Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The A10 Networks threat research team has investigated the HTTP/2 rapid reset vulnerability ( CVE-2023-44487), which has been identified in recent days and has advised customers on the best ways to mitigate it in their network.

In recent years, blockchain technology has garnered significant attention thanks to its remarkable tamper-proof features and robust security. It is also expected that the blockchain technology market will exceed 1.2 billion US dollars by 2030, with an annual growth rate of 82.8 percent. However, recent headlines have exposed numerous vulnerabilities and cyberattacks targeting blockchain technology.

On October 16, 2023, Cisco published a security advisory regarding an actively exploited and unpatched privilege escalation vulnerability in the Web UI feature of the Cisco IOS XE operating system, both physical and virtual. The vulnerability could allow a remote, unauthenticated threat actor to create an account with maximum privileges (privilege level 15 access) on the affected device. Due to these factors, Cisco has given this vulnerability the maximum possible CVSS score of 10.

On October 18, 2023, ServiceNow published a knowledge base article revealing that they are aware of reporting that details a potential misconfiguration issue. This issue lies in the Access Control Lists (ACL) within ServiceNow that if misconfigured could result in unauthenticated threat actors being able to access data. The issue was discovered by a security engineer at AppOmni, and was disclosed in a blog to the public on October 14, 2023.

We just released a new Snyk Partner Speak Video to showcase Snyk and Slack’s joint integration that enables you to view and use Snyk data on Slack channels. The new Snyk App for Slack provides notifications within the channels your teams rely on most to address security issues in your code, open source dependencies, containers, and cloud infrastructure.

An exploit kit is a toolkit that cybercriminals use to attack the security vulnerabilities of a system or device to distribute malware. An exploit is a bit of code that takes advantage of security vulnerabilities found within software and hardware. Cybercriminals collect these bits of code and compile them into a kit that can target multiple security vulnerabilities at once, and secretly install malware on devices.

A critical vulnerability, known as CVE-2023-46747, has been discovered in the widely used F5 BIG-IP Configuration Utility. This vulnerability has been assigned a CVSS score of 9.8 (critical), denoting its high severity. What makes it particularly alarming is its potential to allow unauthenticated attackers to execute arbitrary system commands, which could lead to a compromise of the system.

As the world embraces the power of artificial intelligence, large language models (LLMs) have become a critical tool for businesses and individuals alike. However, with great power comes great responsibility – ensuring the security and integrity of these models is of utmost importance.

On Wednesday, October 18, 2023, we discovered attacks on our system that we were able to trace back to Okta – threat actors were able to leverage an authentication token compromised at Okta to pivot into Cloudflare’s Okta instance. While this was a troubling security incident, our Security Incident Response Team’s (SIRT) real-time detection and prompt response enabled containment and minimized the impact to Cloudflare systems and data.