Flubbed key signing “ceremony” allowed minting of web credentials for any site. eMudhra, the certificate authority that issued eight intermediate TLS credentials so weak that anyone could mint certificates for any website or mail server—one had a private encryption key of just 4—said it’s getting out of the business.…
For 3 days this month, 333 exit nodes were hacked in hopes of stealing sensitive data. Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled, a researcher reported Tuesday. The hijacking began in…
Survey of 2,018 IT heads at big firms points to a lack of leverage. Enterprise-sized businesses spend, on average, 28 percent of their software budgets on unwanted upgrades, migrations, and licensing changes. Often, those firms’ IT heads think those changes are detrimental. Those results are according to a survey…
Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites. Website admins, brace yourselves. Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours for PHP, a programming language that powers websites and Web applications everywhere. PHP…
Intermediate certs allow anyone to mint web credentials for any Internet server. Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on…
Meta is suspending the sharing feature while it investigates its privacy. Muse, the new general-purpose AI agent from Meta, can expose sensitive information when users share conversations through web links, researchers reported Monday. In response to questions from Ars about the behavior, Meta said it’s suspending the sharing feature…
A researcher says attacks chaining 4 vulnerabilities is hacking unpatched boxes. Recently fixed vulnerabilities in the Plex Media Server are under active exploitation in attacks that, when successful, install malware, including cryptominers and residential proxy apps, a researcher said. Plex fixed four vulnerabilities at the start of last month.…
ReactOS gains NTFS install support with new driver. Open source Windows alternative ReactOS has reached a major milestone: The operating system can now be installed directly onto an NTFS drive partition. As reported by Phoronix, the move to NTFS clears a long-standing hurdle for the project and brings it…
The actions could have resulted in criminal charges had humans been behind the keyboard. OpenAI said internal models hacked two more websites, bypassed company-imposed browsing restrictions, and used exposed credentials to draw cryptocurrency from a wallet it couldn’t otherwise access, in the latest installment of disclosures of its agents…
The incident is likely 1st confirmation of mercenary spyware delivered by targeted ads. Researchers say that mercenary hackers laced ads with zero-click exploits that installed sophisticated malware on the devices of targeted individuals when they did nothing other than load a website or open an installed app. The finding,…
