Daily Cyber News coverage tagged Government & Policy.
Weaknesses disclosed in Tailscale SSH could let an attacker expand access after compromising an authorized device. In laboratory testing, chained issues produced root access on reachable servers and exposed keys that could add rogue devices. An automated attack moved between policy-approved servers…
Patient care and teaching were interrupted after a cyberattack hit the University of New Mexico Health Sciences Center. UNM temporarily diverted ambulances, limited admissions, suspended outpatient procedures and canceled classes. It later said critical electronic systems were back online, hospitals were…
Customers of GMO Internet’s cloud desktop service face possible data theft and unauthorized trading activity. The company shut down the service after discovering unauthorized access and later said information linked to customers and its business appeared online. It warned that 26,739 virtual desktop…
Organizations running PHP face active exploitation attempts against two newly disclosed security issues. Federal civilian agencies were ordered to patch by Thursday, while other organizations were told to identify every PHP system and update it. Thousands of failed attack attempts have been reported…
Patient care was disrupted when a cyberattack hit the University of New Mexico Health Sciences Center. Ambulances were diverted, appointments across more than 30 clinics were canceled, and health sciences classes were called off. Hospitals later reopened, with systems and services returning in phases. An…
Aruba environments may face several attack paths if vendor fixes are not applied. A security alert lists multiple vulnerabilities that a remote attacker could use for security-control bypass, denial of service, cross-site scripting, sensitive-information disclosure or remote code execution. The bulletin…
Employees will receive another warning layer for scams that use conversation rather than malicious links or attachments. Microsoft is preparing AI-based phishing detection for Teams, focused mainly on first chats with external contacts. Targeted Release is expected in early November, with worldwide…
Web server compromise is now more practical because public exploit code is available for two critical PHP issues. A researcher used the pair to win a public Bitcoin challenge, although the published script was developed and tested against a local lab copy and succeeded about seven of ten times there. PHP…
Siemens Software Center users face active exploitation of a weakness that can execute attacker-supplied code with the application’s privileges. An authenticated local attacker can place a crafted library in a directory the application searches. Versions before 4.0.9.8 are affected, and Siemens released a…
On-premises VeloCloud Orchestrator systems are being targeted through a newly patched issue. An authenticated user with basic privileges and access to the web interface could gain operator privileges and reach internal functions. Successful exploitation could affect the orchestrator, its data, and the…
At least 600 organizations across multiple critical infrastructure sectors have been affected by SafePay ransomware since August 2024. The group enters through exposed credentials, brute-force attempts, VPN access, and known edge-device weaknesses. It steals data, encrypts systems, and pressures victims…
Machine-learning workloads could execute attacker-controlled code and expose cloud credentials because of an unsafe SageMaker Python SDK default. The SDK generated a predictable storage bucket name without confirming that the caller’s account owned the bucket. An attacker who created the bucket first…
Attackers are chaining four Plex Media Server weaknesses to obtain administrator tokens and run code with elevated privileges. Exploitation reports began on October 17, with early activity targeting honeypots to deploy a cryptocurrency miner. CISA warned that attackers are actively exploiting the…
Self-managed GitLab servers could be taken over if administrators delay a new critical patch. Under certain conditions, an unauthenticated user could execute arbitrary code by submitting a specially crafted regular expression. The affected range extends across many GitLab releases beginning with version…
Chrome is adding warnings designed to interrupt scams before users expose systems or data. Enhanced Protection can now detect suspicious copied commands used in ClickFix attacks and send a scrubbed clipboard payload for analysis. Server-side Gemini analysis also evaluates pages showing strong scam…
A NATO-country shipbuilder was compromised during a Russia-linked espionage campaign that also targeted an aircraft engine maker and a law enforcement agency. The attackers delivered the Hookedge backdoor through an infected Microsoft Word document. They returned to the shipbuilder’s environment…
WordPress sites were backdoored through valid UpdraftCentral management keys after TeamUpdraft detected unauthorized access to its infrastructure. The vendor believes its customer database was accessed and replaced potentially affected keys and credentials. Researchers said attackers used stolen keys to…
Organizations may already have unauthorized VPN sessions created through a patched GlobalProtect authentication bypass. Ransomware operators including Qilin and Inc have been linked to exploitation, while public reporting also connects Settra activity. Attackers used the access to bypass multifactor…
Public-facing web servers face an urgent update cycle after critical PHP weaknesses opened paths to code execution, data exposure and service disruption. The issues affect PHP installations serving web requests, including common Apache, PHP-FPM and CGI configurations. Fixes are available in PHP 8.5.12…