安全· · 2 分钟Rising Attack Vectors.
Today’s cybersecurity landscape is buzzing with vulnerabilities and breaches. From AI-driven attacks to major updates from tech giants, there's a lot to unpack. Stay alert and keep your systems fortified.
Rising Attack Vectors
Identity is becoming a prime attack path, as highlighted in a recent article. With attackers increasingly targeting personal and organizational identities, it's crucial to rethink security measures.
Plus, a nine-year-old Linux kernel flaw is enabling root command execution on major distros. If you’re running outdated systems, now’s the time to patch up and ensure your defenses are solid.
Supply Chain Woes
The recent TanStack npm supply-chain attack has led to GitHub breaches, affecting 3,800 internal repositories. This highlights the ever-present vulnerability in software supply chains, and the need for vigilance in dependency management.
On the flip side, Socket raised $60 million to enhance supply chain security. The funding will help them expand their platform that protects against malicious code in open-source dependencies.
Major Patches and Alerts
Microsoft has released critical patches for two actively exploited vulnerabilities in Defender. These zero-day flaws allow privilege escalation and denial-of-service attacks — if you’re using Defender, make sure you’re up to date.
Drupal also patched a critical vulnerability that could allow remote code execution. If you're running Drupal with PostgreSQL, an immediate update is essential to safeguard your websites.
App Store Security Stats
Apple rejected over 2 million App Store submissions last year for security reasons, blocking over $2.2 billion in fraudulent transactions. Their proactive approach showcases how tech giants can leverage AI to enhance security.
With reports of more than 11 billion in blocked fraud over six years, Apple’s strategy seems to be paying off in the fight against fraudulent activities.
GitHub Breach Linked to NPM Supply-Chain Attack
GitHub confirms a breach affecting 3,800 repositories due to a malicious Nx Console extension linked to the TanStack npm supply-chain attack. This incident underscores the vulnerabilities present in software supply chains.
Apple's App Store Fraud Prevention Success
Apple prevented over $2.2 billion in fraudulent transactions in 2025 by rejecting millions of app submissions. Their AI-driven strategy highlights a successful approach to combatting app fraud.
- Microsoft Warns of Two Actively Exploited Defender VulnerabilitiesMicrosoft has issued alerts for critical vulnerabilities in Defender that are being actively exploited. — The Hacker News
- Chinese Hackers Target Telcos with New MalwareA new Chinese cyber-espionage campaign is targeting telecommunication providers with Linux and Windows malware. — BleepingComputer
- Showboat Linux Malware Hits Middle East TelecomA new Linux malware named Showboat has been reported targeting telecom providers in the Middle East. — The Hacker News
- Police Seize 'First VPN' Service Used in Ransomware AttacksAuthorities shut down a VPN service linked to multiple ransomware attacks, showcasing law enforcement's commitment to tackling cybercrime. — BleepingComputer
- Microsoft Patches Exploited UnDefend and RedSun Defender Zero-DaysMicrosoft has rolled out patches for two zero-day vulnerabilities in Defender that are being exploited in the wild. — SecurityWeek
本期内容对你有帮助吗？
点一下就好，这将影响下一期。