Page 16 - Web Security News Today

A patch in the NextGen Gallery WordPress plugin fixes critical and high-severity cross-site request forgery flaws. Researchers are urging WordPress websites that utilize the NextGen Gallery plugin to apply a patch addressing critical and high-severity flaws. The NextGen Gallery plugin, which is installed on 800,000 WordPress websites, allows sites to upload photos in batch quantities, import metadata and edit image thumbnails. Researchers discovered two cross-site request forgery (CSRF) flaws ...

minute read Share this article: The LodaRAT – known for targeting Windows devices – has been discovered also targeting Android devices in a new espionage campaign. A newly discovered variant of the LodaRAT malware, which has historically targeted Windows devices, is being distributed in an ongoing campaign that now also hunts down Android devices and spies on victims. Along with this, an updated version of LodaRAT for Windows has also been identified; both versions were seen in...

minute read Share this article: About 3.27 billion stolen account logins have been posted to the RaidForums English-language cybercrime community in a ‘COMB’ collection. A “compilation of many breaches” – COMB for short – has been leaked on the cyber-underground, according to researchers. The so-called COMB contains a staggering 3.27 billion unique combinations of cleartext email addresses and passwords. The trove is an aggregate database that brings together older stol...

Register for our free webinar on February 24 at 2 PM ET and learn the secrets of running a mid-sized business with the IT-security posture of a large enterprise.

CD Projekt Red was hit with a cyberattack and the attackers are threatening to release source code for Witcher 3, corporate documents and more.

The ransomware attack, affecting OT systems, resulted in some of WestRock's facilities lagging in production levels.

Remote work continues to fueling a spike in phishing and cyberattacks, particularly in the U.S. When it comes to paying the ransom in a ransomware attack, demands are on the rise. Yet, many companies that paid the ransom failed to receive a decryption key, in a survey issued Monday. In fact, pandemic-themed phishing scams, a sustained onslaught of ransomware attacks and the rise of a remote global workforce all colluded to make the last 12 months particularly brutal for information-security pro...

minute read Share this article: In a unique attack, cybercriminals locally install an extension to manipulate data in internal web applications that the victims have access to. Cybercriminals have been using a novel approach to exfiltrate data that involves directly injecting malicious Google Chrome extensions onto victims’ Windows machines via the abuse of Google’s cloud synching function. The goal of the recently-identified campaign is to manipulate data in internal web appli...

minute read Share this article: Claroty reports that adversaries, CISOs and researchers have all turned their attention to finding critical security bugs in ICS networks. It’s on: Adversaries, CISOs and researchers are all simultaneously involved in a frantic race to find cybersecurity vulnerabilities hiding within industrial networks, according to the latest Biannual ICS Risk and Vulnerability report from Claroty. The report analyzed all publicly disclosed vulnerabilities in ICS...

An CRSF-to-stored-XSS security bug plagues 50,000 'Contact Form 7' Style users.