On September 26th, 2024, details were released about several vulnerabilities in the Common Unix Printing System (CUPS) package. A total of four CVE’s (CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177) have been released, affecting many Unix and Linux distributions. Three of the vulnerabilities are rated High, while one is rated Critical. If left unpatched, a remote attacker is able to execute arbitrary commands on the affected system.

A series of critical vulnerabilities has been uncovered in the Common Unix Printing System (CUPS), specifically in the cups-browsed component and related libraries. This vulnerability chain allows remote, unauthenticated attackers to potentially execute arbitrary code with root privileges on affected systems. The discovery highlights significant security risks in a widely-used open-source component and raises crucial questions about legacy system support and security in modern IT environments.

Five worthy reads is a regular column on five noteworthy items we’ve discovered while researching trending and timeless topics. This week, we explore cyberattacks in the banking industry. Gone are the days when paychecks were rolled out in envelopes on payday. We’ve evolved from juggling between counters to deposit a check to managing everything through a single mobile banking application. Indeed, modern banking saves us time and encourages self-service.

On September 23rd, Twitter user Simone Margaritelli (@evilsocket) announced that he has discovered and privately disclosed a CVSS 9.9 GNU/Linux unauthenticated RCE, which affects almost all Linux distributions, and that the public disclosure will happen on September 30th, Due to a suspected leak in the disclosure process, @evilsocket decided to advance the disclosure, and on September 26th, the vulnerabilities were disclosed in @evilsocket’s blog, along with a full proof of concept.

A zero-day flaw in MOVEit software exposed the data of 66.4 million individuals, revealing businesses are increasingly vulnerable to cyberattacks. Applications, which manage sensitive data, are prime targets for these threats. Compliance regulations recognize the risks and establish guidelines aimed at ensuring applications meet data protection, privacy, and overall security. PCI DSS v4.0 for example introduces 64 new requirements including strict security measures to protect public-facing applications.

In today’s cyber landscape, threat actors are becoming increasingly sophisticated, often leveraging free tools and cloud services to launch targeted attacks. One such group, known as SloppyLemming, is making waves by using platforms like Cloudflare Workers to engage in espionage against government and law enforcement agencies in the Indian subcontinent. This blog delves into their methods, targets, and how organizations can bolster their defenses against such threats.

Mozilla, the organization behind the popular Firefox browser, is facing scrutiny from the European digital rights group NOYB (None Of Your Business) over alleged privacy violations. The complaint, lodged with Austria’s data protection authority, claims that Firefox employs a feature known as "Privacy-Preserving Attribution" (PPA) to track user behavior without explicit consent. This controversy raises significant questions about user privacy and the ethical responsibilities of tech companies.

In a significant move towards enhancing the security of its Android operating system, Google has announced a substantial reduction in memory vulnerabilities by adopting memory-safe programming languages, particularly Rust. This shift aligns with Google's secure-by-design philosophy, aiming to minimize security risks associated with new code development. In this blog, we’ll explore the implications of this transition, the statistical outcomes, and what this means for the future of secure coding.