Lifeboat Foundation: Safeguarding Humanity
Toggle light / dark theme

Blog – Page 4

Get the latest international news and world events from around the world.

Log in for authorized contributors

Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance’s operating system, Cisco said in an advisory on Wednesday.

The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization’s email for spam, malware, and other threats, and only a gateway with the File Reputation service enabled and a Content Scanner Tools package older than version 25.3.0.5525 is vulnerable.

The fix has been shipping since September 14 in AsyncOS 15.5.5–014 and 16.5.0–780, the builds Cisco listed as fixed in a hardening release that day, which the company now says covered this flaw. It also arrives as a Content Scanner Tools update, version 25.3.0.5525 or later, which installs without a software upgrade or a restart.

Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks

“However, Play Protect also provides offline detection for known potentially harmful applications, meaning that the mechanism does not completely disable its protection,” ThreatFabric noted last month. “We therefore assess that the technique is more likely intended to reduce the effectiveness of online reputation and code-analysis mechanisms rather than bypass Play Protect entirely.”

Depending on the nature of the lure app used, the dropper is also designed to serve bogus screens to capture payment PINs, serve fake screens requesting login credentials for banks and wallet apps, display fake lock screen pattern and PIN overlays, and facilitate total remote control of the device.

While all this behavior is par for the course when it comes to Android banking trojans, it’s their attempts to replace the target banking app with a tampered copy that stand out. Specifically, the purpose-built replacements embed a hooking engine to blind signature, accessibility, screen-capture, and Play Integrity checks from within the app. The replacement targets eight Indonesian apps.

Microsoft: Recent Windows updates may trigger Remote Desktop failures

Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the “Administrator protection” security feature is enabled.

This feature began rolling out with the KB5067036 preview cumulative update to systems running Windows 11 24H2/25H2 in October 2025, and it is now enabled by default in organizations using Windows security baselines after installing the October 2026 Windows security update.

When toggled on, admin protection ensures logged-in users have only standard user permissions and prompts them to authenticate via Windows Hello (PIN or biometric) when they try to install new apps or change the Windows registry.

Microsoft fixes VPN issues caused by September Windows updates

Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates.

The Always On VPN remote access solution replaced the legacy DirectAccess technology and works with domain-joined, non-domain-joined, and Microsoft Entra ID–joined Windows 10, Windows 11, and Windows Server devices.

Always On VPN runs in the background and automatically establishes a secure tunnel back to the corporate network whenever a device connects to the internet.