Multiple vulnerabilities have been discovered in Apple products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
Affected Systems:
Risk
Remediation Recommendations
Ensure all Apple products have the latest version(s) installed
Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it)
References
Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
Affected Systems:
Risk
Remediation Recommendations
Ensure all Google Chrome products have the latest version(s) installed
Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it)
References
Multiple vulnerabilities have been discovered in Google Android OS, the most severe of which could allow for privilege escalation. Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. Successful exploitation of the most severe of these vulnerabilities could allow for privilege escalation in the context of the affected component. Depending on the privileges associated with the exploited component, an attacker could then install programs; view, change, or delete data; or create new accounts with full rights.
Affected Systems:
Risk
Remediation Recommendations
Ensure all devices running Android OS have the latest version(s) installed.
Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it)
References
Chainalysis has published a report finding that ransomware payments dropped by 35% in 2024, which the researchers believe was "driven by increased law enforcement actions, improved international collaboration, and a growing refusal by victims to pay." Victims paid a total of $813.55 million in ransoms last year, compared to a record-setting $1.25 billion in 2023.
Lizzie Cookson, Senior Director of Incident Response at Coveware, told Chainalysis, "The market never returned to the previous status quo following the collapse of LockBit and BlackCat/ALPHV. We saw a rise in lone actors, but we did not see any group(s) swiftly absorb their market share, as we had seen happen after prior high profile takedowns and closures. The current ransomware ecosystem is infused with a lot of newcomers who tend to focus efforts on the small- to mid-size markets, which in turn are associated with more modest ransom demands."
Researchers at watchTowr have published a report on the security risks posed by abandoned cloud infrastructure. The researchers focused on AWS S3 buckets but noted that the same issues can apply to any cloud storage provider.
watchTowr discovered and took control of 150 neglected Amazon S3 buckets—some of which had once been used by governments, Fortune 500 companies, cybersecurity firms, and major open-source projects—that were still being pinged by organizations worldwide for software updates, system configurations, and critical files. One of the buckets was owned by the US Cybersecurity and Infrastructure Security Agency (CISA), which the researchers note "is an incredible example of how this challenge is ubiquitous and not limited to only the unenlightened." The report stresses that a threat actor could have abused these assets to launch devastating supply chain attacks.
The buckets discovered by watchTowr have since been sinkholed. An AWS spokesperson told CyberScoop in response to the research, "[T]he issues described in this blog occurred when customers deleted S3 buckets that were still being referenced by third-party applications," adding that customers should follow best practices, including "using unique identifiers when creating bucket names to prevent unintended reuse, and ensuring applications are properly configured to reference only customer-owned buckets."