"Attackers have backdoored the widely used open-source Trivy vulnerability scanner, injecting credential-stealing malware into official releases and GitHub Actions used by thousands of CI/CD workflows."
"The breach has triggered a cascade of additional supply-chain compromises stemming from impacted projects and organizations not rotating their secrets, resulting in the distribution of a self-propagating worm referred to as CanisterWorm."
"A cluster of IoT botnets behind some of the largest DDoS attacks ever recorded -- AISURU, Kimwolf, JackSkid, and Mossad -- were wiped as part of a broad law enforcement operation."
Recent security issues highlight ongoing vulnerabilities in internet systems, including supply chain attacks on CI/CD setups and the exploitation of IoT devices. Attackers are employing creative methods, leading to new malware tricks and a rise in mobile threats. The breach of the Trivy vulnerability scanner has resulted in credential-stealing malware being injected into official releases, causing widespread compromise. Additionally, law enforcement has taken action against major DDoS botnets, but the overall landscape remains fraught with risks from zero-days and unpatched vulnerabilities.
Read at The Hacker News
Unable to calculate read time
Collection
[
|
...
]