Cisco recently announced patches for multiple vulnerabilities across its products, including a high-severity bug in its enterprise collaboration solutions.  Tracked as CVE-2024-20375, the high-severity issue (CVSS score of 8.6) impacts the SIP call processing function of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and can be exploited remotely, without authentication.

New cybersecurity rules have been proposed by the Federal Aviation Administration (FAA) to mitigate vulnerabilities caused by the interconnectedness of modern aircraft.  The proposal, published in the Federal Register on August 21, highlighted the current trend in aircraft design of increased integration of airplane, engine, and propeller systems with internal or external data networks and services.

A security researcher named John Blackbourn, through the Patchstack zero-day bug bounty program, has discovered a critical vulnerability in the LiteSpeed Cache plugin, potentially exposing millions of WordPress sites to severe security risks. The researcher noted that the vulnerability allows unauthorized users to gain administrator-level access and could lead to installing malicious plugins and compromising affected websites.  The researcher said the vulnerability arises from the plugin’s weak security hash used in its user simulation feature.

Researchers at Check Point found that a suspected developer of the "Styx Stealer" malware made an Operational Security (OPSEC) mistake, leaking client and earnings data from his computer. Styx Stealer collects browser data and cryptocurrency, as well as instant messenger sessions from Telegram and Discord. The developer's significant error and data leak from his computer gave Check Point a lot of intelligence.

Cryptojacking attackers are targeting poorly protected PostgreSQL databases running on Linux machines. Aqua Security researchers observed the attack on a honeypot system, which began with the threat actors brute-forcing access credentials. Once access is gained, the threat actor creates a new user role with login capability and high privileges, strips the user role they compromised of superuser privileges, and more. The first payload, "PG_Core," mainly removes cron jobs for the current user and terminates processes associated with other cryptomining malware.

According to the application security company Miggo, about 15,000 apps that use Amazon Web Services' (AWS) Application Load Balancer (ALB) for authentication may be vulnerable to attacks. The attacks dubbed "ALBeast" stem from a critical configuration issue, not a vulnerability in the AWS ALB solution. AWS was informed of the possible risks in April, and since then, it has updated its documentation and added new code to help prevent ALBeast attacks. This article continues to discuss the vulnerability of thousands of apps using AWS ALB to ALBeast attacks.

"MoonPeak," a newly discovered Remote Access Trojan (RAT) family, has been linked to the North Korean threat group "UAT-5394." Cisco Talos research shows that this sophisticated malware, based on the open source "XenoRAT," is actively being developed to avoid detection and improve functionality.

Class action litigation claims administration firm Arden Claims Service recently started notifying about 139,000 individuals that their personal information was stolen during an October 2023 data breach.  The incident was discovered on October 17, when the firm noticed unusual activity in an email account.  During an investigation, the company found that  a third party “acquired certain data without authorization on or about October 3”.