InfoSec / Cyber Security News thehackernews.com Apple's New iCloud Private Relay Service Leaks Users' Real IP AddressesGoogle Warns of a New Way Hackers Can Make Malware Undetectable on WindowsCisco Releases Patches 3 New Critical Flaws Affecting IOS XE SoftwareUrgent Apple iOS and macOS Updates Released to Fix Actively Exploited Zero-DaysMicrosoft Exchange Bug Exposes ~100,000 Windows Domain CredentialsA New Bug in Microsoft Windows Could Let Hackers Easily Install a Rootkit bleepingcomputer.com Researcher drops three iOS zero-days that Apple refused to fixCisco fixes highly critical vulnerabilities in IOS XE SoftwareSonicWall fixes critical bug allowing SMA 100 device takeoverGoogle: Manifest V2 Chrome extensions to stop working in 2023Microsoft gets Windows 11 ready for release with new buildHacking group used ProxyLogon exploits to breach hotels worldwide wired.com Ransomware Isn't Back. It Never LeftHe Escaped the Dark Web's Biggest Bust. Now He's BackThe iOS 15 Privacy Settings You Should Change Right NowHow to Set Up a NAS to Securely Share FilesFormer US Intelligence Operatives Admit They Hacked for UAEApple and Google Go Further Than Ever to Appease Russia krebsonsecurity.com Indictment, Lawsuits Revive Trump-Alfa Bank StoryDoes Your Organization Have a Security.txt File?Trial Ends in Guilty Verdict for DDoS-for-Hire BossCustomer Care Giant TTEC Hit By RansomwareMicrosoft Patch Tuesday, September 2021 EditionKrebsOnSecurity Hit By Huge New IoT Botnet “Meris” zerodayinitiative.com CVE-2021-26084: Details on the Recently Exploited Atlassian Confluence OGNL Injection BugThe September 2021 Security Update ReviewAnalysis of a Parallels Desktop Stack Clash Vulnerability and Variant Hunting using Binary NinjaCVE-2021-2429: A Heap-based Buffer Overflow Bug in the MySQL InnoDB memcached PluginProxyToken: An Authentication Bypass in Microsoft Exchange ServerFrom Pwn2Own 2021: A New Attack Surface on Microsoft Exchange - ProxyShell! reddit.com/r/InfoSecNews 3.8 billion Clubhouse and Facebook user records allegedly scraped and merged, put for sale onlineNew FamousSparrow APT group used ProxyLogon exploits in its attacksLawsuits, Indictments Revive Trump-Alfa Bank StoryCrystal Valley hit by ransomware attack, it is the second farming cooperative shut down in a weekPeeking into CVE-2021-40444 | MS Office Zero-Day Vulnerability Exploited in the WildREVil ransomware devs added a backdoor to cheat affiliates threatpost.com Apple Patches 3 More Zero-Days Under Active AttackREvil Affiliates Confirm: Leadership Were Cheating Dirtbags5 Tips for Achieving Better Cybersecurity Risk Management100M IoT Devices Exposed By Zero-Day BugFamousSparrow APT Wings in to Spy on Hotels, GovernmentsGoogle Report Spotlights Uptick in Controversial ‘Geofence Warrants’ by Police reddit.com/r/cybersecurity Mentorship MondayAMA Series - Ask a CISO AnythingDisclosure of three 0-day iOS vulnerabilities and critique of Apple Security Bounty programNew macOS zero-day bug lets attackers run commands remotelyRant: Client Pitched Cyber Solutions from Non-Technical StaffHit Me with a Wrench All You Want, I Can’t Tell You My Password reddit.com/r/netsec /r/netsec's Q3 2021 Information Security Hiring ThreadDisclosure of three 0-day iOS vulnerabilities and critique of Apple Security Bounty programFinancially motivated actor breaks certificate parsing to avoid detectionIAM Vulnerable - Assessing the AWS Assessment ToolsAnalysis of products made by Huawei, Xiaomi and OnePlusSaved by the log: Building IR support into software design reddit.com/r/websec Docker for CTFs (Application Virtualization)Very simple example of an SSRF (Server Side Request Forgery) vulnerabilityURL Filter SubversionI made a video trying to explain XSS. Please feel free to leave any constructive criticism.Beginner trying to understand WSDL, SOAP, and SOAP messages for a "Secure Web Development" courseBurp Suite Certification reddit.com/r/pwned Geico data breach exposed customers' driver's license numbersCodecov.io: "Unauthorized access and alterations to our Bash Uploader since Jan 31, 2021, which enabled them to potentially export information stored in our users' continuous integration (CI) environments"Mobikwik (India) KYC data leaked$5.7 Million Crypto Stolen Due To A Security Breach at Cryptocurrency platform RollAmerican Armed Forces Mutual Aid Association hack impacted more than 161,000 embracethered.com Video: Web Application Security FundamentalsBackdoor users on Linux with uid=0Using Microsoft Counterfit to create adversarial examples for Husky AIUsing procdump on Linux to dump credentialsThe Silver Searcher - search through code and files quicklyAutomating Microsoft Office to Achieve Red Teaming Objectives darkreading.com UK MoD Data Breach Shows Cybersecurity Must Protect Both People and DataFragAttacks Foil 2 Decades of Wireless SecurityResearchers Call for 'CVE' Approach for Cloud VulnerabilitiesHTTP/2 Implementation Errors Exposing Websites to Serious RisksCISA Launches JCDC, the Joint Cyber Defense CollaborativeIncident Responders Explore Microsoft 365 Attacks in the Wild trendmicro.com Virtual Event: Google Cloud Next | October 12 – 14Cyberattacks from all Angles: 2021 Midyear ReportCISA Reports Top Vulnerabilities From Remote WorkCryptominer z0Miner Uses Newly Discovered Vulnerability CVE-2021-26084 to Its AdvantageReduce Risk with an Open Source Code Scanner welivesecurity.com Bug in macOS Finder allows remote code executionFamousSparrow: A suspicious hotel guestPlugging the holes: How to prevent corporate data leaks in the cloudEuropean police dismantle cybercrime ring with ties to Italian MafiaWeek in security with Tony AnscombeNumando: Count once, code twice helpnetsecurity.com A new zero-day is being exploited to compromise Macs (CVE-2021-30869)New infosec products of the week: September 24, 2021Implementing risk quantification into an existing GRC programThe evolution of DRaaSPolicy and patience key in Biden’s cybersecurity battle nakedsecurity.sophos.com STILL ALIVE! iOS 12 gets 3 zero-day security patches – update nowHow Outlook “autodiscover” could leak your passwords – and how to stop itVMware patch bulletin warns: “This needs your immediate attention.”iOS 15 launches with 22 documented security patches – including a Face ID bypass using a “3D model”“Back to basics” as courier scammers skip fake fees and missed deliveries insights.infosec-jobs.com A first update on our salary surveyShare your salary and see what everyone else is making in InfoSec / the Cyber Security spaceThe 10 most in-demand roles in the Information Security domain2021 so far – A few UpdatesWe launched “jobmarks”We now have “Dark Mode” securityweek.com LG to Acquire Vehicle Cybersecurity Firm CybellumCISA Opens IPv6 Guidance to Public FeedbackPort of Houston Target of Suspected Nation-State HackF5 to Acquire Threat Stack for $68 Million in CashWorking Securely From Anywhere With Zero Trust securityboulevard.com Check: that Republican audit of MaricopaCybersecurity Leaders on Insider Threat Awareness MonthApple Digital Driver’s License Part 2THE 2021 OWASP TOP TEN EMPHASIZES SECURITY CONTROL AREAS OVER INDIVIDUAL VULNERABILITIES FOR IMPROVED RISK MANAGEMENTWhy Developers Need More than SAST and DAST for Real Code Security siliconrepublic.com Microsoft security team detects major phishing-as-a-service operationOnly 3pc of Ireland was worried about healthcare data security before HSE breachThe future of printing: Are we facing a paperless world?VMware issues critical patch for ransomware vulnerabilityMeet the students representing Ireland in ‘the Eurovision of cybersecurity’ csoonline.com Security Recruiter DirectoryBreach reporting required for health apps and devices, FTC says10 top API security testing toolsExchange Autodiscover feature can cause Outlook to leak credentialsYes, the FBI held back REvil ransomware keysUS cryptocurrency exchange sanctions over ransomware likely not the last kitploit.com Reconky - A Great Content Discovery Bash Script For Bug Bounty Hunters Which Automate Lot Of Task And Organized ItJSPanda - Client-Side Prototype Pullution Vulnerability ScannerWordlistgen - Quickly Generate Context-Specific Wordlists For Content Discovery From Lists Of URLs Or PathsAES256_Passwd_Store - Secure Open-Source Password ManagerDirSearch - A Go Implementation Of Dirsearch grahamcluley.com Lithuania warns firms not to use Xiaomi and Huawei smartphones after investigation finds security and censorship concernsSmashing Security podcast #244: Facebook Ray-Bans, VPN spies, and AI camouflageUS Government tells firms not to give in to ransomware demands, as first crypto exchange sanctioned for laundering cyber ransomsPredict 21 – the intelligence summit from Recorded Future you cannot afford to miss, October 12-13 2021Facebook’s Ray-Ban Stories glasses have got a problem