Ransomware is costing Attack.Ransom UK companies a whopping £346 million every year , despite Britain being labelled ‘ the most resolute ’ country for dealing with the cyber attacks Attack.Ransom . In fact , more than 40 per cent of mid-large UK business suffered on average five ransomware attacks Attack.Ransom during the last year , according to research by Vanson Bourne . However , 92 per cent of security professionals feel confident in their ability to combat ransomware in the future . And there was more good news for British . The survey found the UK to be the most resolute , both in refusing to pay ransom demands Attack.Ransom , as well as the most effective in combatting them . They experience the fewest number of attacks : 40 per cent , versus 70 per cent in Germany , 59 per cent in France and 55 per cent in the USA and enjoy a 43 per cent success rate in successfully defending against attacks . The research , commissioned by SentinelOne , reveals that ransomware is costing Attack.Ransom individual businesses around the globe an average of £591,238 per annum . The research all concluded that the number of companies ravaged by ransomware is on the rise . Results show that the overall percentage of companies experiencing ransomware has increased from 48 per cent in 2016 to 56 per cent in 2018 , however the average number per year has fallen from six to five attacks . The amount of time spent decrypting ransomware attacks Attack.Ransom has also increased from 33 to 40 man-hours . The study also reveals that employees are considered the major culprits responsible for introducing the malware into the business . This was further supported by the fact that phishing Attack.Phishing , which seeks to socially engineer employees , was the top attack vector by which ransomware infiltrated the business in 69 per cent of instances . Migo Kedem , director of Product Management at SentinelOne said : “ It ’ s staggering to see the cost to British businesses of £346 million . This figure shows that businesses are becoming increasingly aware that it ’ s not just the ransom demand Attack.Ransom , but rather the ancillary costs of downtime , staff time , lost business , as well as the data recovery costs and reputational damage that are the biggest concern to British businesses. ” He added : “ On a more positive note , it ’ s good to see CISOs feeling more bullish about their ability to tackle ransomware using the latest behavioural AI-based end-point technology . It ’ s also encouraging to see a clear movement against companies caving in to ransomware demands Attack.Ransom , preferring instead to take more proactive measure such as back-ups and patching Vulnerability-related.PatchVulnerability of vulnerable systems . However , the volume of ransomware attacks Attack.Ransom is still increasing and their speed , scale , sophistication and success in evading detection with the growth in file-less and memory-based malware , explains why ransomware will continue to be a major threat to CISOs in 2018 and beyond . ”

Intel revealed Vulnerability-related.DiscoverVulnerability that it will not be issuing Vulnerability-related.PatchVulnerability Spectre patches to a number of older Intel processor families , potentially leaving many customers vulnerable to the security exploit . Intel claims the processors affected are mostly implemented as closed systems , so they aren ’ t at risk from the Spectre exploit , and that the age of these processors means they have limited commercial availability . The processors which Intel won ’ t be patching Vulnerability-related.PatchVulnerability include four lines from 2007 , Penryn , Yorkfield , and Wolfdale , along with Bloomfield ( 2009 ) , Clarksfield ( 2009 ) , Jasper Forest ( 2010 ) and the Intel Atom SoFIA processors from 2015 . According to Tom ’ s Hardware , Intel ’ s decision not to patch Vulnerability-related.PatchVulnerability these products could stem from the relative difficulty of patching Vulnerability-related.PatchVulnerability the Spectre exploit on older systems . “ After a comprehensive investigation of the microarchitectures and microcode capabilities for these products , Intel has determined to not release Vulnerability-related.PatchVulnerability microcode updates for these products , ” Intel said . Because of the nature of the Spectre exploit , patches for it need to be delivered Vulnerability-related.PatchVulnerability as an operating system or BIOS update , and if Microsoft and motherboard OEMs aren ’ t going to distribute Vulnerability-related.PatchVulnerability the patches , developing Vulnerability-related.PatchVulnerability them isn ’ t much of a priority . “ However , the real reason Intel gave up on patching Vulnerability-related.PatchVulnerability these systems seems to be that neither motherboard makers nor Microsoft may be willing to update Vulnerability-related.PatchVulnerability systems sold a decade ago , ” Tom ’ s Hardware reports . It sounds bad , but as Intel pointed out , these are all relatively old processors — with the exception of the Intel Atom SoFIA processor , which came out in 2015 — and it ’ s unlikely they ’ re used in any high-security environments . The Spectre exploit is a serious security vulnerability to be sure , but as some commentators have pointed out in recent months , it ’ s not the kind of exploit the average user needs to worry about . “ We ’ ve now completed release Vulnerability-related.PatchVulnerability of microcode updates for Intel microprocessor products launched in the last 9+ years that required protection against the side-channel vulnerabilities discovered Vulnerability-related.DiscoverVulnerability by Google Project Zero , ” said an Intel spokseperson . “ However , as indicated in our latest microcode revision guidance , we will not be providing Vulnerability-related.PatchVulnerability updated microcode for a select number of older platforms for several reasons , including limited ecosystem support and customer feedback. ” If you have an old Penryn processor toiling away in an office PC somewhere , you ’ re probably more at risk for a malware infection arising from a bad download than you are susceptible to something as technically sophisticated as the Spectre or Meltdown vulnerabilities .

Intel revealed Vulnerability-related.DiscoverVulnerability that it will not be issuing Vulnerability-related.PatchVulnerability Spectre patches to a number of older Intel processor families , potentially leaving many customers vulnerable to the security exploit . Intel claims the processors affected are mostly implemented as closed systems , so they aren ’ t at risk from the Spectre exploit , and that the age of these processors means they have limited commercial availability . The processors which Intel won ’ t be patching Vulnerability-related.PatchVulnerability include four lines from 2007 , Penryn , Yorkfield , and Wolfdale , along with Bloomfield ( 2009 ) , Clarksfield ( 2009 ) , Jasper Forest ( 2010 ) and the Intel Atom SoFIA processors from 2015 . According to Tom ’ s Hardware , Intel ’ s decision not to patch Vulnerability-related.PatchVulnerability these products could stem from the relative difficulty of patching Vulnerability-related.PatchVulnerability the Spectre exploit on older systems . “ After a comprehensive investigation of the microarchitectures and microcode capabilities for these products , Intel has determined to not release Vulnerability-related.PatchVulnerability microcode updates for these products , ” Intel said . Because of the nature of the Spectre exploit , patches for it need to be delivered Vulnerability-related.PatchVulnerability as an operating system or BIOS update , and if Microsoft and motherboard OEMs aren ’ t going to distribute Vulnerability-related.PatchVulnerability the patches , developing Vulnerability-related.PatchVulnerability them isn ’ t much of a priority . “ However , the real reason Intel gave up on patching Vulnerability-related.PatchVulnerability these systems seems to be that neither motherboard makers nor Microsoft may be willing to update Vulnerability-related.PatchVulnerability systems sold a decade ago , ” Tom ’ s Hardware reports . It sounds bad , but as Intel pointed out , these are all relatively old processors — with the exception of the Intel Atom SoFIA processor , which came out in 2015 — and it ’ s unlikely they ’ re used in any high-security environments . The Spectre exploit is a serious security vulnerability to be sure , but as some commentators have pointed out in recent months , it ’ s not the kind of exploit the average user needs to worry about . “ We ’ ve now completed release Vulnerability-related.PatchVulnerability of microcode updates for Intel microprocessor products launched in the last 9+ years that required protection against the side-channel vulnerabilities discovered Vulnerability-related.DiscoverVulnerability by Google Project Zero , ” said an Intel spokseperson . “ However , as indicated in our latest microcode revision guidance , we will not be providing Vulnerability-related.PatchVulnerability updated microcode for a select number of older platforms for several reasons , including limited ecosystem support and customer feedback. ” If you have an old Penryn processor toiling away in an office PC somewhere , you ’ re probably more at risk for a malware infection arising from a bad download than you are susceptible to something as technically sophisticated as the Spectre or Meltdown vulnerabilities .

Microsoft 's patches for the Meltdown vulnerability have had a fatal flaw all these past months , according to Alex Ionescu , a security researcher with cyber-security firm Crowdstrike . Only patches for Windows 10 versions were affected Vulnerability-related.DiscoverVulnerability , the researcher wrote today in a tweet . Microsoft quietly fixed Vulnerability-related.PatchVulnerability the issue on Windows 10 Redstone 4 ( v1803 ) , also known as the April 2018 Update , released Vulnerability-related.PatchVulnerability on Monday . `` Welp , it turns out Vulnerability-related.PatchVulnerability the Meltdown patches for Windows 10 had a fatal flaw : calling NtCallEnclave returned back to user space with the full kernel page table directory , completely undermining the mitigation , '' Ionescu wrote . Microsoft issued Vulnerability-related.PatchVulnerability today an security update , but it was n't to backport the `` fixed '' Meltdown patches for older Windows 10 versions . Instead , the emergency update fixed Vulnerability-related.PatchVulnerability a vulnerability in the Windows Host Compute Service Shim ( hcsshim ) library ( CVE-2018-8115 ) that allows an attacker to remotely execute code on vulnerable systems . Microsoft classified Vulnerability-related.DiscoverVulnerability CVE-2018-8115 as a `` critical '' issues . A patched hcsshim file is available Vulnerability-related.PatchVulnerability for download from GitHub . `` We are aware and are working to provide Vulnerability-related.PatchVulnerability customers with an update , '' a Microsoft spokesperson told Bleeping Computer today in an email . It may be that if Microsoft does n't bundle these fixes in an out-of-band update , they will most likely arrive Vulnerability-related.PatchVulnerability in Microsoft 's May 2018 Patch Tuesday , but this is only our speculation . Microsoft released Vulnerability-related.PatchVulnerability its Meltdown and Spectre patches on January 4 , a day after security researchers disclosed Vulnerability-related.DiscoverVulnerability the two flaws , vulnerabilities that allow attackers to retrieve data from protected areas of modern CPUs . The Redmond-based OS maker has had a hard time patching Vulnerability-related.PatchVulnerability the two flaws , and the company recently issued Vulnerability-related.PatchVulnerability additional security updates to fix Vulnerability-related.PatchVulnerability the original Spectre mitigations , and also deliver Vulnerability-related.PatchVulnerability Intel CPU microcode updates , as a favor to Intel .

LONDON — The U.K. agency tasked with fighting cyberthreats on Thursday announced a new process for the public disclosure Vulnerability-related.DiscoverVulnerability of potentially sensitive software flaws , introducing a new level of transparency to its work . The National Cyber Security Centre laid out its new procedure , called the `` Equities Process '' in a blog post that details how it makes decisions on whether to make public Vulnerability-related.DiscoverVulnerability the discovery of new flaws . National security operations sometimes hold back from announcing Vulnerability-related.DiscoverVulnerability the discovery of security flaws in part because the bugs can be used to gather intelligence . “ There ’ s got to be a good reason not to disclose , ” said Ian Levy , technical director at the NCSC . The default position , the NCSC said , is to disclose Vulnerability-related.DiscoverVulnerability those vulnerabilities to the public after fixes have been made Vulnerability-related.PatchVulnerability . The government will only keep them confidential in rare instances , such as if there ’ s an overriding intelligence reason . Levy said withholding release of a bug will require high-level government sign-off . The goal is to prevent cyberattacks Attack.Ransom like “ WannaCry , ” which paralyzed computer systems around the world in May 2017 . The attack , which the U.S. has blamed on North Korea , wrought havoc within the U.K. ’ s National Health Service ( NHS ) by exploiting vulnerabilities in an outdated version of Microsoft Windows . WannaCry underscored the dangers of not patching Vulnerability-related.PatchVulnerability or updating Vulnerability-related.PatchVulnerability software . The NCSC ’ s disclosure policy follows one implemented by the White House in 2017 . The National Security Agency ( NSA ) had come under intense pressure from transparency advocates to disclose more about its work in the wake of WannaCry . “ The best defense against a cyberattack , whether it ’ s by criminals or nation states , is to keep your box up to date , ” said Levy . “ If you patch Vulnerability-related.PatchVulnerability your software , a lot of the stuff that we ’ ve found goes away. ” The vast majority of attacks are carried out by exploiting vulnerabilities already known to the vendors of the technology in question , Levy said . Such was the case when Russian cyberoperatives hacked into British telecoms companies in 2017 . Levy said the primary goal of more transparency is to “ bang the drum ” about basic cybersecurity , like patching Vulnerability-related.PatchVulnerability and secure network setups .

LONDON — The U.K. agency tasked with fighting cyberthreats on Thursday announced a new process for the public disclosure Vulnerability-related.DiscoverVulnerability of potentially sensitive software flaws , introducing a new level of transparency to its work . The National Cyber Security Centre laid out its new procedure , called the `` Equities Process '' in a blog post that details how it makes decisions on whether to make public Vulnerability-related.DiscoverVulnerability the discovery of new flaws . National security operations sometimes hold back from announcing Vulnerability-related.DiscoverVulnerability the discovery of security flaws in part because the bugs can be used to gather intelligence . “ There ’ s got to be a good reason not to disclose , ” said Ian Levy , technical director at the NCSC . The default position , the NCSC said , is to disclose Vulnerability-related.DiscoverVulnerability those vulnerabilities to the public after fixes have been made Vulnerability-related.PatchVulnerability . The government will only keep them confidential in rare instances , such as if there ’ s an overriding intelligence reason . Levy said withholding release of a bug will require high-level government sign-off . The goal is to prevent cyberattacks Attack.Ransom like “ WannaCry , ” which paralyzed computer systems around the world in May 2017 . The attack , which the U.S. has blamed on North Korea , wrought havoc within the U.K. ’ s National Health Service ( NHS ) by exploiting vulnerabilities in an outdated version of Microsoft Windows . WannaCry underscored the dangers of not patching Vulnerability-related.PatchVulnerability or updating Vulnerability-related.PatchVulnerability software . The NCSC ’ s disclosure policy follows one implemented by the White House in 2017 . The National Security Agency ( NSA ) had come under intense pressure from transparency advocates to disclose more about its work in the wake of WannaCry . “ The best defense against a cyberattack , whether it ’ s by criminals or nation states , is to keep your box up to date , ” said Levy . “ If you patch Vulnerability-related.PatchVulnerability your software , a lot of the stuff that we ’ ve found goes away. ” The vast majority of attacks are carried out by exploiting vulnerabilities already known to the vendors of the technology in question , Levy said . Such was the case when Russian cyberoperatives hacked into British telecoms companies in 2017 . Levy said the primary goal of more transparency is to “ bang the drum ” about basic cybersecurity , like patching Vulnerability-related.PatchVulnerability and secure network setups .

If you ’ re a BMW owner , prepare to patch ! Chinese researchers have found Vulnerability-related.DiscoverVulnerability 14 security vulnerabilities affecting Vulnerability-related.DiscoverVulnerability many models . The ranges affected Vulnerability-related.DiscoverVulnerability ( some as far back as 2012 ) are the BMW i Series , X Series , 3 Series , 5 Series and 7 Series , with a total of seven rated serious enough to be assigned CVE Vulnerability-related.DiscoverVulnerability numbers . The vulnerabilities are in in the Telematics Control Unit ( TCU ) , the Central Gateway Module , and Head Unit , across a range of interfaces including via GSM , BMW Remote Service , BMW ConnectedDrive , Remote Diagnosis , NGTP , Bluetooth , and the USB/OBD-II interfaces . Some require local access ( e.g . via USB ) to exploit but six including the Bluetooth flaw were accessible remotely , making them the most serious . Should owners worry that the flaws could be exploited Vulnerability-related.DiscoverVulnerability , endangering drivers and vehicles ? On the basis of the technical description , that seems unlikely , although Keen Lab won ’ t release the full proof-of-concept code until 2019 . Keen Lab described the effect of its hacking as allowing it to carry out : The execution of arbitrary , unauthorized diagnostic requests of BMW in-car systems remotely . To which BMW responded : BMW Group has already implemented security measures , which are currently being rolled out via over-the-air configuration updates . Additional security enhancements for the affected infotainment systems are being developed Vulnerability-related.PatchVulnerability and will be available Vulnerability-related.PatchVulnerability as software updates for customers . In other words , some fixes have already been made Vulnerability-related.PatchVulnerability , while others will be made Vulnerability-related.PatchVulnerability between now and early 2019 , potentially requiring a trip to a service centre . Full marks to BMW for promptly responding to the research but the press release issued Vulnerability-related.PatchVulnerability in its wake reads like PR spin . To most outsiders , this is a case of Chinese white hats finding Vulnerability-related.DiscoverVulnerability vulnerabilities in BMW ’ s in-car systems . To BMW , judging by the triumphant language of its press release , it ’ s as if this was the plan all along , right down to awarding Keen Lab the “ first-ever BMW Group Digitalization and IT Research Award. ” More likely , car makers are being caught out by the attention their in-car systems are getting from researchers , with Volkswagen Audi Group experiencing some of the same discomfort a couple of weeks ago at the hands of Dutch researchers . BMW has experienced this before too – three years ago it suffered Vulnerability-related.DiscoverVulnerability an embarrassing security flaw in its car ConnectedDrive software door-locking systems . Let ’ s not feel too sorry for the car makers because it ’ s the owners who face the biggest adjustment to their expectations – software flaws and patching Vulnerability-related.PatchVulnerability are no longer just for computers .

Another critical security hole has been found Vulnerability-related.DiscoverVulnerability in Apache Struts 2 , requiring an immediate update . The vulnerability – CVE-2018-11776 – affects Vulnerability-related.DiscoverVulnerability core code and allows miscreants to pull off remote code execution against vulnerable servers and websites . It affects Vulnerability-related.DiscoverVulnerability all versions of Struts 2 , the popular open-source framework for Java web apps . The Apache Software Foundation has `` urgently advised '' anyone using Struts to update Vulnerability-related.PatchVulnerability to the latest version immediately , noting that the last time a critical hole was found Vulnerability-related.DiscoverVulnerability , the holes were being exploited Vulnerability-related.DiscoverVulnerability in the wild just a day later . In other words , if you delay in patching Vulnerability-related.PatchVulnerability , your organization will be compromised in short order via this bug , if you are running vulnerable systems . It was that earlier flaw that led to a nightmare data breach Attack.Databreach from credit company Equifax after it failed to patch Vulnerability-related.PatchVulnerability swiftly enough . The details of nearly 150 million people were exposed Attack.Databreach , costing the company more than $ 600m , so this is not something to be taken lightly . The company that discovered Vulnerability-related.DiscoverVulnerability the vulnerability – Semmle Security Research Team – warns that this latest one is actually worse that the one last year , which it also found Vulnerability-related.DiscoverVulnerability . It has published a blog post with more information . Semmle found Vulnerability-related.DiscoverVulnerability the hole back in April and reported Vulnerability-related.DiscoverVulnerability it to Apache , which put out Vulnerability-related.PatchVulnerability a patch in June that it has now pulled Vulnerability-related.PatchVulnerability into formal updates ( 2.3.35 for those using version 2.3 and 2.5.17 for those on 2.5 ) . As mentioned , the vulnerability is in the core code and does n't require additional plugins to work . It is caused by insufficient validation of untrusted user data in the core of the Struts framework , and can be exploited in several different ways . Semmle says it has identified two different vectors but warns there may be others . Since it can be used remotely and due to the fact that Struts is typically used to create applications that are on the public internet , hackers are going to be especially focused on exploiting it so they can gain access to corporate networks . And there are some big targets out there : Apache Struts is extremely common with most large corporations using it somewhere in their systems for web apps . Semmle 's VP of engineering , Pavel Avgustinov , had this to say about the hole on Wednesday this week : `` Critical remote code execution vulnerabilities like the one that affected Vulnerability-related.DiscoverVulnerability Equifax and the one we announced today are incredibly dangerous for several reasons : Struts is used for publicly-accessible customer-facing websites , vulnerable systems are easily identified , and the flaw is easy to exploit Vulnerability-related.DiscoverVulnerability . A hacker can find their way in within minutes , and exfiltrate Attack.Databreach data or stage further attacks from the compromised system . It ’ s crucially important to update affected systems immediately ; to wait is to take an irresponsible risk . '' This is very far from the first time that big security holes have been found Vulnerability-related.DiscoverVulnerability in Struts , leading some to recommend that people simply stop using it .

Intel ’ s newly announced 9-series CPUs bring a lot of exciting new features to the table , including higher clock speeds and the promise of greater gaming performance . But arguably one of the most important factors is in security . These chips are the first generation of new desktop CPUs to come with Vulnerability-related.PatchVulnerability hardware fixes for the Spectre and Meltdown bugs which emerged in recent years . In particular , it ’ s the new K-series of gaming CPUs that are receiving Vulnerability-related.PatchVulnerability the fix . Those chips come with changes at the hardware level and should be far more secure against the kind of attacks that Spectre and its ilk have brought to light in recent years . Although they are still based on the same 14nm node that has dominated Intel ’ s chip designs since 2014 , these would be the first ones to come with Vulnerability-related.PatchVulnerability a fix for these sorts of bugs at the hardware level . The second set of new 9th-gen chips , the X-series ( and Xeon-class chips ) , don’t have Vulnerability-related.PatchVulnerability those same security fixes . Because they ’ re based on the older Skylake-X architecture , Intel is relying solely on software updates to keep them protected against Vulnerability-related.PatchVulnerability these possible vulnerabilities . News of the fixes were shared at Intel ’ s recent desktop press event , where it stated that , “ the new desktop processors include protections for the security vulnerabilities commonly referred to as ‘ Spectre , ’ ‘ Meltdown , ’ and ‘ L1TF. ’ These protections include a combination of the hardware design changes we announced earlier this year as well as software and microcode updates. ” The hardware alterations made to the chips protect against Meltdown V3 , otherwise known as the rogue data cache load bug . The L1 terminal fault exploit was also shored up with hardware changes . Software and microcode changes protect those same chips against the Spectre V2 branch target injection bug , the Meltdown V3 , a rogue system register read , and the variant V4 speculative store bypass flaw . In the laptop world , Intel has had a similar approach toward making hardware-level fixes . Some , but not all , have implemented hardware protections . Intel has been criticized in the past for the way it has handled these potentially critical flaws and has had a relatively slow move toward patching Vulnerability-related.PatchVulnerability the vulnerabilities on a hardware level throughout 2018 .

Adobe has patched Vulnerability-related.PatchVulnerability 87 vulnerabilities for Acrobat and Reader in its December Patch Tuesday update , including a slew of critical flaws that would allow arbitrary code-execution . The scheduled update comes less than a week after Adobe released Vulnerability-related.PatchVulnerability several out-of-band fixes for Flash Player , including a critical vulnerability ( CVE-2018-15982 ) that it said is being exploited Vulnerability-related.DiscoverVulnerability in the wild . That ’ s a use-after-free flaw enabling arbitrary code-execution in Flash . The addressed critical vulnerabilities are myriad this month . The arbitrary code-execution problems include : two buffer errors ; two untrusted pointer dereference glitches ; three heap-overflow issues , five out-of-bounds write flaws , 24 use-after-free bugs . Adobe also patched Vulnerability-related.PatchVulnerability three other critical-rated issues that could lead to privilege escalation ; these are all security bypass problems . In addition to the critical bugs , Adobe also patched Vulnerability-related.PatchVulnerability 43 out-of-bounds read flaws , four integer overflow problems and two security bypass issues , all of which could allow information disclosure . Adobe has characterized all of the flaws , both critical and important , as “ priority two ” for patching Vulnerability-related.PatchVulnerability , which means that the software giant deems them to be unlikely to be imminently exploited Vulnerability-related.DiscoverVulnerability in the wild , but patching Vulnerability-related.PatchVulnerability within 30 days is recommended . The flaws are far-reaching and affect Vulnerability-related.DiscoverVulnerability various implementations of Acrobat DC , Acrobat Reader DC , Acrobat 2017 and Acrobat Reader 2017 for macOS and Windows , in classic 2015 , classic 2017 and continuous-track versions . All can be mitigated by updating Vulnerability-related.PatchVulnerability to the most current versions of the software .

Adobe has patched Vulnerability-related.PatchVulnerability 87 vulnerabilities for Acrobat and Reader in its December Patch Tuesday update , including a slew of critical flaws that would allow arbitrary code-execution . The scheduled update comes less than a week after Adobe released Vulnerability-related.PatchVulnerability several out-of-band fixes for Flash Player , including a critical vulnerability ( CVE-2018-15982 ) that it said is being exploited Vulnerability-related.DiscoverVulnerability in the wild . That ’ s a use-after-free flaw enabling arbitrary code-execution in Flash . The addressed critical vulnerabilities are myriad this month . The arbitrary code-execution problems include : two buffer errors ; two untrusted pointer dereference glitches ; three heap-overflow issues , five out-of-bounds write flaws , 24 use-after-free bugs . Adobe also patched Vulnerability-related.PatchVulnerability three other critical-rated issues that could lead to privilege escalation ; these are all security bypass problems . In addition to the critical bugs , Adobe also patched Vulnerability-related.PatchVulnerability 43 out-of-bounds read flaws , four integer overflow problems and two security bypass issues , all of which could allow information disclosure . Adobe has characterized all of the flaws , both critical and important , as “ priority two ” for patching Vulnerability-related.PatchVulnerability , which means that the software giant deems them to be unlikely to be imminently exploited Vulnerability-related.DiscoverVulnerability in the wild , but patching Vulnerability-related.PatchVulnerability within 30 days is recommended . The flaws are far-reaching and affect Vulnerability-related.DiscoverVulnerability various implementations of Acrobat DC , Acrobat Reader DC , Acrobat 2017 and Acrobat Reader 2017 for macOS and Windows , in classic 2015 , classic 2017 and continuous-track versions . All can be mitigated by updating Vulnerability-related.PatchVulnerability to the most current versions of the software .

After scrambling to patch Vulnerability-related.PatchVulnerability a critical vulnerability late last month , Drupal is at it again . The open source content management project has issued Vulnerability-related.PatchVulnerability an unscheduled security update to augment its previous patch for Drupalgeddon2 . There was also a cross-site scripting bug advisory in mid-April . The latest Drupal core vulnerability , designated Vulnerability-related.DiscoverVulnerability , SA-CORE-2018-004 and assigned Vulnerability-related.DiscoverVulnerability CVE-2018-7602 , is related to the March SA-CORE-2018-002 flaw ( CVE-2018-7600 ) , according to the Drupal security team . It can be exploited Vulnerability-related.DiscoverVulnerability to take over a website 's server , and allow miscreants to steal information or alter pages . `` It is a remote code execution vulnerability , '' explained a member of the Drupal security team in an email to The Register . `` No more technical details beyond that are available . '' The vulnerability affects Vulnerability-related.DiscoverVulnerability at least Drupal 7.x and Drupal 8.x . And a similar issue has been found Vulnerability-related.DiscoverVulnerability in the Drupal Media module . In a blog post from earlier this month about the March patch , Dries Buytaert , founder of the Drupal project , observed Vulnerability-related.DiscoverVulnerability that all software has security issues and critical security bugs are rare . While the March bug is being actively exploited Vulnerability-related.DiscoverVulnerability , the Drupal security team says it 's unaware of any exploitation of the latest vulnerability . But it wo n't be long – those maintaining the project observed automated attacks appearing about two weeks after the SA-CORE-2018-002 notice . The fix is to upgrade Vulnerability-related.PatchVulnerability to the most recent version of Drupal 7 or 8 core . The latest code can be found at Drupal 's website . For those running 7.x , that means upgrading to Drupal 7.59 . For those running , 8.5.x , the latest version if 8.5.3 . And for those still on 8.4.x , there 's an upgrade to 8.4.8 , despite the fact that as an unsupported minor release , the 8.4.x line would not normally get Vulnerability-related.PatchVulnerability security updates . And finally , if you 're still on Drupal 6 , which is no longer officially supported , unofficial patches are being developed Vulnerability-related.PatchVulnerability here . Drupal users appear to be taking the release in stride , though with a bit of grumbling . `` Drupal Wednesday looks like the new Windows patch day , '' quipped designer Tom Binroth via Twitter . `` I would rather spend my time on creating new stuff than patching Vulnerability-related.PatchVulnerability Drupal core sites . ''

Google 's Project Zero has again called Apple out for silently patching Vulnerability-related.PatchVulnerability flaws . Apple has secretly patched Vulnerability-related.PatchVulnerability a bunch of high-severity bugs reported Vulnerability-related.DiscoverVulnerability to it by Google 's Project Zero researchers . The move has resulted in Google 's Project Zero once again calling Apple out for fixing Vulnerability-related.PatchVulnerability iOS and macOS security flaws without documenting them in public security advisories . While it 's good news that Apple beat Project Zero 's 90-day deadline for patching Vulnerability-related.PatchVulnerability or disclosing Vulnerability-related.DiscoverVulnerability the bugs it finds Vulnerability-related.DiscoverVulnerability , the group 's Ivan Fratric recently argued that the practice endangered users by not fully informing them why an update should be installed . This time the criticism comes from Project Zero 's Ian Beer , who 's been credited by Apple with finding Vulnerability-related.DiscoverVulnerability dozens of serious security flaws in iOS and macOS over the years . Beer posted Vulnerability-related.DiscoverVulnerability a blog about several vulnerabilities in iOS 7 he found Vulnerability-related.DiscoverVulnerability in 2014 that share commonalities with several bugs he has found Vulnerability-related.DiscoverVulnerability in iOS 11.4.1 , some of which he 's now released exploits for . Beer notes Vulnerability-related.DiscoverVulnerability that none of the latest issues is mentioned in the iOS 12 security bulletin even though Apple did fix Vulnerability-related.PatchVulnerability them . The absence of information about them is a `` disincentive '' for iOS users to patch Vulnerability-related.PatchVulnerability , Beer argues . `` Apple are still yet to assign CVEs Vulnerability-related.DiscoverVulnerability for these issues or publicly acknowledge that they were fixed Vulnerability-related.PatchVulnerability in iOS 12 , '' wrote Beer . `` In my opinion a security bulletin should mention the security bugs that were fixed Vulnerability-related.PatchVulnerability . Not doing so provides a disincentive for people to update Vulnerability-related.PatchVulnerability their devices since it appears that there were fewer security fixes than there really were . '' In other instances , such as one macOS bug Beer reported Vulnerability-related.DiscoverVulnerability , Apple did actually assign a CVE Vulnerability-related.DiscoverVulnerability , but it still hasn't updated Vulnerability-related.PatchVulnerability the relevant security bulletin to reflect the fix . Apple similarly allocated Vulnerability-related.DiscoverVulnerability CVE-2018-4337 to another high-severity iOS bug , which was fixed Vulnerability-related.PatchVulnerability in iOS 12 , but is n't currently acknowledged Vulnerability-related.DiscoverVulnerability in the iOS 12 security bulletin . In another case , Apple fixed Vulnerability-related.PatchVulnerability a bug that affected Vulnerability-related.DiscoverVulnerability iOS and macOS but didn't assign Vulnerability-related.DiscoverVulnerability a CVE or mention it in the security bulletins . Not only may it be a disincentive for end-users to patch Vulnerability-related.PatchVulnerability iPhones and Macs , but Beer also points out Vulnerability-related.DiscoverVulnerability in another bug report that the lack of public acknowledgement Vulnerability-related.DiscoverVulnerability by Apple means he has no way of knowing whether the issue is a duplicate that another researcher may have already found Vulnerability-related.DiscoverVulnerability . As he notes Vulnerability-related.DiscoverVulnerability in the blog , many of the bugs he has found Vulnerability-related.DiscoverVulnerability in iOS are very similar or the same as bugs found Vulnerability-related.DiscoverVulnerability by noted jailbreaking hackers Pangu Team .

Google 's Project Zero has again called Apple out for silently patching Vulnerability-related.PatchVulnerability flaws . Apple has secretly patched Vulnerability-related.PatchVulnerability a bunch of high-severity bugs reported Vulnerability-related.DiscoverVulnerability to it by Google 's Project Zero researchers . The move has resulted in Google 's Project Zero once again calling Apple out for fixing Vulnerability-related.PatchVulnerability iOS and macOS security flaws without documenting them in public security advisories . While it 's good news that Apple beat Project Zero 's 90-day deadline for patching Vulnerability-related.PatchVulnerability or disclosing Vulnerability-related.DiscoverVulnerability the bugs it finds Vulnerability-related.DiscoverVulnerability , the group 's Ivan Fratric recently argued that the practice endangered users by not fully informing them why an update should be installed . This time the criticism comes from Project Zero 's Ian Beer , who 's been credited by Apple with finding Vulnerability-related.DiscoverVulnerability dozens of serious security flaws in iOS and macOS over the years . Beer posted Vulnerability-related.DiscoverVulnerability a blog about several vulnerabilities in iOS 7 he found Vulnerability-related.DiscoverVulnerability in 2014 that share commonalities with several bugs he has found Vulnerability-related.DiscoverVulnerability in iOS 11.4.1 , some of which he 's now released exploits for . Beer notes Vulnerability-related.DiscoverVulnerability that none of the latest issues is mentioned in the iOS 12 security bulletin even though Apple did fix Vulnerability-related.PatchVulnerability them . The absence of information about them is a `` disincentive '' for iOS users to patch Vulnerability-related.PatchVulnerability , Beer argues . `` Apple are still yet to assign CVEs Vulnerability-related.DiscoverVulnerability for these issues or publicly acknowledge that they were fixed Vulnerability-related.PatchVulnerability in iOS 12 , '' wrote Beer . `` In my opinion a security bulletin should mention the security bugs that were fixed Vulnerability-related.PatchVulnerability . Not doing so provides a disincentive for people to update Vulnerability-related.PatchVulnerability their devices since it appears that there were fewer security fixes than there really were . '' In other instances , such as one macOS bug Beer reported Vulnerability-related.DiscoverVulnerability , Apple did actually assign a CVE Vulnerability-related.DiscoverVulnerability , but it still hasn't updated Vulnerability-related.PatchVulnerability the relevant security bulletin to reflect the fix . Apple similarly allocated Vulnerability-related.DiscoverVulnerability CVE-2018-4337 to another high-severity iOS bug , which was fixed Vulnerability-related.PatchVulnerability in iOS 12 , but is n't currently acknowledged Vulnerability-related.DiscoverVulnerability in the iOS 12 security bulletin . In another case , Apple fixed Vulnerability-related.PatchVulnerability a bug that affected Vulnerability-related.DiscoverVulnerability iOS and macOS but didn't assign Vulnerability-related.DiscoverVulnerability a CVE or mention it in the security bulletins . Not only may it be a disincentive for end-users to patch Vulnerability-related.PatchVulnerability iPhones and Macs , but Beer also points out Vulnerability-related.DiscoverVulnerability in another bug report that the lack of public acknowledgement Vulnerability-related.DiscoverVulnerability by Apple means he has no way of knowing whether the issue is a duplicate that another researcher may have already found Vulnerability-related.DiscoverVulnerability . As he notes Vulnerability-related.DiscoverVulnerability in the blog , many of the bugs he has found Vulnerability-related.DiscoverVulnerability in iOS are very similar or the same as bugs found Vulnerability-related.DiscoverVulnerability by noted jailbreaking hackers Pangu Team .

Update , Cisco will take a second crack at addressing Vulnerability-related.PatchVulnerability a vulnerability in WebEx that can be exploited Vulnerability-related.DiscoverVulnerability to execute malicious code on a vulnerable installation . Switchzilla has issued Vulnerability-related.PatchVulnerability a new fix to address Vulnerability-related.PatchVulnerability CVE-2018-15442 , a command injection bug in its video conference software that allows a local attacker to their elevate privileges , and then execute code by injecting commands through the software update component of the WebEx Meetings Client . The bug was traced back to the failure by Webex Meetings to properly check arguments passed via its update service commands . Thus a miscreant could run an update command with specially crafted arguments to ultimately execute code with system privileges . This means rogue logged-in users or malware on a Windows system could leverage WebEx to completely hijack the machine . Cisco had hoped to plug Vulnerability-related.PatchVulnerability the vulnerability in October with a patch that was thought to have resolved Vulnerability-related.PatchVulnerability the flaw . However , software-breakers at SecureAuth found that Switchzilla failed to account for DLL preloading . By sticking the malicious commands inside a DLL file and then executing the update program with that library loaded , an attacker would be able to circumvent the patch and then exploit Vulnerability-related.DiscoverVulnerability the flaw as before to execute commands with system-level clearance . `` The vulnerability can be exploited Vulnerability-related.DiscoverVulnerability by copying to an a local attacker controller folder , the ptUpdate.exe binary . Also , a malicious dll must be placed in the same folder , named wbxtrace.dll , '' SecureAuth explained in its disclosure today . `` To gain privileges , the attacker must start the service with the command line : '' Fortunately , the flaw was privately disclosed Vulnerability-related.DiscoverVulnerability to Cisco , giving the teleconferencing vendor time to get out Vulnerability-related.PatchVulnerability a fix prior to this bug going public . Those running Webex Meetings on their Windows machines should update as soon as possible . While the flaw is n't as severe as a remote code bug that could be exploited Vulnerability-related.DiscoverVulnerability without any user interaction , the fact it has now been patched Vulnerability-related.PatchVulnerability twice and has working proof-of-concept code public should make patching Vulnerability-related.PatchVulnerability a priority .

A Google Project Zero researcher has published a macOS exploit to demonstrate that Apple is exposing its users to security risks by patching Vulnerability-related.PatchVulnerability serious flaws in iOS but not revealing the fact until it fixes Vulnerability-related.PatchVulnerability the same bugs in macOS a week later . This happened during Apple 's update Vulnerability-related.PatchVulnerability for critical flaws in iOS 12 , tvOS 12 and Safari 12 on September 17 . A Wayback Machine snapshot of the original advisory does n't mention Vulnerability-related.DiscoverVulnerability any of the bugs that Project Zero researcher Ivan Fratric had reported Vulnerability-related.DiscoverVulnerability to Apple , and which were actually fixed Vulnerability-related.PatchVulnerability . Then , a week later , after Apple patched Vulnerability-related.PatchVulnerability the same bugs in macOS , the company updated Vulnerability-related.PatchVulnerability its original advisory with details about the nine flaws that Fratric had reported Vulnerability-related.DiscoverVulnerability , six of which affected Vulnerability-related.DiscoverVulnerability Safari . The update fixed Vulnerability-related.PatchVulnerability a Safari bug that allowed arbitrary code execution on macOS if a vulnerable version of Safari browsed to a website hosting an exploit for the bugs . While Fratric concedes that Apple is probably concealing Vulnerability-related.PatchVulnerability the fix in iOS to buy time to patch Vulnerability-related.PatchVulnerability macOS , he argues the end result is that people may ignore an important security update because they were n't properly informed by Apple in the security advisory . `` This practice is misleading because customers interested in the Apple security advisories would most likely read them only once , when they are first released and the impression they would get is that the product updates fix far fewer vulnerabilities and less severe vulnerabilities than is actually the case . '' Even worse , a skilled attacker could use the update for iOS to reverse-engineer a patch , develop an exploit for macOS , and then deploy it against a macOS user-base that does n't have a patch . Users also do n't know that Apple has released information that could make their systems vulnerable to attack . Fratric developed an exploit for one of the Safari bugs he reported and published Vulnerability-related.DiscoverVulnerability the attack on Thursday . The bugs were all found Vulnerability-related.DiscoverVulnerability using a publicly available fuzzing tool he developed , called Domato , meaning anyone else , including highly advanced attackers , could use it too . `` If a public tool was able to find that many bugs , it is expected that private ones might be even more successful , '' he noted . He was n't aiming to write a reliable or sophisticated exploit , but the bug is useful enough for a skilled exploit writer to develop an attack to spread malware and `` potentially do a lot of damage even with an unreliable exploit '' . Fratric said he successfully tested the exploit on Mac OS 10.13.6 High Sierra , build version 17G65 . `` If you are still using this version , you might want to update , '' noted Fratric . On the upside , it appears Apple and its Safari WebKit team have improved the security of the browser compared with the results of Fratric 's Domato fuzzing efforts last year , which turned up way more bugs in Safari than in Chrome , Internet Explorer , and Edge . Last year he found Vulnerability-related.DiscoverVulnerability 17 Safari flaws using the fuzzing tool . His final word of warning is not to discount any of the bugs he found just because no one 's seen them being attacked in the wild . `` While it is easy to brush away such bugs as something we have n't seen actual attackers use , that does n't mean it 's not happening or that it could n't happen , '' the researcher noted .

Back in January 2013 , researchers from application security services firm DefenseCode unearthed Vulnerability-related.DiscoverVulnerability a remote root access vulnerability in the default installation of some Cisco Linksys ( now Belkin ) routers . The flaw was actually found Vulnerability-related.DiscoverVulnerability in Broadcom ’ s UPnP implementation used in popular routers , and ultimately the researchers extended Vulnerability-related.DiscoverVulnerability the list of vulnerable routers to encompass devices manufactured by the likes of ASUS , D-Link , Zyxel , US Robotics , TP-Link , Netgear , and others . “ Back in the days , Cisco fixed Vulnerability-related.PatchVulnerability the vulnerability , but we are not sure about all other router vendors and models because there are too many of them , ” the DefenseCode team noted . When DefenseCode first came out Vulnerability-related.DiscoverVulnerability with the vulnerability in 2013 , Rapid7 researchers also found Vulnerability-related.DiscoverVulnerability a number of flaws in other popular UPnP implementations , and by scanning the Internet , revealed Vulnerability-related.DiscoverVulnerability that there were approximately 15 million devices with a vulnerable Broadcom UPnP implementation . It ’ s difficult to tell how many of these devices are still vulnerable Vulnerability-related.DiscoverVulnerability but , as DefenseCode ’ s Leon Juranic pointed out to me , users rarely ( if ever ) update their router ’ s firmware , so there are bound to be still many of them . And given how many people have watched and analyzed their technical video of the exploit in action over the years , obviously many are interested in it . Still , I think we can all agree , four years is more than enough time for patching Vulnerability-related.PatchVulnerability , and nobody can fault them for publishing the exploit . Hopefully , if there are manufacturers that still haven ’ t pushed out Vulnerability-related.PatchVulnerability a patch they ’ ll do it now , but this is could also be a welcome impetus for users to update their router ’ s firmware – especially those that haven ’ t done it for years . Whitepapers and offers