Catalin Cimpanu 3 months ago

Microsoft Oct 2025 Patch Tuesday is out with fixes for 3 actively exploited zero-days https://rawcdn.githack.com/campuscodi/Microsoft-Patch-Tuesday-Security-Reports/55b489e3398e0c216c7bfb81a05bc3c9119c0209/Reports/MSRC_CVEs2025-Oct.html -CVE-2025-24990 — Windows Agere Modem Driver Elevation of Privilege Vulnerability -CVE-2025-59230 — Windows Remote Access Connection Manager Elevation of Privilege Vulnerability -CVE-2025-47827 — Secure Boot bypass in IGEL OS before 11

Catalin Cimpanu 3 months ago

I just realized this might screw up a lot of infostealers in the coming weeks. Chrome also does this regularly. Let's see how quick they adapt this time. View quoted note →

Catalin Cimpanu 3 months ago

Research home page, if you wanna read the paper:

🛰️ SATCOM Security

Research project homepage for SATCOM Security: papers, source code, and recent satellite communications vulnerabilities.

View quoted note →

Catalin Cimpanu 3 months ago

Firefox 144 is out with hardened encryption for locally stored passwords

Firefox

Firefox 144.0, See All New Features, Updates and Fixes

Catalin Cimpanu 3 months ago

Infosec drama, part 283,293: FuzzingLabs accuses Gecko Security of stealing two CVEs and backdating blogs

X (formerly Twitter)

FuzzingLabs (@FuzzingLabs) on X

💣 We caught @ycombinator–backed @gecko_sec stealing two of our CVEs, one on @ollama , one on @Gradio. They copied our PoCs, claimed CVE IDs, ...

Catalin Cimpanu 3 months ago

"Pixnapping is a new class of attacks that allows a malicious Android app to stealthily leak information displayed by other Android apps or arbitrary websites." Tested to steal data from Gmail, Google Accounts, Signal, Google Authenticator, Venmo, and Google Maps

Pixnapping Attack

Catalin Cimpanu 3 months ago

Security firm DarkTower has discovered four different Telegram emoji packs that contain bank logos and are likely used in cybercrime channels as a way to order phishing pages.