Now that the calendar has flipped to November, the end of the year is in sight. It’s a popular time for friends and family to gather for the holidays, yet unfortunately, it’s also a popular time for cyber attackers to ramp up their exploits. Our thoughts turned to the cyber professionals on the front lines. What compromises do they feel pressured to make in their work-life balance to keep their companies secure? How often does their work actually impinge on their personal time?

In today’s digital world, the importance of cybersecurity is more critical than ever. With the constant evolution of cyber threats, safeguarding sensitive data and digital assets has transitioned from an option – to an absolute necessity. Each October, Cybersecurity Awareness Month focuses on the importance of cybersecurity in our interconnected world.

Cisco has released an advisory, acknowledging active exploitation of a previously unknown vulnerability, which is tracked as CVE-2023-20198, in the web UI feature of Cisco IOS XE Software when exposed to the internet or to untrusted networks. This vulnerability allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access, which is the highest level of access.

Casinos bring in millions of players and billions of dollars a year, via both physical venues and online platforms. And the industry estimated to grow by $11.42 billion between 2021 and 2025. Players trust casinos with their funds and high-value personal data, so it is no surprise that threat actors are targeting these venues to monetize their attacks.

Small and Medium Enterprises (SMEs) have encountered increasing burdens over the last few years, from challenging economic conditions to a dramatically evolving cyber threat landscape. Today, 43% of cyber attacks are targeted at SMEs, and only 14% of targeted SMEs were prepared to handle such attacks. An astonishing 75% of those SMEs attacked could result in permanent closure if unable to recover data.

During a red team assessment for a client, Charles Fol and Dany Bach from LEXFO, discovered a heap overflow bug in Fortigate’s SSL VPN that can be exploited to achieve remote code execution on Fortigate instances. This vulnerability is reachable without authentication, and can be used to execute arbitrary code on vulnerable systems, which could lead to a complete compromise of the system.

In early June, multiple threat researchers observed attacks on MOVEit servers using a zero day vulnerability that facilitated data exfiltration. MOVEit Transfer is a managed file transfer software that supports the exchange of files and data. This vulnerability allows an attacker to gain access to the database and possibly infer information about the structure and contents of the database.

As businesses increasingly embrace cloud computing to enhance their operations, the need for robust cybersecurity measures becomes paramount. Traditional cybersecurity approaches often fall short in protecting cloud environments against ever-evolving cyber threats. This is why today we are excited to announce that we are expanding our CleanINTERNET® service to the cloud.