Google recently announced security updates for Chrome 126 that address ten vulnerabilities, including eight high-severity bugs reported by external researchers.  Google noted that the new Chrome 126 release resolves an inappropriate implementation flaw in V8, a type confusion in V8, use-after-free bugs in Screen Capture, Media Stream, Audio, and Navigation, a race condition in DevTools, and an out-of-bounds memory access in V8.  Google says it paid out $10,000 and $7,000 bug bounty rewards for the inappropriate implementation and type confusion vulnerabilities in V8.

MNGI Digestive Health has started notifying over 765,000 individuals that their personal information was compromised in an August 2023 data breach.  The incident occurred on August 20, 2023, but it took MNGI almost one year to determine that personal and protected health information was accessed.  MGNI says that the potentially compromised information includes names, dates of birth, Social Security numbers, driver’s licenses and state ID numbers, passport numbers, biometric data, health insurance information, and medical information.

Virginia-based furniture manufacturer and retailer Bassett Furniture has recently announced that it was targeted in a ransomware attack that caused significant disruptions, including in the company's manufacturing facilities. The company detected unauthorized access to its IT systems on July 10. Bassett Furniture said the threat actor disrupted its business operations by encrypting "some data files." The company noted that retail stores and the e-commerce platform are open, and customers can place orders and purchase available merchandise; however, the company's ability to fu

Cybersecurity analysts at FortiGuard Labs have warned of a significant uptick in cyber threats targeting the upcoming Paris 2024 Olympics. The researchers noted that cybercriminals have been intensifying their efforts for more than a year, gearing up with sophisticated tools and tactics aimed at exploiting the global event.  The researchers said there was a substantial surge in darknet activity, with an 80-90% increase observed between the second half of 2023 and the first half of 2024.  The researchers say they saw a huge increase in phishing kits tailored for the Olympics.

A threat actor recently released over 15 million email addresses associated with Trello accounts that were collected using an unsecured API in January.  Trello is an online project management tool owned by Atlassian.  Businesses commonly use it to organize data and tasks into boards, cards, and lists.  In January, a threat actor known as "emo" was selling profiles for 15,115,516 Trello members on a popular hacking forum.  The leaked data includes email addresses and public Trello account information, including the user's full name.

A research team led by faculty from Binghamton University's School of Management (SOM), in collaboration with scholars from Vietnam National University and Liverpool John Moores University, has been investigating whether there is a link between mass layoffs and data breaches. According to the study, layoffs increase stress or job insecurity for employees, making them more likely to engage in risky behaviors that leave their company vulnerable to data breaches. This article continues to discuss findings from the study "The Impacts of Layoffs Announcement on Cybersecurity Breaches."

Researchers have found a critical Remote Code Execution (RCE) vulnerability in the MHTML protocol handler, which the Advanced Persistent Threat (APT) group "Void Banshee" exploited. The APT group exploited the flaw in a sophisticated attack chain to steal sensitive data and achieve financial gain. This article continues to discuss findings regarding the exploitation of a critical RCE flaw within the MHTML protocol handler by the Void Banshee APT group.

Hackers have compromised multiple domain names registered with Squarespace, leaving several cryptocurrency platforms scrambling to regain control of their Domain Name System (DNS) records. The recent attacks impacted domains transferred to Squarespace after the domain registrar acquired domain registrations and customers from Google Domains in 2023. This article continues to discuss the exploitation of a flaw to hijack cryptocurrency domains migrated from Google Domains to Squarespace.

The US cybersecurity agency CISA recently urged federal agencies to patch a critical severity vulnerability in GeoServer as soon as possible, warning of evidence of active exploitation.  The bug is tracked as CVE-2024-36401 (CVSS score of 9.8) and is described as the unsafe evaluation of property names as XPath expressions, which could allow unauthenticated attackers to execute code remotely through crafted input against a default GeoServer installation.