The not so weekly Cyber is here ! What's new...

I'm lucky this time, not only you get a newsletter, but it is sponsored by listen.dev !

80% of organizations rely on open source supply chain and CI/CD while working on innovative solutions (source listen.dev ), yet, these new projects do come with security challenges.

? Open source supply chain attacks have increased rapidly in the past decade and becomes a growing challenge for organizations.

?? While attackers previously targeted run times and deployment, new attack vectors are emerging on CI and build time. This is where identifying efficient solutions make a difference, this is where listen.dev brings you the needed tools to ensure that your development environment security is properly watched.

There is a difference between vulnerable and malicious, vulnerable means there is a possibility and risk to be exploited, malicious means an active harmful attack. Static monitoring is not enough, there needs to be proactive behavioral monitoring of the open-source supply chain.

? Are you delivering product leading to liability risks ? Have you taken all the actions you could to avoid negligence on the security side ? Github actions is an important tool for CI.

Listen.dev is a proactive and dynamic tool which monitors your github actions workflows.

While you are now fully aware of the fact that you can secure your continuous integration pipeline, let's see what's fresh in the news, for companies that may not have done all they could in regards to security, and other vulnerabilities !

1 - Oil and gas giant Halliburton has confirmed in a filing today to the Securities and Exchange Commission (SEC) that data was stolen in the recent attack linked to the RansomHub ransomware gang. Business impact has been significant.

2 - If using a Zyxel router, make sure it's patched - Critical flaw in Zyxel’s secure routers allows OS command execution via cookie (CVE-2024-7261)

3 - Transport for London is dealing with a cyber security incident - I always tell you, wireless is weak, well, let's look at this : "Transport for London has set the contactless sign in link to Maintenance mode" as they "have a genuine internal security incident running and are reverting to paper processes". Can't hack paper, not connected, not hacked.

Philosophical side note : today, we still discover old historical manuscripts on paper from centuries, if not thousands years, teaching us some things about history. What is sure, is that non of the information in the tech world and computer of today, will be found in the future. Historians for thousand years ahead may still find middle age notes, but absolute none of all this digital stuff....we are deleting ourselves by digitally transforming in this fog-ware. Thankfully, for now, we still print books...maybe some of these will be found in the future.

4 - Hopefully you keep your stuff patched - Critical Atlassian Vulnerability Exploited To Connect Servers In Mining Networks - It's a CVE score 10, so, that's a wide open door.

5 - How to make your OS more vulnerable ? Install Microsoft tools ! New Flaws in Microsoft macOS Apps Could Allow Hackers to Gain Unrestricted Access

6 - Ahhh the cloud, I mean, you can't make this up : A third of organizations suffered a SaaS data breach this year

7 - Failing your criminal attempt is worse than failing at your job ! Ex-Engineer Charged in Missouri for Failed $750,000 Bitcoin Extortion Attempt

8 - Throwing away any electronic should be done with a strong hammering if you care about your privacy and data - Video Baby Monitor Repair Uncovers Private Data

9 - All this connected stuff is just evilly spying on you - Cox Media Group To Listen To Users Devices For Ad Targeting

That's about it for today !

Readers, again, don't forget to visit my sponsor for today's newsletter, which is listen.dev ! Have a look, see what they do ! This is helping me as well.

Have a great day all ! till next time !