セキュリティ· · 2分Vulnerabilities Galore.
Today's cybersecurity landscape is buzzing with vulnerabilities, new protections, and the rise of AI threats. Major updates from Google and Microsoft aim to fortify defenses, while the quick exploitation of flaws highlights the urgent need for better security practices. From backdoored software updates to a new MITRE framework, it's a wild week in the world of info security.
Vulnerabilities Galore
The Marimo RCE flaw (CVE-2026-39987) was exploited just 10 hours after disclosure, a stark reminder of how quickly attackers can act. Meanwhile, Chrome 147 patched 60 vulnerabilities, including two critical flaws worth $86,000 in bounties. Organizations must stay vigilant as threat actors are more agile than ever.
New Protections Roll Out
Google’s Chrome now features Device Bound Session Credentials (DBSC) to combat cookie theft. This cryptographic trick ties session cookies to devices, making stolen cookies useless. On the email front, Gmail users on mobile can now send and receive end-to-end encrypted emails seamlessly, boosting privacy.
AI in the Crosshairs
The rise of AI is a double-edged sword in cybersecurity. As Sen. Sanders discussed, we need to address privacy concerns while leveraging AI's power. However, AI models can be exploited, making it critical to understand vulnerabilities in AI systems.
Supply Chain Attacks Continue
A backdoored update for Smart Slider 3 Pro was distributed through compromised servers, showing how supply chain attacks remain a significant threat. Likewise, CPUID was hacked to serve malware via its popular software downloads, highlighting the risks associated with trusted software sources.
Geopolitical Cyber Threats
Iranian hackers are targeting U.S. industrial devices, exposing nearly 4,000 systems to potential compromise. This uptick in cyberattacks correlates with geopolitical tensions and highlights the urgent need for robust cybersecurity measures in critical infrastructure.
Critical Marimo Flaw Exploited Hours After Public Disclosure
A critical vulnerability in Marimo was exploited less than 10 hours after disclosure, allowing attackers to gain remote code execution. This incident underscores the rapid pace at which vulnerabilities are weaponized.
Google Rolls Out Cookie Theft Protections in Chrome
Google has implemented new measures in Chrome to protect against session cookie theft with Device Bound Session Credentials, making stolen cookies ineffective. This update is crucial for enhancing user security.
EngageLab SDK Flaw Exposed 50M Android Users, Including 30M Crypto Wallet Installs
A vulnerability in the EngageLab SDK affects over 50 million Android users, including 30 million using crypto wallets, threatening sensitive information. The flaw allows attackers to manipulate intents, risking user credentials.
- Google Rolls Out DBSC in Chrome 146 to Block Session Theft on WindowsNew security measures in Chrome 146 aim to prevent session theft on Windows devices. — The Hacker News
- Backdoored Smart Slider 3 Pro Update Distributed via Compromised Nextend ServersCompromised servers distributed a backdoored update for Smart Slider 3 Pro, exposing users to risks. — The Hacker News
- Sen. Sanders Talks to Claude About AI and PrivacySen. Sanders discusses the implications of AI on privacy in a conversation with Claude. — Schneier
- Critical Marimo Flaw Exploited Hours After Public DisclosureMarimo's critical vulnerability was exploited in less than 10 hours after its disclosure. — SecurityWeek
- CPUID Hacked to Deliver Malware via CPU-Z, HWMonitor DownloadsHackers compromised CPUID to serve malware through its popular software downloads. — BleepingComputer
この号は役に立ちましたか？
ワンクリックで次号の改善に役立ちます。