XSS vulnerabilities have been a general nuisance for years, but a new alert from CISA and the FBI points out that they represent a national security risk and a notable financial drain on the country.
Joint study finds that old vulnerabilities accounted for just over three-quarters of ransomware attacks in 2022. Most of these old vulnerabilities are from between 2015 to 2019, but the oldest still being actively exploited was published and patched in 2010.
Microsoft appears to have at least been aware of the possibility of this zero-day since 2021. Remote code execution using this Office exploit has been spotted in Russia and Belarus, and by a Chinese APT group.
Nearly 10,000 Android apps are found with a variety of undocumented backdoor abilities such as remotely resetting user passwords and blocking users from loading certain types of content.
Beyond the challenges around risk and uncertainty, can bug bounties really deliver on their promise? Even as crowdsourced security testing continues to gain acceptance, what’s important is designing the right model to increase efficiency and avoid diminishing marginal returns.