Blog – Page 956 – Cyber Mike

Microsoft Uncovers macOS Vulnerability CVE-2024-44243 Allowing Rootkit Installation

Microsoft has shed light on a now-patched security flaw impacting Apple macOS that, if successfully exploited, could have allowed an attacker running as “root” to bypass the operating system’s System Integrity Protection (SIP) and install malicious kernel drivers by loading third-party kernel extensions.
The vulnerability in question is CVE-2024-44243 (CVSS score: 5.5), a medium-severity bug

Snyk Says ‘Malicious’ NPM Packages Part of Research Project

Apparently malicious NPM packages linked to Snyk raised some concerns, but the security firm clarified that it’s part of a research project.

The post Snyk Says ‘Malicious’ NPM Packages Part of Research Project appeared first on SecurityWeek.

Orchid Security Banks Hefty $36M Seed Round

New York identity management startup raises $36 million in an unusually large seed round co-led by Team8 and Intel Capital.

The post Orchid Security Banks Hefty $36M Seed Round appeared first on SecurityWeek.

Google OAuth Vulnerability Exposes Millions via Failed Startup Domains

New research has pulled back the curtain on a “deficiency” in Google’s “Sign in with Google” authentication flow that exploits a quirk in domain ownership to gain access to sensitive data.
“Google’s OAuth login doesn’t protect against someone purchasing a failed startup’s domain and using it to re-create email accounts for former employees,” Truffle Security co-founder and CEO Dylan Ayrey said

FBI wipes Chinese PlugX malware from over 4,000 US computers

The U.S. Department of Justice announced today that the FBI has deleted Chinese PlugX malware from over 4,200 computers in networks across the United States. […]

Hackers use FastHTTP in new high-speed Microsoft 365 password attacks

Threat actors are utilizing the FastHTTP Go library to launch high-speed brute-force password attacks targeting Microsoft 365 accounts globally. […]

Fortinet warns of auth bypass zero-day exploited to hijack firewalls

Attackers are exploiting a new authentication bypass zero-day vulnerability in FortiOS and FortiProxy to hijack Fortinet firewalls and breach enterprise networks. […]

Cyber Insights 2025: Cyber Threat Intelligence

Cyber threat intelligence can inform decisions but is a complex issue. Where it is complete and accurate it is a huge boon.

The post Cyber Insights 2025: Cyber Threat Intelligence appeared first on SecurityWeek.

Microsoft 365 apps crash on Windows Server after Office update

Microsoft says a known issue is causing Classic Outlook and Microsoft 365 applications to crash on Windows Server 2016 or Windows Server 2019 systems. […]

SAP Patches Critical Vulnerabilities in NetWeaver

SAP has released 14 security notes on January 2025 Patch Day, including two addressing critical vulnerabilities in NetWeaver.

The post SAP Patches Critical Vulnerabilities in NetWeaver appeared first on SecurityWeek.

Cyber News