Researchers have uncovered a new vulnerability, tracked as CVE-2024-6769, which enables attackers to bypass Windows User Access Control (UAC) and elevate their privileges to gain full system control without triggering any alerts. This exploit, affecting Microsoft’s Windows platform, has sparked debate about whether UAC truly acts as a security boundary. While Microsoft does not classify this as a vulnerability, security experts warn organizations to be vigilant about the risks involved.

When it comes to securing applications in the cloud, the challenge isn’t detecting potential security issues. There are hundreds of application security tools and cloud security tools that are capable of surfacing code flaws and security misconfigurations that could lead to vulnerabilities. The real challenge is empowering development teams to adopt these tools to consistently improve the security posture of their services.

Since its debut in 2022, ChatGPT has radically reshaped the way we interact with technology. Generative AI (genAI) platforms like ChatGPT, Google Gemini, and Meta AI have rapidly gained in popularity, offering capabilities that range from rewriting text to generating creative content. While these tools have created new opportunities for enhanced productivity, they’ve also introduced new security risks — particularly when users unknowingly share sensitive information.

As modern organizations grow in size and complexity, managing secure access to computing infrastructure becomes a top priority. Teleport has introduced new features in Teleport Policy 16 aimed at making this easier and more efficient. With these enhancements, organizations can take a more proactive approach to security, ensuring better oversight and reducing potential risks.

New research by Recorded Future provides insight into how advanced and sophisticated the threat group Marko Polo has become since launching in 2022. Marko Polo is of particular interest due to their rapid progress in advancing their operations.

Industry analysis of the domains used behind phishing and brand impersonation attacks show financial institutions are being leveraged at an alarming rate. It’s one thing to see your industry at the top of some “state of” cybersecurity report, but it’s entirely different to learn that 68% of all phishing web pages identified in a single quarter are from your industry. That’s exactly what we find in Akamai’s latest analysis of websites across the Internet.

CVE-2023-2163 is a critical vulnerability in the Linux Kernel, specifically affecting kernel versions 5.4 and above (excluding 6.3). This vulnerability arises from incorrect verifier pruning in the Berkeley Packet Filter (BPF), leading to unsafe code paths being incorrectly marked as safe. The vulnerability has a CVSS v3.1 Base Score of 8.8, indicating its high severity. The consequences are arbitrary read/write in kernel memory, lateral privilege escalation and container escape.

In the wide world of information security, there are many different frameworks, standards, and systems in use to help assume a secure stance against threats. Two commonly seen frameworks are SOC 2 and ISO 27001. How do these two stand in comparison to each other, and which one do you need for your business? Let’s discuss.

If you wish to fortify your organization’s cybersecurity posture, obtaining a Cyber Essentials certification is a good idea. It enables IT managers to be more aware of the cybersecurity risks in their environment and take actionable steps to mitigate them. Before you pursue it, though, you should decide between two certification levels: Cyber Essentials and Cyber Essentials Plus. ‍ While both are cybersecurity assurance schemes, Cyber Essentials Plus offers a greater level of assurance.

Most organizations today are heavily reliant on technology, regardless of the product or service they provide. This expands their data exposure points and potential attack surface, which is why there is a significant need to monitor the risks and vulnerabilities in the cybersecurity landscape. ‍ Cyber Essentials certification is a comprehensive cybersecurity strategy involving vigilance over various scattered technologies, policies, and controls.