Internet scans show 7,000 devices may be vulnerable. The true number could be higher.

An error as small as a single flipped memory bit is all it takes to expose a private key.
The vulnerability occurs when there are errors during the signature generation that takes place when a client and server are establishing a connection. It affects only keys using the RSA cryptographic algorithm, which the researchers found in roughly a third of the SSH signatures they examined. That translates to roughly 1 billion signatures out of the 3.2 billion signatures examined. Of the roughly 1 billion RSA signatures, about one in a million exposed the private key of the host.

Among other things, bug allows code running inside a VM to crash hypervisors.

Octo Tempest employs tactics that many of its targets aren't prepared for.

iLeakage is practical and requires minimal resources. A patch isn't (yet) available.

Vulnerability allows attackers to tamper with data stored in device memory.

Remote code execution requiring no authentication fixed. 2 other RCEs remain unpatched.

Google's app for generating MFA codes syncs to user accounts by default. Who knew?

With 70 zero-days uncovered so far this year, 2023 is on track to set a new record.

Google researchers say currently unfixed vulnerability affects a popular software package.

Vulnerability allows hackers to execute malicious code when targets open malicious ZIP files.

Critics also decry Microsoft's "pay-to-play" monitoring that detected intrusions.

AIOS bills itself as an "all-in-one" security solution. A just-fixed bug undermined that.

Microsoft blocks a new batch of system drivers, but the loophole empowering them remains.

SQL injection attacks on MOVEit file-transfer service likely to get worse.

"Operation Triangulation" stole mic recordings, photos, geolocation, and more.

Researchers have devised a low-cost smartphone attack that cracks the authentication fingerprint used to unlock the screen and perform other sensitive actions on a range of Android devices in as little as 45 minutes.

Spyware is sold to countries including Egypt, Indonesia, Oman, Saudi Arabia, and Serbia.
Smartphone malware sold to governments around the world can surreptitiously record voice calls and nearby audio, collect data from apps such as Signal and WhatsApp, and hide apps or prevent them from running upon device reboots, researchers from Cisco’s Talos security team have found.

When it announced iOS 16, iPadOS 16, and macOS Ventura at its Worldwide Developers Conference last summer, one of the features Apple introduced was something called "Rapid Security Response." The feature is meant to enable quicker and more frequent security patches for Apple's newest operating systems, especially for WebKit-related flaws that affect Safari and other apps that use Apple's built-in browser engine.

Fast-growing e-commerce app Pinduoduo had an EvilParcel stow-away.