Apple shipped emergency patches for iOS and macOS to address two WebKit zero‑day vulnerabilities used in what researchers call an “extremely sophisticated” attack. The flaws appear tied to an already‑exploited Chrome issue, heightening concern about cross‑browser exploit chains and the likelihood of commercial spyware involvement. Security teams should prioritize rapid updates across iPhones, iPads, and Macs.
Source: SecurityWeek
Atlassian ships fixes for critical Apache Tika flaw across Jira, Confluence, Bitbucket, and more
Atlassian released updates for a critical vulnerability in Apache Tika impacting multiple products, including Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, and Jira. Because Tika is used to parse uploaded files, exploitation could enable code execution via weaponized documents, making this a high‑risk issue in collaborative environments. Patch quickly and review upload/content scanning controls.
Source: SecurityWeek
5.8M impacted in 700Credit breach exposing names, addresses, DOBs, and SSNs
Credit and identity verification provider 700Credit disclosed a breach that exposed sensitive PII, including Social Security numbers, for 5.8 million people. The incident poses high identity theft risk and potential downstream fraud for auto dealers and lenders that rely on the firm’s services. Organizations should prepare enhanced verification and monitor for synthetic identity abuse.
Source: SecurityWeek
New Android banker “Frogblight” targets Turkey via fake government court app
Kaspersky uncovered a rapidly evolving Android banking Trojan dubbed Frogblight that masquerades as an official app for accessing Turkish court cases. Researchers warn the malware could soon be offered as Malware‑as‑a‑Service, expanding reach and speed of campaigns. Users should install apps only from official stores and verify government app links.
Source: Securelist (Kaspersky)
CERT-FR urges users to fully disable Wi‑Fi when not in use amid broad wireless risk
France’s CERT-FR advises iPhone and Android users to completely turn off Wi‑Fi when it’s not needed, citing exposure from vulnerabilities across wireless interfaces, apps, OSs, and even hardware. The guidance reinforces least‑exposure practices: use trusted networks, restrict app permissions, and keep devices updated—ideally with MDM policies enforcing wireless hygiene.
Source: Security Affairs
Denmark proposes curbs on VPN use to tackle piracy, raising privacy and security concerns
Denmark’s government is seeking public input on legislation that would restrict VPN use for accessing certain online content, framed as a piracy countermeasure. While ministers call it “modest,” security and privacy advocates warn such measures could chill legitimate VPN usage for safety, censorship circumvention, and corporate security.
Source: The Register
VolkLocker RaaS blunder: hard‑coded master key allows free decryption
Researchers exposed a serious implementation flaw in VolkLocker ransomware—linked to pro‑Russian group CyberVolk—that embeds a master key, enabling victims to decrypt files without paying. The lapse underscores the uneven maturity of emerging RaaS offerings and gives defenders a window to help affected organizations recover swiftly.
Source: The Hacker News
You May Also Be Interested In...
Wireshark 4.6.2 fixes two vulnerabilities and five bugs
Apple, Google issue emergency zero‑day patches amid active exploitation