Dark Reading Daily -- September 29, 2023

Government Shutdown Poised to Stress Nation's Cybersecurity Supply Chain

CISA announces it will furlough more than 80% of staff indefinitely if Congress can't reach an agreement to fund the federal government.

Chrome Flags Third Zero-Day This Month That's Tied to Spying Exploits

So far this year, Google has disclosed six vulnerabilities that attackers were actively exploiting before the company had a patch for them.

New Cisco IOS Zero-Day Delivers a Double Punch

The networking giant discloses new vulnerabilities the same day as warnings get issued that Cisco gear has been targeted in a Chinese APT attack.

Novel ZenRAT Scurries Onto Systems via Fake Password Manager Tool

Attackers exclusively target Windows users with an impersonation website that distributes information-stealing malware.

Supply Chain Attackers Escalate With GitHub Dependabot Impersonation

Armed with stolen developer passcodes, attackers have checked in changes to repositories under the automation feature's name in an attempt to escape notice.

Johnson Controls International Disrupted by Major Cyberattack

The company filed with the SEC and is assessing its operations and financial damages.

4 Legal Surprises You May Encounter After a Cybersecurity Incident

Many organizations are not prepared to respond to all the constituencies that come knocking after a breach or ransomware incident.

Looking Beyond the Hype Cycle of AI/ML in Cybersecurity

Artificial intelligence and machine learning aren't yet delivering on their cybersecurity promises. How can we close the gaps?

How the Okta Cross-Tenant Impersonation Attacks Succeeded

Sophisticated attacks on MGM and Caesars underscore the reality that even robust identity and access management may not be enough to protect you.

China APT Cracks Cisco Firmware in Attacks Against the US and Japan

Sophisticated hackers are rewriting router firmware in real time and hiding their footprints, leaving defenders with hardly a fighting chance.

Microsoft Adds Passkeys to Windows 11

It's the latest step in the gradual shift away from traditional passwords.

Threat Data Feeds and Threat Intelligence Are Not the Same Thing

It's important to know the difference between the two terms. Here's why.

Researchers Release Details of New RCE Exploit Chain for SharePoint

One of the already-patched flaws enables elevation of privilege, while the other enables remote code execution.

LATEST FROM THE EDGE

QR Code 101: What the Threats Look Like

Because QR codes can be used for phishing as easily as an email or text can, organizations must remain vigilant when dealing with them.

LATEST FROM DR TECHNOLOGY

7 Ways SMBs Can Secure Their WordPress Sites

This Tech Tip outlines seven easy fixes small and midsize businesses can use to prevent the seven most common WordPress vulnerabilities.

LATEST FROM DR GLOBAL

Q&A: UK Ambassador on Creating New Cybersecurity Agencies Around the World

How the UK is assisting other nations in forming their own versions of a National Centre for Cybersecurity (NCSC).

The State of Supply Chain Threats