Patch/Configuration Management

QNAP's patches for the SQLi issue come just days after it addressed another zero-day impacting its HBS 3 Hybrid Backup Sync disaster recovery and data backup solution, which was discovered and leveraged by the Viettel Cyber Security team to compromise a TS-464 network-attached storage device during the competition.

ACROS Security has released free unofficial fixes for a zero-day flaw in Windows Themes, which could be leveraged to facilitate the remote compromise of NTLM credentials on devices running on Windows 7 to Windows 11 24H2.

The discoveries included three critical security vulnerabilities and 18 high-severity flaws.

New research finds that six years later, AMD and Intel processors can still be hit with speculative execution attacks.

SafeBreach argues that Microsoft’s narrow definition of a flaw leaves the Windows kernel open to attacks.

Threat actors could exploit the vulnerability, which stems from resource exhaustion, to facilitate a denial-of-service condition in impacted devices' RAVPN service, said Cisco.