Explaining Threats, Threat Actors, Vulnerabilities, and Risk Using a Real-World Scenario https://ift.tt/32LwDIN Casey Ellis (of Bugcrowd fame) had a great post on Twitter today about security terminology. Casey also added that Acceptable Risk would be being willing to get punched in the face. threat actor = someone who wants to punch you in the facethreat […]

CVE-2021-20226: A Reference-Counting Bug in the Linux Kernel io_uring Subsystem https://ift.tt/3dEjIyr In June 2020, we received a Linux kernel submission detailing a reference-counting bug in the recently introduced io_uring subsystem. The bug leads to a use-after-free on any file structure, which can be leveraged for privilege escalation in the kernel. This bug was submitted by […]

Take action! Multiple Pulse Secure VPN vulnerabilities exploited in the wild https://ift.tt/32yRE98 Pulse Secure has alerted customers to the existence of an exploitable chain of attack against its Pulse Connect Secure (PCS) appliances. PCS provides Virtual Private Network (VPN) facilities to businesses, which use them to prevent unauthorized access to their networks and services. Cybersecurity […]

Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day https://ift.tt/32udA5z Executive Summary Mandiant recently responded to multiple security incidents involving compromises of Pulse Secure VPN appliances. This blog post examines multiple, related techniques for bypassing single and multifactor authentication on Pulse Secure VPN devices, persisting across upgrades, and maintaining access […]