This week Twitter has begun experimenting with a new feature called ‘Tip Jar,’ which lets Twitter users tip select profiles to support their work.. But the feature has sparked multiple concerns among Twitter users: from the sender’s PayPal shipping add…
Read More Twitter Tip Jar may expose PayPal address, sparks privacy concernsCloud communications company Twilio has now disclosed that the recent Codecov supply-chain attack exposed a small number of Twilio’s customer email addresses. […]
Read More Twilio discloses impact from Codecov supply-chain attackToday, Trustwave researchers have disclosed their findings on a novel Windows malware sample that uses Internet Control Message Protocol (ICMP) for its command-and-control (C2) activities. Dubbed “Pingback,” this malware targets Windows 64-bit systems,…
Read More New Windows ‘Pingback’ malware uses ICMP for covert communicationPython 3.3 standard library ‘ipaddress’ suffers from a critical IP address vulnerability (CVE-2021-29921) identical to the flaw that was reported in the “netmask” library earlier this year. […]
Read More Python also impacted by critical IP address validation vulnerabilityCodecov has now started notifying the maintainers of software repositories affected by the recent supply-chain attack. These notifications, delivered via both email and the Codecov application interface, state that the company believes the affected rep…
Read More Codecov begins notifying affected customers, discloses IOCsCodecov has now started notifying the maintainers of software repositories affected by the recent supply-chain attack. These notifications, delivered via both email and the Codecov application interface, state that the company believes the affected rep…
Read More Codecov starts notifying customers affected by supply-chain attackMillions of COVID-19 test reports were found to be publicly accessible due to flawed online system implementation. […]
Read More Over 8 million COVID-19 test results leaked onlineThe heavily downloaded Node.js library “systeminformation” has a severe command injection vulnerability tracked as CVE-2021-21315. […]
Read More Heavily used Node.js package has a code injection vulnerabilityLinkedIn is inaccessible for both web and mobile users around the world in what appears to be an outage. […]
Read More LinkedIn is down for many, and we are not sure whyThis week a report has revealed details on the two spyware strains leveraged by state-sponsored threat actors during the India-Pakistan conflict.
The malware strains named Hornbill and SunBird have been delivered as fake Android apps (APKs) by the Co…
This week, hundreds of new packages have been published to the npm open-source repository named after private components being internally used by major companies. These npm packages are identical to the proof-of-concept packages created by Alex Birsan,…
Read More Copycat researchers imitate supply chain attack that hit tech giantsThis week, hundreds of new packages have been published to the npm open-source repository named after private components being internally used by major companies. These npm packages are identical to the proof-of-concept packages created by Alex Birsan,…
Read More Copycats imitate novel supply chain attack that hit tech giants