New wolfSSL vulnerability and malicious apps expose user data

Critical wolfSSL vulnerability enables certificate forgery

A significant vulnerability has been discovered within the wolfSSL library, allowing threat actors to forge digital certificates. This flaw facilitates the impersonation of trusted servers, thereby enabling man-in-the-middle attacks. The impact extends to billions of devices, with a particular concentration in embedded and IoT systems that widely integrate the wolfSSL library for secure communication protocols.

Malicious chrome extensions target user data

A cluster comprising 108 malicious Chrome extensions has been identified as actively stealing Google and Telegram data. These extensions, which have affected approximately 20,000 users, masquerade as legitimate browser tools. Their operational mechanism involves communication with a shared command-and-control infrastructure to exfiltrate sensitive data, including user credentials, identity information, and browsing activity.

RCI hospitality holdings data breach via IDOR vulnerability

RCI Hospitality Holdings recently confirmed a data breach that exposed sensitive personal information belonging to numerous independent contractors. The incident was attributed to an insecure direct object reference (IDOR) vulnerability. This architectural flaw permitted unauthorized access to contractor data by manipulating specific parameters within web requests, bypassing standard authorization checks.