Read Time:6 Second
Once considered inactive, the Chinese cyber espionage group FamousSparrow has reemerged, targeting organizations across the US, Mexico and Honduras
Daily Archives: March 27, 2025
A Taxonomy of Adversarial Machine Learning Attacks and Mitigations
Read Time:4 Second
NIST just released a comprehensive taxonomy of adversarial machine learning attacks and countermeasures.
NCA Warns of Sadistic Online “Com” Networks
Read Time:6 Second
The UK’s National Crime Agency is warning of a growing cyber and physical threat from homegrown teens
NCSC Urges Domain Registrars to Improve Security
Read Time:5 Second
The UK’s National Cyber Security Centre has released new guidance to help domain registrars enhance security
Malaysian PM says “no way” to $10 million ransom after alleged cyber attack against Kuala Lumpur airport
Read Time:9 Second
According to some reports, Kuala Lumpur International Airport had to resort to using whiteboards to communicate with passengers.
Read more in my article on the Hot for Security blog.
USN-7376-1: MariaDB vulnerability
Read Time:12 Second
A security issue was discovered in MariaDB and this update includes
a new upstream MariaDB version to fix the issue.
In addition to security fixes, the updated packages contain bug and
regression fixes, new features, and possibly incompatible changes.
Apache Tomcat RCE
Read Time:1 Minute, 9 Second
What is the Vulnerability?On March 10, 2025, Apache issued a security advisory regarding a critical vulnerability (CVE-2025-24813) affecting the Apache Tomcat web server. This flaw could allow attackers to view or inject arbitrary content into security-sensitive files and potentially achieve remote code execution.Exploit code for this vulnerability is publicly available, and no authentication is required to launch an attack, making prompt mitigation essential. According to Apache, successful exploitation requires specific conditions, many of which are enabled by default, allowing attackers to manipulate and view sensitive files or execute remote code.What is the recommended Mitigation?Impacted users should implement the recommended mitigations provided by Apache and follow the instructions outlined in the vendor’s advisory:https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq- Upgrade to Apache Tomcat 11.0.3 or later- Upgrade to Apache Tomcat 10.1.35 or later- Upgrade to Apache Tomcat 9.0.99 or laterWhat FortiGuard Coverage is available?FortiGuard Labs has available IPS protection to detect and block any attack attempts targeting the CVE-2025-24813 affecting the Apache Tomcat web server. https://www.fortiguard.com/encyclopedia/ips/57559FortiGuard Endpoint Vulnerability Service provides a systematic and automated method of patching applications on an endpoint, eliminating manual processes while reducing the attack surface. https://www.fortiguard.com/encyclopedia/endpoint-vuln/84317The FortiGuard Incident Response team can be engaged to help with any suspected compromise.
USN-7375-1: Org Mode vulnerabilities
Read Time:54 Second
It was discovered that Org Mode did not correctly handle filenames
containing shell metacharacters. An attacker could possibly use this issue
to cause a denial of service or execute arbitrary code. This issue only
affected Ubuntu 22.04 LTS. (CVE-2023-28617)
It was discovered that Org Mode could run untrusted code left in its
buffer. An attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-30202)
It was discovered that Org Mode did not correctly handle the contents of
remote files. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2024-30205)
It was discovered that Org Mode could be made to run arbitrary Elisp code.
An attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. (CVE-2024-39331)
Smashing Security podcast #410: Unleash the AI bot army against the scammers – now!
Read Time:18 Second
A YouTuber has unleashed an innovative AI bot army to disrupt and outwit the world of online scammers, and a New York Times investigation looks into the intricate web of global money laundering.
All this and more is discussed in the latest edition of the award-winning “Smashing Security” podcast by computer security veterans Graham Cluley and Carole Theriault.