnings as well as CISA note on exploitation of Service Location Protocol vulnerability for DDoS purposes.
Microsoft
Microsoft pledges a dramatic software security overhaul, as Amazon veteran shakes the tree
Biggest overhaul of Redmond's security in 20 years sees promises of "code analysis [of] 100% of commercial product”, cryptographic keys to be kept in a hardened Azure HSM, more.
CISO
As SEC’s SolarWinds charges reverberate, companies scrutinise cyber risk disclosures
'Do not state anything that is subjective and avoid adjectives (e.g., "state of the art," "mature," "advanced," "appropriate," "comprehensive," or "reasonable")' say experts.
News
Zero day in free Roundcube webmail service exploited to target governments
Despite the low sophistication of the group’s toolset, it is a threat to governments in Europe because... a significant number of internet-facing applications are not regularly updated although they are known to contain vulnerabilities.”
data breaches
Okta breach looks worse as BeyondTrust, Cloudflare, 1Password report impact, flag concerns
Concern at IAM vendor Okta's response mounts as BeyondTrust details concerns, Cloudflare calls for customers to press harder on "further information regarding potential impact to your organization"
ransomware
Was this the most vanilla ransomware attack ever?
"VPNs pose a threat to enterprise security. They create a path in the network perimeter and provide access to network resources after authentication..."
Okta
Fresh Okta breach exposes files: HAR, but no laughing matter
The attackers used a "stolen credential to access Okta's support case management system"
NSA
Top 10 misconfigurations: NSA checklist for CISOs flags Active Directory Certificate Services
"In some cases, the actor may be restricted or detected by advanced defense-in-depth and zero trust implementations as well, but this has been a rare finding in assessments thus far"
nuclear
UK nuclear firms get code red warning over cybersecurity failings
Cybersecurity failures "escalated…to significantly enhanced attention"
Cisco
CVSS 10 Cisco bug is getting exploited, has no patch
"We have also seen devices... getting the implant successfully installed through an as of yet undetermined mechanism."
Cybersecurity
Security veterans team up to tackle “Cyber Poverty”
"Because of the interconnected nature of our supply chain, the ramifications of a single incident in these underserved less cyber mature pockets can have devastating downstream impact..."
open source
A free new repository offers intel on malicious open source
OpenSSF's new Malicious Packages Repository is free to use in and available in OSV format.