Google Chrome security advisory: Stable Channel Update for Desktop
New version 132.0.6834.110/111 for Windows, Mac and 132.0.6834.110 for Linux includes 3 security fixes, 2 were externally reported. CVE-2025-0611 (high severity) Object corruption in V8 and CVE-2025-0612 (high) Out of bounds memory access in V8. No mention of exploitation.

#google #chrome #chromium #vulnerability #cve #infosec #cybersecurity

“Clang will now more aggressively use undefined behavior on pointer addition overflow for optimization purposes.” https://github.com/llvm/llvm-project/commit/c2979c58d49b

A whole lot of non-exploitable bugs may become exploitable pretty soon.

Microsoft is getting ready to do away with MFA for its web-based products. No, this is not clickbait.

Beginning in February, if you log in to a web-based service, Microsoft will keep you logged in by default. Go ahead and close the browser window, it doesn’t matter. You’re still logged in, unless you deliberately log out. Think about hotel computers, library computers. Think about women in an abusive relationship.

It’s no longer MFA if Microsoft reduces authentication to device authentication. They won’t be requiring proof of identity of the person in front of the screen.

If you sign in to a Microsoft web-based app on a computer that is ACCESSED BY OTHER PEOPLE, you are at risk.

ACTION STEP
Even though Microsoft is placing the notification at the top of the screen right now, there are people you know who won’t understand what it means. There are people who won’t even notice the message. Make sure your friends and family know how to explicitly sign out after every session on a shared computer.

One last note: Microsoft says that instead of logging out you can use private browsing (for example, Google’s incognito mode). I don’t recommend this option, because sometimes software doesn’t behave quite like the coder thinks it will. For the most reliable security, log out.

#CallMeIfYouNeedMe #FIFONetworks

#cybersecurity #privacy

Here's a video overview of Venture, the cross-platform Windows Event Viewer. Version 0.2.0 now has the ability to join multiple .evtx files into a single view!

https://www.youtube.com/watch?v=LSobpAWwNV8

Grab Venture here: https://github.com/mttaggart/venture/releases/

"CrowdStrike, Fortinet Get Price Target Hikes Amid Booming Cybersecurity Market"

Clearly the Clownstrike "incident" doom is already behind, and Fortinet product security is irrelevant to stock price :X

Episode 8478 of how the internet works

Cisco Zero-Day: ClamAV OLE2 File Format Decryption Denial of Service Vulnerability
CVE-2025-20128 (5.3 medium) A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read.

The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerabilities that are described in this advisory.
The Cisco PSIRT is not aware of any malicious use of the vulnerabilities that are described in this advisory.

Two more Cisco security advisories:

• Cisco Meeting Management REST API Privilege Escalation Vulnerability CVE-2025-20156 (9.9 critical)
• Cisco BroadWorks SIP Denial of Service Vulnerability CVE-2025-20165 (7.5 high)

These two do not mention proof of concept or exploitation.

#cisco #vulnerability #cve #infosec #cybersecurity

You've heard of #PatchTuesday, now get ready for PatchEveryday: Elastic security advisories 22 January 2025:

• Fleet Server 8.15.0 Security Update (ESA-2024-31) CVE-2024-52975 (8.0 high) Fleet Server sensitive information exposure via logs
• Kibana 8.15.0 Security Update (ESA-2024-29, ESA-2024-30) CVE-2024-43710 (4.3 medium) Kibana server-side request forgery

No mention of exploitation.

#elastic #kibana #vulnerability #CVE #infosec #cybersecurity

Everything in this talk is open-source, from our algorithms to the very decompiler we made to handle these optimizations:
https://github.com/angr/angr-management
https://www.usenix.org/system/files/sec23winter-prepub-301-basque.pdf

Try it out, and come with fun questions about decompilation :).

South Korean VPN provider IPany was breached in a supply chain attack by the "PlushDaemon" China-aligned hacking group, who compromised the company's VPN installer to deploy the custom 'SlowStepper' malware.

https://www.bleepingcomputer.com/news/security/ipany-vpn-breached-in-supply-chain-attack-to-push-custom-malware/

Project: openssl-static-gcc-dwarf 3.4.0
File: openssl
Address: 006a55e0

tdes_wrap_cipher

SVG:
dark https://tmr232.github.io/function-graph-overview/render/?graph=https%3A%2F%2Fraw.githubusercontent.com%2Fv-p-b%2Fghidra-function-graph-datasets%2Frefs%2Fheads%2Fmain%2F%2Fopenssl-static-gcc-dwarf%2F006a55e0.json&colors=dark
light https://tmr232.github.io/function-graph-overview/render/?graph=https%3A%2F%2Fraw.githubusercontent.com%2Fv-p-b%2Fghidra-function-graph-datasets%2Frefs%2Fheads%2Fmain%2F%2Fopenssl-static-gcc-dwarf%2F006a55e0.json&colors=light

I just went through @drawio 's homepage so I can throw some money at them, but I just can't because disrupting unhealthy markets is its own reward it seems:

https://www.drawio.com/about

These people are pretty cool!

@timb_machine maybe it's for emergency remote technical support ;) ;)

It's flattering when your work appears in the news, I just wish this piece wasn't so terribly wrong on so many important details :P

I'll reshare the original instead: https://blog.silentsignal.eu/2025/01/21/ibm-acs-password-dump/

(If you want to pull your hair out: https://cybersecuritynews[.]com/ibm-i-access-client-vulnerability-exposed/)

@scottwilson With modern mobile UI's people no longer know what files are in the first place.

This article just blows me away. Students apparently don’t understand directory structure on computers •••at all•••!
#directories #folders #data #organization #students #search
https://www.theverge.com/22684730/students-file-folder-directory-structure-education-gen-z

CVE-2025-0395: Buffer overflow in the GNU C Library's assert()

https://seclists.org/oss-sec/2025/q1/48

Project: mpengine-x64-pdb 1.1.24090.11
File: mpengine.dll
Address: 75a1ff7cc

GetTrackingContextFromBase64String

SVG:
dark https://tmr232.github.io/function-graph-overview/render/?graph=https%3A%2F%2Fraw.githubusercontent.com%2Fv-p-b%2Fghidra-function-graph-datasets%2Frefs%2Fheads%2Fmain%2F%2Fmpengine-x64-pdb%2F75a1ff7cc.json&colors=dark
light https://tmr232.github.io/function-graph-overview/render/?graph=https%3A%2F%2Fraw.githubusercontent.com%2Fv-p-b%2Fghidra-function-graph-datasets%2Frefs%2Fheads%2Fmain%2F%2Fmpengine-x64-pdb%2F75a1ff7cc.json&colors=light

The new US administration has terminated the CSRB (who did the excellent Exchange Online hack review - Microsoft have a free pass now),

the CISA advisory panel,

Artificial Intelligence Safety and Security Board,

Critical Infrastructure Partnership Advisory Council,

National Security Telecommunications Advisory Committee,

National Infrastructure Advisory Council and

USSS Cyber Investigations Advisory Board

https://www.documentcloud.org/documents/25500093-dhs-advisory-boards-termination-letter/