Quick Hits

Engineers can use the Cyber Resiliency Engineering Framework Navigator to visuzalize their cyber-resiliency capabilities.

QNAP NAS devices are vulnerable to CVE-2022-27596, which allows unauthenticated, remote SQL code injection.

A new supply chain risk management office aims to help public and private sectors implement recent CISA policies and guidance.

Google Fi mobile customers have been alerted that their SIM card serial numbers, phone numbers, and other data were exposed in T-Mobile hack.

Recent cyberattacks against SMBs across Europe have been traced back to copycat groups using leaked LockBit locker malware.

The new API incorporates threat intelligence research and employs machine learning to identify threats in the supply chain.

UK sportswear retailer asks exposed customers to stay "vigilant" against phishing attempts following cyberattack.

The Instagram rate-limiting bug, found by a rookie hunter, could be exploited to bypass Facebook 2FA in vulnerable apps, researcher reports.

The accused sold an enormous data set stolen from the Austrian radio and television licensing authority — to an undercover cop.

After Berlin pledged tanks for Ukraine, some German websites were knocked offline temporarily by Killnet DDoS attacks.

Zacks Elite sign-ups for the period 1999–2005 were accessed, including name, address, email address, phone number, and the password associated with Zacks.com.

Encrypted backups for several GoTo remote work tools were exfiltrated from LastPass, along with encryption keys.

API Leak Management software discovers exposed API keys and other secrets, blocks their use, and monitors for abuse, the company says.

Devices running Android 12 and below are at risk of attackers downloading apps that direct users to a malicious domain.

Amid all the NFL playoff action, FanDuel has sent an email warning to gamblers that their data was exposed in its third-party breach, putting them at risk for phishing attacks.