Progress published all 31 on October 12 and scored five of them critical. It told operators to disconnect the controllers or filter access to them. Whether other models or firmware versions are affected is not known. A compromised account that looks legitimate at first could become the starting point for a much larger attack. The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying ​Grindr users’ sensitive data to advertisers. The SDK handles authentication for those services with the application’s client credentials, a client ID and a client secret.

Three vulnerabilities in LG’s webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. The data protection authority said its investigation found that Xandr was a joint controller with Grindr, which meant it was responsible for obtaining users’ consent before processing their data. “Xandr acted as an intermediary that relayed the personal data of Grindr users in Norway, including data revealing sexual orientation, to potentially thousands of other companies,” the Data Protection Authority said in a statement. An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Experiments show cheap TV boxes can run capable AI models, and small models may soon be able to spread across such devices on their own.

OTCC urged CISA to mandate baseline security requirements for federal operational technology The UK, US and allies have issued an alert detailing malicious activity linked to China’s Integrity Technology Group – AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. The suspect is believed to be Edward Dubrovsky, a Canadian cybersecurity executive who was visiting the United States for a conference. The outage hit the main Ubuntu and Canonical websites, including the Ubuntu blog and developer portal.

Google froze its open source bug bounty program due to a ‘significant rise’ in AI submissions

This security flaw specifically affects Windows worker nodes and could allow attackers to execute arbitrary commands on the host system by exploiting the `/logs` endpoint of… The most alarming of these flaws are four critical path traversal vulnerabilities that could allow unauthorized access to sensitive information. Ivanti addressed multiple severe vulnerabilities in its Endpoint Manager (EPM) software, potentially exposing organizations to significant data breaches. DHS agents not only tracked and intimidated people observing ICE activity in Maine, but stored information about them in a database run on Palantir software, newly unsealed court filings say.

• An attacker replays a manifest from sync-demo, a built-in app already on the device, signed with a test certificate the firmware trusts.
• GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution.
• An attacker must be able to control the tenant subdomain, the name such an application passes to the SDK to say which tenant a request is for.
• “Such an ‘AI worm’ could carry its model weights with it as it reproduces (or re-download them from a public hub), and then run inference directly on compromised hardware,” Anthropic said .
• The attackers have threatened to release sensitive company data within two days unless their demands…

• Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic.
• CERT-FR is part of ANSSI, France’s national cybersecurity agency.
• “We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet,” Ledger said in an X post.
• The breach, which was caused by a compromised third-party contractor account, raised concerns about data security and third-party risk…
• A significant cybersecurity threat involving North Korean hackers exploiting LinkedIn as an entry point to infiltrate organizations.

And some systems turned out to be easier to break into than anyone would like to admit. People offering to fix a ransomware mess had questions to answer themselves. GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution.

An attacker replays a manifest from sync-demo, a built-in app already on the device, signed with a test certificate the firmware trusts. An attacker must be able to control the tenant subdomain, the name such an application passes to the SDK to say which tenant a request is for. Conversion transferred the account’s personal access tokens (PATs) to the user designated as the organization’s owner. Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic. Daiichi Kosho says a supply chain breach has exposed personal data on over eight million karaoke customers

Hackers Allegedly Claiming Breach Of Hewlett Packard Enterprise

Ivanti has released fixes for two of the flaws and told customers on affected versions to “act immediately.” A fix for the third is still pending, according to Volexity. The CVE record it published on October 13 gives the flaw a CVSS 4.0 score of 9.4. It did not reach the Docker Hub web interface, and it could not be used to change a password, email address, or two-factor settings, or to take over an account. “Such an ‘AI worm’ could carry its model weights with it as it reproduces (or re-download them from a public hub), and then run inference directly on compromised hardware,” Anthropic said .

The popular food delivery platform Grubhub has disclosed a significant data breach involving unauthorized access to customer, merchant, and driver information. A major data security incident has been uncovered where sensitive information of over 33,000 employees was exposed due to unsecured API endpoints. The US government’s Tradewinds initiative has made it easier to throw millions of dollars at “nontraditional” defense contractors, including OpenAI, Anthropic, and Google. From AI-generated images to restricted satellite data, the systems used to verify what’s real online are struggling to keep up. Your conversations with AI chatbots are both highly personal and deeply vulnerable to surveillance. In an exclusive interview with WIRED, Paragon Solutions CEO Andrew Boyd reveals the limits of the company’s promise to keep bad actors from abusing its powerful espionage tool.

“We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet,” Ledger said in an X post. The incident is said to have resulted in losses totaling more than $86 million, according to pseudonymous blockchain investigator Specter . Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via CryptoBilis following reports of stolen funds linked to devices sold by the reseller.

Refrigeration Controller Hack Spoils Food Across European Supermarkets

• Nowhere is this more evident than in cyber threat intelligence, where raw data alone is powerless without…
• Installing the fixes for the 10 MarkLogic flaws Progress disclosed in August is not enough.
• Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies.
• Les Mousquetaires, which owns the Intermarché chain, said its fridges and freezers were put into defrost and heated to as much as 50°C.
• This security flaw specifically affects Windows worker nodes and could allow attackers to execute arbitrary commands on the host system by exploiting the `/logs` endpoint of…
• From AI-generated images to restricted satellite data, the systems used to verify what’s real online are struggling to keep up.

Installing the fixes for the 10 MarkLogic flaws Progress disclosed in August is not enough. ANSSI’s head, Vincent Strubel, called it urgent to take the two series off the internet or fil… CERT-FR is part https://spainlivinghome.com/ispmanager-a-key-tool-for-administering-web-servers-and-hosting.html of ANSSI, France’s national cybersecurity agency. Les Mousquetaires, which owns the Intermarché chain, said its fridges and freezers were put into defrost and heated to as much as 50°C.

Cybersecurity News

The attackers have threatened to release https://autonow.net/api-testing-to-ensure-software-quality-and-reliability-with-postman.html sensitive company data within two days unless their demands… The beloved doughnut chain Krispy Kreme has fallen victim to a significant cybersecurity incident, with the notorious Play ransomware group claiming responsibility for the attack. Two of 31 newly disclosed flaws in Progress Software’s MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Together they let an attacker run code as the appliance’s cgi-server user, and the third flaw, a privilege escalation, raises that to root, Volexity said. Microsoft fixed vulnerabilities across Azure and AI-branded products, with privilege escalation flaws accounting for the majority. A small circuit board hidden under the signers’ screens read user data and transmitted it to the attackers.

Tasked with controlling AI, an administrator often resorts to blocking well-known AI websites and taking enforcement action without knowing what is actually running. A user opens a browser tab, pastes data into a chat assistant, and nothing is installed. The attack enters through a service that the TV exposes on port 3001, which is used by the LG ThinQ app for pairing. LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12. The administrative penalty is the largest issued by the data protection watchdog, arguing the case merited a high fine because of the “very serious” nature of the breach. The appliance was fully patched at the time and running version 22.8R2.4.