Threat Source newsletter (Sept. 16, 2021)
Summary: Cisco Talos reported tracking a series of trojans targeting the aviation industry, lured in through spam about flight itineraries and transportation news. Microsoft's September security update disclosed 86 vulnerabilities, headlined by a patch for the actively exploited MSHTML remote code execution flaw CVE-2021-40444, with proof-of-concept code now public.
What you should know: CVE-2021-40444 was already being exploited in the wild before a patch existed, and the release of proof-of-concept code widens the pool of attackers who can use it. Apple separately patched a zero-click flaw used to install Pegasus spyware, which researchers said could have left up to 1.65 billion Apple devices exposed since March.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-26435CVE-2021-36965CVE-2021-40444
- Related
- Microsoft Patch Tuesday, September 2021 Edition Cyber Risks ·CVE-2021-40444: Microsoft MSHTML Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021