MercadoLibre, one of the most important e-commerce companies in Latin America, confirmed unauthorized access to a part of its source code, in addition to confirming that the attackers managed to access the personal records of some 300,000 users. The company has not confirmed that its IT infrastructure was affected during the incident.

The Argentine firm confirmed the compromise of its systems after hackers from the Latin American group Lapsus$ threatened to expose confidential information from MercadoLibre and other e-commerce platforms. Faced with this threat, MercadoLibre enabled all its security and containment protocols, so it recommended that users of the platform change their passwords and monitor their account statements to prevent any attempt at malicious activity.

MercadoLibre has established itself as the largest e-commerce and payment processing ecosystem in Latin America. It currently has more than 140 million active buyers and sellers in Argentina, Brazil, Chile, Colombia, Mexico, Peru and Venezuela.

A report by cybersecurity firm Binarly points to the detection of 16 critical vulnerabilities in various implementations of Unified Extensible Firmware Interface (UEFI), present in multiple HP enterprise devices. According to the researchers, threat actors can exploit these flaws to implant firmware capable of evading UEFI Secure Boot, Intel Boot Guard, and virtualization-based security measures.

Cybersecurity specialists reported the detection of multiple vulnerabilities in IBM Security QRadar SOAR. According to the report, successful exploitation of these flaws would allow the deployment of severe attack scenarios.

Below are brief descriptions of the reported flaws, in addition to their tracking keys and scorings assigned according to the Common Vulnerability Scoring System (CVSS).

CVE-2021–41182: The insufficient sanitization of values passed as the ‘altField‘ option of the Datepicker widget would allow remote attackers to inject and run arbitrary JavaScript code in affected users’ browsers.

Hackers abuse Mitel devices to perform high-impact amplification attacks to stage massive DDoS attacks with a record-breaking amplification ratio.

---

Researchers have discovered three critical vulnerabilities in APC Smart-UPS.

Researchers have discovered three critical vulnerabilities in APC Smart-UPS.

Just as it wasn’t raining when Noah built the ark, companies must face the fact that they need to prepare — and educate the organization on — a well-thought-out response plan if a successful cyberattack does occur. Obviously, the worst time to plan your response to a cyberattack is when it happens.

With so many companies falling victim to cyberattacks, an entire cottage industry of Incident Response (IR) services has arisen. Thousands of IR engagements have helped surface best practices and preparedness guides to help those that have yet to fall victim to a cyberattack.

Recently, cybersecurity company Cynet provided an Incident Response plan Word template to help companies plan for this unfortunate occurrence.

Two such certificates were part of the Nvidia hack attack haul we reported on last week.

---

Among all the sensitive hardware and driver data spilled by hacking extortion group Lapsus$, there were some expired but still usable Nvidia code-signing certificates.