Microsoft fixes exploited Outlook attack in massive patch release

Daily Cyber News: N-able takes hosted management platform offline over disclosed risks N-able customers face management disruption after the company took its hosted N-central environment offline as a precaution. The action followed public disclosure of 33 critical security vulnerabilities while a hotfix was still being developed. N-able said it had not seen active exploitation at the time of its notice. Key context: Hosted customers cannot access the classic N-central environment, and associated services may be unavailable. Additional detail: Keep affected servers offline, use the alternate services that remain available, and wait for N-able’s remediation guidance before restoring access. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, active exploitation, N-able, takes, hosted, management, platform, offline.

Daily Cyber News: Trusted cloud access exposes multiple AWS environments and data Multiple AWS environments had secrets and data accessed after a threat actor used credentials from an account associated with Qubole. Between October 14th and October 26th, the attacker assumed customer roles that still trusted the vendor account. Some of those roles had little or no recent legitimate use. Key context: The incident turned a routine integration into a cloud supply-chain risk. Additional detail: Organizations should audit external AWS trust relationships, remove unused roles, revoke suspicious sessions, and rotate every secret those sessions could read. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, Trusted, cloud, access, exposes, multiple, environments, data.

Daily Cyber News: Microsoft fixes exploited Outlook attack in massive patch release Organizations face an actively exploited Outlook credential-theft path within a record-breaking Microsoft update covering one thousand two hundred thirty five flaws. A malicious message file must be opened. Outlook can then connect to an attacker-controlled location without showing its usual external-content warning and expose an NTLM authentication hash. Key context: The size of the update creates a difficult prioritization problem for large Windows estates. Additional detail: Patch the exploited Outlook issue first, then accelerate testing and deployment for exposed network services and high-value systems. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, remote code execution, windows, Microsoft, fixes, exploited, Outlook, attack.

Daily Cyber News: Railway breach leads to $740,000 in fraudulent AI charges Railway customers face about seven hundred forty thousand dollars in fraudulent AI usage after attackers stole authentication secrets. The company says the attackers exploited two infrastructure weaknesses, obtained internal source code, and reached credentials used to decrypt customer environment variables. At most one point eight five percent of workspaces, or approximately one hundred thousand, were potentially affected. Key context: The incident shows how stolen platform secrets can create immediate financial harm. Additional detail: Organizations should rotate potentially exposed secrets, revoke linked tokens, and immediately review AI-provider usage for unauthorized charges. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, Railway, breach, leads, fraudulent, charges.

Daily Cyber News: Email security gateways targeted for full administrative control A small number of organizations were compromised through two recently patched Barracuda Email Security Gateway weaknesses. When used together, the issues can bypass authorization and execute commands with root privileges. Successful attacks require access to the appliance’s administrative interface. Key context: A compromised email security appliance gives an attacker high-level control over a trusted system at the edge of an organization. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, Email, security, gateways, targeted, full, administrative, control.

Daily Cyber News: Stale cloud trust opens customer data to supply-chain theft Customer data was stolen after attackers used compromised credentials linked to Qubole’s AWS account to assume trusted roles in other organizations’ cloud environments. The campaign affected over a dozen organizations and ran from October 14th to October 26th. Attackers enumerated resources, collected secrets and configurations, and exfiltrated data from S3 buckets. Key context: Cross-account roles are normal for cloud services, but they can preserve powerful access after a business relationship ends. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, Stale, cloud, trust, opens, customer, data, supply-chain.

Daily Cyber News: Remote management platform shut down after 33 flaws go public Remote administration was interrupted after N-able took its hosted N-central service offline and urged customers to disconnect self-hosted deployments. A researcher had published details and proof-of-concept code for 33 issues without advance remediation. The disclosed attack chains could steal credentials, create administrative accounts and gain high-level control. Key context: The concern is the reach of the platform. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, Remote, management, platform, shut, down, flaws, public.

Daily Cyber News: Cyber sabotage ruins food and sparks fires across French stores Food was destroyed and at least 15 fires were reported after attackers remotely altered refrigeration systems at around 700 French grocery stores. Temperatures reached 50 Celsius for about six hours, forcing businesses to discard fresh and frozen goods. French authorities attributed the October 12th sabotage to Shahid Kaveh, a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps. Key context: This incident turned access to industrial controls into physical, financial and food-safety consequences. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, sabotage, ruins, food, sparks, fires, across, French.

Daily Cyber News: Update 05 — English headline pending More than 1.3 million Android-based devices across over 200 countries were enrolled in a botnet through software embedded directly in device firmware. Most were TV set-top boxes, but investigators also observed telehealth equipment, karaoke machines and digital signs. Key context: The compromised devices could provide residential proxy access, deliver additional malware and support fraud. Additional detail: For leaders, the case shows that low-cost connected hardware can introduce supply-chain risk before it ever reaches the organization’s network. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, malware, English, headline, pending.

Daily Cyber News: Cloud breach may expose data tied to 7.7 million shoppers Personal information tied to as many as 7.7 million people may have been exposed after unauthorized access to a cloud service used by the Iris Plaza shopping platform. The potential total includes 5.8 million registered or former members and 1.9 million non-members. Key context: The operator suspended the store and related systems after finding a suspicious file. Additional detail: For leaders, the important point is that retention and vendor decisions determine the possible size of a breach before an attacker arrives. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, Cloud, breach, expose, data, tied, million, shoppers.