Two new CPU flaws, Cachewarp and Reptar. More on passkeys. Ransomware gangs filing complaints to the SEC.

Look, I'll be honest. Whenever these CPU vulnerabilities are reported my head starts spinning by the time I get to the second paragraph. But I'll try to interpret it as best I can.

As I understand it, it allows attackers to revert cached VM memory to a previous state, thereby finding previously authenticated sessions or recovering private keys that they can use to get themselves access or escalate privileges. But the statement of AMD does say it requires a malicious hypervisor? If your hypervisor is malicious, I'd think you have bigger problems. Still, it sounds like a clever hack.

Another CPU vulnerability, this time for Intel. It ... has something to do with prefixes.

From the article:
"Under certain microarchitectural conditions, Intel has identified cases where execution of an instruction (REP MOVSB) encoded with a redundant REX prefix may result in unpredictable system behavior resulting in a system crash/hang, or, in some limited scenarios, may allow escalation of privilege (EoP) from CPL3 to CPL0".

Yep.

I'll move on the words of comfort that we all seek:
While it might be possible to achieve privilege escalation with this vulnerability, that hasn't happened yet, although it can cause a DoS. Still, Intel does not expect this issue to be encountered in the real world, but just in case there is a microcode update available.

Citrix Hypervisor is also affected, they released a patch as well: link.

Google has updated their Titan security keys to include support for passkeys, allowing users to store up to 250 unique ones. That might be a very welcome alternative, or additive, to passkeys on smartphones. They also announced they'll be giving away 100,000 of them to high-risk users around the world.

Speaking of passkeys, great article by the EFF on what the passkeys are. There's a part two on passkey privacy implications as well.

This definitely jumped out to me. To add to the extortion arsenal, criminals might now file a complaint with the SEC for not complying with the four-day rule to disclose a cyberattack, that they caused.

If you think doing a quick pentest every few quarters isn’t enough, you are correct. GlitchSecure combines continuous vulnerability assessments with real-time pentesting - all verified by highly skilled (and wonderful) humans in a user friendly platform. (Sponsored)

The botnet was originally discovered in 2019, and stood out for it's use of the InterPlanetary File System (IPFS) peer-to-peer protocol to communicate with infected systems. It grew to to more than 13,500 devices by 2020, earning the creator more than $550,000. He was arrested by the FBI, who took down the botnet infrastructure, but didn't remove the malware from infected devices.

Microsoft provides three more years of Windows Server 2012 Extended Security Updates (ESUs) until October 2026, allowing admins more time to upgrade or migrate to Azure.

The FCC proposed the creation of a “Schools and Libraries Cybersecurity Pilot Program” that would allow officials to research which cybersecurity services would best help K-12 schools and libraries across the US defend themselves from hackers.

It would require hospitals to have their own cybersecurity program, with their own CISO, incident response plans, enforced 2fa, the works. They'd be able to apply for funding to help make this a reality. Great stuff, and I absolutely wish that all hospitals (also in the EU) would have to do this. But it can't be easy to find enough people and resources :/

They discovered hidden mining rigs -inside the court house-, in a ventilation duct and beneath a raised floor, where they were powered by electricity from the court’s mains supply.

If you live in the US, go for it :-)

A password manager is more than a security tool. Learn from 1Password’s CFO why it’s an indispensable tool for finance teams that handle sensitive information. (Sponsored)