Endpoint/Device Security

Windows and Android devices are being targeted by malware distributed through fraudulent apps impersonating OpenAI's ChatGPT chatbot, BleepingComputer reports.

BleepingComputer reports that Google has been collaborating with Android ecosystem partners to strengthen firmware security as it works to better defend other components of a system on a chip against potential exploitation.

SecurityWeek reports that numerous Arris routers including the G2482A, SBG10, and TG2492 models running firmware version 9.1.103 which have reached end-of-life are being impacted by a remote code execution flaw, tracked as CVE-2022-45701.

Increased government pressure and the emergence of software bill of materials have prompted a reduction in published vulnerabilities in extended Internet of Things devices since 2021 even as the flaws have been increasingly self-reported by device manufacturers rather than independent researchers, SecurityWeek reports.

Threat actors could chain two critical security vulnerabilities in Schneider Electric's Unity line of Modicon programmable logic controllers, tracked as CVE-2022-45788 and CVE-2022-45789, to compromise safety protections for limiting physical damage, according to The Record, a news site by cybersecurity firm Recorded Future.

Several high-severity vulnerabilities in Citrix Systems' Virtual Apps and Desktops, as well as its Workspace Apps, which could be exploited to achieve privilege escalation and system takeovers, have been patched in recently issued security updates, BleepingComputer reports.