On February 20, 2024, we published a security bulletin detailing newly disclosed authentication bypass and path traversal vulnerabilities in ConnectWise ScreenConnect. Shortly after the bulletin was sent, ConnectWise updated their security bulletin with IOCs from observed active exploitation of these vulnerabilities. On February 21, 2024, the vulnerabilities were assigned the following CVE numbers.

Vulnerability prioritization is one of the most important steps in managing cybersecurity risks effectively. Ideally, security teams would address every vulnerability immediately upon detection. However, the reality is far from ideal because of the overwhelming number of vulnerabilities and their escalating volume among other challenges, like severity spectrum differences requiring nuanced assessment, evolving threats, or resource constraints.

People, processes, and tooling all impact an organization’s ability to maintain a strong AppSec program. In a recent panel at Black Hat Europe, Snyk spoke with two customers — Jaguar Land Rover (JLR) and Asda — about the unique challenges they face managing development teams, onboarding new security tools, and building a modern DevSecOps program throughout their organizations.

Widespread exploitation of these vulnerabilities in the wild has been confirmed including comprise of UnitedHealth’s Change Healthcare on February 22nd, by Lockbit. Sophos has confirmed various strains of malware using these vulnerabilities as part of delivery including LockBit ransomware, AsyncRAT, infostealers, etc.

Microsoft's Patch Tuesday updates in February 2024 include critical fixes for two zero-day vulnerabilities: CVE-2024-21413 impacting Microsoft Outlook (called MonikerLink) and CVE-2024-21410 impacting Microsoft Exchange Server. The former allows remote code execution to access and leak privileged information, while the latter permits privilege escalation (potentially using credentials leaked by the former). These security risks expose a victim's machine to potentially malicious arbitrary code execution.

In the digital age, assuring the security and integrity of IT infrastructure is paramount for businesses of all sizes. Vulnerability scanning plays a crucial role in identifying weaknesses in systems and networks, and forms the backbone of any robust cybersecurity strategy. What happens, however, when this critical step fails or encounters issues?

Struggling to manage vulnerabilities in your Kubernetes environment? You’re not alone. Traditional vulnerability management tools often leave security teams feeling overwhelmed and unsure of where to focus their efforts. Traditional scanners churn out an endless stream of alerts, many irrelevant, making it difficult to prioritize and address the most critical issues. Sound familiar?

A recent Total Economic Impact™ study from Forrester Consulting revealed that Tanium can help organizations improve their endpoint management, security, and more while delivering significant value and savings.

Server-side request forgery (SSRF) is a common vulnerability that can crop up unknowingly in any Node.js application. It poses a significant threat because attackers can manipulate a server into making unintended requests to both internal and external resources. This article will explore SSRF, its potential risks, and the strategies to mitigate SSRF in Node.js applications.

Varonis researchers have recently disclosed that several government agencies and private-sector companies had customized or added features to their Salesforce Apex code that leaked data, allowed data corruption, or allowed an attacker to disrupt business functions. Impacted data included the usual suspects like phone numbers, addresses, social security numbers, and username/password combinations.