Toyota sealed up a backdoor to its global supplier management network
Hacker praises carmaker’s prompt response to the (mercifully) good-faith pwnage
The Daily Swig | Cybersecurity news and views
Google engineers plot to mitigate prototype pollution
Plan to create boundary between JavaScript objects and their blueprints gathers momentum
Serious security hole plugged in infosec tool binwalk
Path traversals could ‘void reverse engineering efforts and tamper with evidence collected’
Truffle Security relaunches XSS Hunter tool with new features
Popular hacking aid now available with CORS misconfig detection function following end-of-life announcement
Researcher drops Lexmark RCE zero-day rather than sell vuln ‘for peanuts’
Printer exploit chain could be weaponized to fully compromise more than 100 models
Bug Bounty Radar // The latest bug bounty programs for February 2023
New web targets for the discerning hacker
Tell us what you think: The Daily Swig reader survey 2023
Have your say to be in with the chance to win Burp Suite swag…
Deserialized web security roundup: ‘Catastrophic cyber events’, another T-Mobile breach, more LastPass problems
Your fortnightly rundown of AppSec vulnerabilities, new hacking techniques, and other cybersecurity news
Facebook two-factor authentication bypass issue patched
Security vulnerability was one of Meta’s top bugs of 2022
Ruby on Rails apps vulnerable to data theft through Ransack search
Several applications were vulnerable to brute-force attacks; hundreds more could be at risk
Trellix automates tackling open source vulnerabilities at scale
More than 61,000 vulnerabilities patched and counting
Yellowfin tackles auth bypass bug trio that opened door to RCE
Pre- and post-auth path to pwnage
Bitwarden responds to encryption design flaw criticism
Password vault vendor accused of making a hash of encryption
IoT vendors faulted for slow progress in setting up vulnerability disclosure programs
Manufacturer complacency ‘translates into an unacceptable risk for consumers’, warns security expert
AWS patches bypass bug in CloudTrail API monitoring tool
Threat actors poking around AWS environments and API calls could stay under the radar
Git security audit reveals critical overflow bugs
Uncovered vulnerabilities include several high, medium, and low-security issues
Popular password managers auto-filled credentials on untrusted websites
Dashlane, Bitwarden, and Safari all cited by Google researchers
Google pays hacker duo $22k in bug bounties for flaws in multiple cloud projects
Six payouts issued for bugs uncovered in Theia, Vertex AI, Compute Engine, and Cloud Workstations
WAGO fixes config export flaw threatening data leak from industrial devices
Severity somewhat blunted by reboot-related caveat
US government announces third Hack The Pentagon challenge
Ethical hackers and bug bounty hunters invited to test Department of Defense assets
Keeping you up to date with the latest cybersecurity news from around the world.