Zero-day Windows and ransomware: emergency patch for Fortinet and new threats

Quick Answer

New Windows zero-day allows privilege escalation

A new zero-day vulnerability, named LegacyHive (CVE-2024-21191), is actively circulating. This flaw, discovered by Bleeping Computer, allows attackers to obtain administrative privileges on Windows 11 and Windows Server 2022 systems. The vulnerability exploits an issue in Windows registry files, enabling unauthorized access to sensitive data.

The Gentlemen ransomware surpasses Qilin

According to Infosecurity Magazine, the ransomware group The Gentlemen has recently surpassed Qilin as the most prolific threat. This group has implemented more aggressive tactics, including the use of zero-day vulnerabilities and advanced evasion techniques. Their activities have led to a significant increase in ransomware attacks in recent months.

CISA orders immediate patches for Fortinet vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert to immediately patch three Fortinet vulnerabilities (CVE-2024-21762, CVE-2024-23113, CVE-2024-23114). These vulnerabilities, affecting FortiSandbox, can be exploited to execute arbitrary code and gain unauthorized access. CISA has ordered federal agencies to apply the patches by Sunday.

Canadian surveillance legislation under scrutiny

A U.S. senator has sent a letter to Senators Rubio and Blunt to express concern about the Canadian Lawful Access Act, surveillance legislation under discussion in Canada. The Record reported that the senator is worried about the implications for privacy and civil rights, calling for a more thorough review.

Meta Oversight Board detects bias in AIs

The Meta Oversight Board has published a report revealing that leading artificial intelligence models are less likely to criticize repressive regimes. According to Reuters, this bias could have significant implications for freedom of expression and transparency. The report also highlighted the need for greater regulation and oversight of AI technologies.

Hewlett Foundation invests $100 million

The Hewlett Foundation has announced a new $100 million commitment to emerging technology security. This investment, reported by the Hewlett Foundation, aims to support research and development of secure technologies and promote collaboration between academia, industry, and government. The initiative will focus on areas such as artificial intelligence, encryption, and cybersecurity.

Espionage attack against Bangladesh

An espionage attack has recently targeted the Bangladesh Ministry of Defense. The attack, which exploited a vulnerability in a document management system, allowed attackers to access sensitive information. Bangladeshi authorities are investigating the incident, but specific details of the attack have not yet been made public.

U.S. prosecutors dismantle money laundering network

The United States has charged two individuals with laundering $43 million from an investment fraud. According to Bleeping Computer, the two suspects used a network of bank accounts and cryptocurrencies to hide the illicit proceeds. This case underscores the importance of international cooperation in dismantling criminal networks.

Hack reveals Suno AI music generator scraped YouTube, Deezer, and Genius

A hack has revealed that the AI music generator Suno scraped data from YouTube, Deezer, and Genius. According to 404 Media, the company used this data to train its models without proper authorization, raising concerns about data privacy and copyright infringement.