On Tuesday, March 7, 2023, Fortinet published a security advisory detailing an unauthenticated remote code execution vulnerability affecting FortiOS and FortiProxy (CVE-2023-25610). The vulnerability was internally discovered by Fortinet, and exploitation has not been observed in the wild at this time. A proof of concept (PoC) exploit has not been published publicly for this vulnerability at this time.

As cybercrime continues to grow and organizations digitize, understanding cybersecurity and how to improve one’s security posture becomes paramount. Unfortunately, the firewall has dissolved and tools alone, though helpful, can’t protect environments when public sector organizations are understaffed, underfunded, and struggling to maintain compliance.

On February 14, 2023, Microsoft released a security advisory for CVE-2023-21716, a critical remote code execution vulnerability in Microsoft Word. While CVE-2023-21716 was deemed to be of critical severity, Microsoft assessed at the time of publication that the vulnerability was “less likely” to be exploited, and no proof-of-concept exploit was available. Microsoft also noted that the vulnerability may be exploited through the Preview Pane in Microsoft Outlook.

It’s been three years since the California Consumer Privacy Act (CCPA) came into effect, marking improved security and data privacy for individuals both inside and outside of California. However, just because the law has been in effect, it doesn’t mean that all organizations are actively complying with the statutes.

It may be the shortest month, but February brought no shortage of bad behavior by cybercriminals. In our latest cyber attack roundup of the ever-thriving world of cybercrime, we look at a disturbing theft from one of the United States’ most secretive government organizations, a long-running ransomware tie-up for a major media company, a never-ending nightmare for a security-minded internet company, and the latest of many breaches for one of the backbones of the modern web.

$11.5 trillion. That’s the amount predicted global cybercrime will cost in 2023. As cyber attacks continue to evolve, becoming more damaging and more devious, organizations are desperate for comprehensive, proactive solutions. For many, that means a security operations center (SOC).

On Wednesday, March 1, 2023, Cisco published an advisory of a critical severity vulnerability impacting 6800, 7800, and 8800 series IP phones. The vulnerability allows for unauthenticated execution of arbitrary code. The vulnerability was responsibly disclosed to Cisco by a security researcher, and security patches are available to remediate the vulnerability.

On February 27, 2023, LastPass updated their security incident notice to include additional details around the data breach they began investigating in November 2022. According to their notice, the threat actor used information obtained in an earlier, August 2022, data breach to target an employee and obtain credentials and keys used to decrypt storage volumes within their cloud-based storage service.

Once again, Arctic Wolf has taken the temperature of organizations across the globe to determine how the cybersecurity landscape of 2022 is shaping their 2023 concerns and actions. While the survey covered a number of topics, one stood out: ransomware. 48% of organizations ranked ransomware as their number one concern for the coming year. While that’s down from 70% in 2022, it doesn’t mean that ransomware is going away.

The financial services industry is under constant threat from cybercriminals, thanks to the large amounts of money and data they move and store. In fact, financial services businesses suffer 300 times more cyber-attacks than companies in other sectors, and the cost of downtime is among the highest in any industry. 57% of IT professionals say their organizations can’t tolerate the loss of mission-critical applications for a full hour, with 15% reporting they can’t tolerate ANY downtime.