RegreSSHion’ Bug Threatens Takeover of Millions of Linux Systems
A high-severity CVE-2024-6387 vulnerability in OpenSSH, known as ‘RegreSSHion,’ allows unauthenticated remote code execution on Linux systems, potentially leading to full system compromise. The bug, reintroduced from a 2006 flaw, affects glibc-based Linux systems and may exist in Mac and Windows environments. While challenging to exploit, the vulnerability demands a focused security approach, with researchers recommending upgrading to the latest OpenSSH version or applying available fixes to older versions to mitigate the risk.
Prudential Financial Says 2.5 Million Impacted by Data Breach
Prudential Financial disclosed a data breach affecting over 2.5 million individuals, with personal information compromised by cybercriminals in February 2024. The breach involved unauthorized access to administrative/user data and employee/contractor accounts, leading to the theft of names, driver’s license numbers, and non-driver identification card numbers. The ALPHV/Blackcat ransomware gang claimed responsibility for the attack, which is part of their cybercrime activities linked to over 60 breaches worldwide, including a $22 million ransom theft.
Over Six Million Hit by Ransomware Breach at Infosys McCamish Systems
A cyber-attack on Infosys McCamish Systems last year affected over six million customers, with unauthorized activity occurring between October 29, 2023, and November 2, 2023. The breach exposed sensitive information like Social Security Numbers, financial data, and biometric details. The company is offering credit monitoring to affected customers and the stolen data may be used for phishing and identity fraud attacks.
Australian Police Arrest Suspect in Fake Wi-Fi Scam Targeting Airport Passengers
The Australian Federal Police arrested a 42-year-old man for setting up fake free Wi-Fi access points at airports, known as ‘evil twin’ Wi-Fi devices, to capture personal data from unsuspecting victims. The man allegedly saved email and social media logins from victims, which could be used to access more personal information, including online communications and bank details. The AFP Cyber Expert recommended caution when connecting to public Wi-Fi networks, advising users to install a VPN, disable file sharing, avoid sensitive tasks like banking on free Wi-Fi, and forget networks after use.
HubSpot Warns of Ongoing Cyberattacks Targeting Customer Accounts
HubSpot is currently combating cyberattacks targeting customer accounts, with at least 50 accounts already compromised. The company is actively investigating, blocking attempts, and has contacted affected customers while revoking unauthorized access. HubSpot reassures that no new unauthorized access has been detected since June 28, 2024, and that the breach is limited to a small subset of customers.
Hundreds of Thousands Impacted in Children’s Hospital Cyberattack
Lurie Children’s Hospital in Chicago experienced a cyberattack compromising personal information of 791,000 patients, including sensitive medical data. The cybercriminals disrupted the hospital’s systems, affecting patient portal access and medical records. Despite not paying a ransom, the hospital is taking steps to inform affected individuals and provide identity protection services.
Juniper Rushes Out Emergency Patch for Critical Smart Router Flaw
Juniper Networks has issued an emergency patch for a critical authentication bypass vulnerability affecting Session Smart Routers, Conductors, and WAN Assurance Routers, with a CVSS score of 10. The flaw, identified as CVE-2024-2973, could allow threat actors to take full control of unpatched devices, although there is no evidence of exploitation in the wild. Juniper recommends immediate updates for affected devices, ensuring non-disruptive application of the fix to production traffic.
Shoezone UK Retail Chain Discloses Cyberattack, Data Compromised
UK retailer Shoe Zone has experienced a cyberattack resulting in unauthorized access to specific online systems and data. The company has engaged third-party consultants to investigate the breach, notified regulatory bodies such as the Information Commissioner’s Office (ICO) and the National Cyber Security Centre (NCSC), and continues to fulfill orders with minimal anticipated financial impact. Shoe Zone is committed to data security and will notify affected individuals as necessary to comply with applicable regulations.
Disclaimer: Titles and summaries are AI-generated. Please refer to the linked content for more details.