Covers: Vulnerabilities & PatchingGovernance, Risk & ComplianceCloud SecurityData BreachesAI SecurityThreat Actors & Nation-StateSupply Chain & AppSecDetection & ResponseZero-Days & ExploitsEndpoint & Network Security
Qualys introduced Qualys VMDR with Qualys TruRisk, which prioritizes vulnerabilities, assets, and asset groups by the actual risk they pose rather than by CVSS score. Qualys says this lets organizations focus on up to 85% fewer critical vulnerabilities,...
Empire is an open-source post-exploitation framework first released in 2015 whose original GitHub repository has been archived, though forks such as BC-SECURITY's continue active development with hundreds of modules, RATs in multiple languages, and...
Microsoft released 98 new patches for January 2023, 11 rated critical and 87 rated important, covering Windows, Office, Exchange Server, .NET Core, Visual Studio Code, Azure Service Fabric Container, Windows Defender, and BitLocker. One vulnerability was...
Qualys states its Policy Compliance product covers 850 policies, 19,000 controls, 350 technologies, and 100 frameworks, and that it supports more CIS benchmarks than Tenable, Rapid7, Tripwire, and Tanium. The post cites ransomware attack data showing RDP...
A ransomware campaign tracked as ESXiArgs targeted VMware ESXi hypervisors running versions 6.x and before 6.7, exploiting a heap-overflow vulnerability in OpenSLP tracked as CVE-2021-21974, with related flaws CVE-2020-3992 and CVE-2021-21974 in the SLP...
On February 1, 2023, Fortra released an advisory behind an auth wall notifying customers of a remote code execution zero-day in its GoAnywhere Managed File Transfer application, assigned CVE-2023-0669; version 7.1.2 fixing the flaw followed on February 7,...
Microsoft's March 2023 Patch Tuesday addressed 101 vulnerabilities, including 22 in Microsoft Edge (Chromium-based), with nine rated critical, 70 important, and one moderate. Two zero-days known to be exploited in the wild, CVE-2023-24880 and...
CISA's Ransomware Vulnerability Warning Pilot proactively identifies information systems carrying vulnerabilities commonly exploited by ransomware actors and notifies their owners so they can mitigate before an intrusion occurs. The program draws on...
The ACSC's Essential 8, first published in 2017 as an evolution of the Australian Signals Directorate's mitigation strategies, sets out eight security controls with four maturity levels, where ML 3 requirements rose from 29 to 69. The blog ties rising...
An IDC report, Worldwide Device Vulnerability Management Forecast, 2023–2027: Evolving Beyond Scanning, states that vulnerability scanning is evolving into vulnerability management that will integrate attack surface management and cybersecurity asset...
Qualys announced that its Cloud Platform and Cloud Agents now support Alibaba Cloud IaaS and PaaS deployments, collecting security, IT, and compliance data from assets such as virtual machines, web applications, and containers. The offering includes VMDR...
Microsoft's May 2023 Patch Tuesday addressed 49 vulnerabilities, six rated critical and 32 important, including two zero-days known to be exploited in the wild. The release also covered 11 vulnerabilities in Microsoft Edge (Chromium-based), with flaws...
President Biden's Executive Order 14028 made zero-trust architecture the guiding security model for the federal government, and federal civilian executive branch agencies are all tasked with creating and using one. According to the Office of Management and...
The public preview of CVSSv4 was announced on June 8, 2023, at the 35th Annual FIRST Conference in Montreal, introducing changes from CVSSv3.1 including a new optional Supplemental Metric Group, renaming of Temporal to Threat Metrics, retirement of the...
CISA released Binding Operational Directive 23-02, "Mitigating The Risk From Internet-Exposed Management Interfaces," on June 13, 2023, requiring agencies to inventory, identify, and manage digital assets and to act within 14 days of notification or...
On June 13, 2023, CISA released Binding Operational Directive 23-02, requiring federal civilian executive-branch agencies to take two primary actions to mitigate risk from internet-exposed management interfaces on devices such as routers, switches,...
Qualys reports that the National Vulnerability Database holds 206,000 vulnerabilities and counting, with 14,205 reported in 2023 alone, and that over 80% of high-risk CVEs carry a Network access vector and over 80% require no authentication to exploit. The...
Qualys reports that for CVEs disclosed in 2023, the average gap from NVD publication to inclusion in CISA's Known Exploited Vulnerabilities catalog was just eight days, with some vulnerabilities exploited almost instantly. The post also cites...
Qualys cites Experian data that 42% of consumers believe it is a company's responsibility to protect PII, and notes that 25% of the apps a consumer engages with collect their PII. The post states GDPR fines can reach up to 4% of global annual revenue, that...
Qualys outlines a three-part framework for cybersecurity metrics: tactical metrics for operational teams, strategic metrics for leadership, and metrics for technical debt tied to end-of-life and end-of-support hardware, software, and operating systems. The...
Qualys published a Top Twenty list of vulnerabilities targeted by threat actors, malware, and ransomware, drawn from sightings over recent years and the current year, with several entries also appearing in CISA's August 3, 2023 Joint Cybersecurity...
Qualys Threat Research Unit discovered a buffer overflow in glibc's dynamic loader when processing the GLIBC_TUNABLES environment variable, and exploited it to gain full root privileges on default installations of Fedora 37 and 38, Ubuntu 22.04 and 23.04,...
The curl project pre-announced version 8.4.0, released October 11, 2023, to fix two vulnerabilities: CVE-2023-38545, a high-severity flaw affecting both libcurl and the curl tool that maintainers called arguably the most critical security flaw in curl in...
Oracle released its fourth quarterly Critical Patch Update for 2023, covering 387 security vulnerabilities, with Oracle Financial Services Applications receiving the most at 103 patches (26% of the total), followed by Oracle Communications with 91 and...
Qualys published a walkthrough of crawl settings in its Web Application Scanning (WAS) product, describing four scope options: limit at or below the URL hostname, limit to a URL subdirectory, limit to the hostname plus a specified sub-domain, and limit to...
Qualys reports a 40% increase over the last five months in organizations adopting AI-driven vulnerability management solutions, which it says led to a 30% reduction in vulnerabilities. The company describes its TruRisk AI, built into its Enterprise TruRisk...
Qualys outlines how default scan settings in its Web Application Scanning tool are established when a web application is created and can be overridden at scan time, with option profiles acting as scan blueprints covering URL scope, specific tests (QIDs),...
Qualys' Threat Research Unit found that of 76,667 all-time weaponized vulnerabilities, only 270 are actively used in ransomware campaigns, and it estimates that 25% of assets still carry at least one open ransomware-related vulnerability. The same research...
Qualys published a walkthrough of the additional configuration options in its Web Application Scanning (WAS) tool, covering authentication records, header injection, API endpoint definition, exclusion lists, DNS overrides, redundant links, path fuzzing...
Qualys confirmed ongoing attacks in which criminals advertise work-from-home jobs on Facebook, pose as Qualys recruiters, and move victims into private messaging to hand over fake offer letters bearing logos, corporate addresses, and signature lines....