Welcome to this week’s edition of ‘This Week in Cybersecurity’ where we explore a common subject that affects us all: cybersecurity and privacy in the digital age.
Stay up-to-date with the latest development by diving into this week’s roundup. We curated short summaries of interesting articles that unfold this week ranging from the Medusa stealer which targets password manager (passbolt not in the list) and crypto wallets to the new Instagram Thread app and TootRoot vulnerability affecting mastodon. So sit back, relax and enjoy these short summaries.
1. Mastodon fixes critical “TootRoot” vulnerability allowing node hijacking
The maintenance of the Mastodon social network, which runs on open source software, has published a security update that patches a critical vulnerability, tracked as CVE-2023-36460, that allows attackers to backdoor the servers. The vulnerability, named as TootRoot, allows the attackers to create arbitrary files and execute remote code. This could potentially give the hackers the root access to instances. Such actions will bring harm to individual users and the larger internet. Mastodon released the patch after Cure53 performed the pentesting and informed large servers to ensure swift patching.
| Date: | Jul 7, 2023 |
|---|---|
| Source: | Ars TECHNICA |
| Author: | Dan Goodin |
| Tag: | Cyber Risk/Cyber Threats, Software Security |
2. New StackRot Linux kernel flaw allows privilege escalation
A security researcher has discovered a vulnerability, named as StackRot, affecting multiple Linux kernel versions that could be triggered with “minimal capabilities” and could allow the attackers to elevate privileges. This vulnerability impacts all kernel configuration on Linus version 6.1 to 6.4. A patch has been released for the affected stable kernel and plans are in place to disclose the complete technical details about StackRot and a proof-of-concept (PoC) exploit by the end of July. It is advised for the users to check their Linux distro’s kernel version and update to the latest release with the fix.
| Date: | Jul 6, 2023 |
|---|---|
| Source: | Bleeping Computer |
| Author: | Bill Toulas |
| Tag: | Vulnerability, Cyber Risk/Cyber Threats |
3. Instagram’s Twitter alternative ‘Threads’ launch halted in Europe over privacy concerns
Ireland’s Data Protection Commission (DPC) has confirmed that Instagram Threads, which is Meta’s competition with Twitter, will not be launched in the EU over privacy concerns. DPC has been in contact with Meta and confirmed it won’t extend to Europe “at this point” as Europe has stringent privacy protection laws. The application is deemed likely to collect user data. Thread, which is set to launch on July 6th, is a text-based conversation app that allows Instagram users to interact.
| Date: | Jul 5, 2023 |
|---|---|
| Source: | The Hacker News |
| Author: | Ravie Lakshmanan |
| Tag: | Tech, Data Privacy |
4. Security researchers latest to blast UK’s Online Safety Bill as encryption risk
A group of 68 security and private researchers have warned that the proposed U.K.’s Online Safety Bill security technologies and strong encryption. In an open letter, the researchers have expressed concern that the draft legislation will undermine critical security standards as it aims to push for “routine monitoring” of people’s communication, purportedly with the goal of combating the spread of child sexual abuse and exploitation (CSEA) content. Many end-to-end encryption comms services like Whatsapp, Signal, Element and Apple have echoed that they would move out from the U.K. market in case this bill passes through rather than compromising on their security standards.
| Date: | Jul 5, 2023 |
|---|---|
| Source: | Tech Crunch |
| Author: | Natasha Lomas |
| Tag: | Encryption, Data Privacy |
5. 336,000 servers remain unpatched against critical Fortinet vulnerability
Researchers believe that nearly 336,000 devices exposed to the internet remain vulnerable to critical vulnerabilities in the Fortinet firewall. The flaw, tracked as CVE-2023-27997 and has a severity rating of 9.8 out of 10, allows remote code execution in Fortigate VPNs. Security firm Bishop Fox cited that 69 percent of devices remain unpatched despite patches being released three weeks ago. They also discovered that some devices are still running outdated Fortinet software that dates back to 2015. Fortinet urges immediate patching in order to mitigate the risk.
| Date: | Jul 4, 2023 |
|---|---|
| Source: | Ars TECHNICA |
| Author: | Dan Goodin |
| Tag: | Hack, Vulnerability |
6. Evasive Medusa stealer targets 19 password managers and 76 crypto wallets
Uptycs cybersecurity researchers have recently discovered a new Window-based information stealer called Medusa stealer. It involves a “comprehensive data theft” targeting critical login credentials, browser-related data, bookmarks, password managers, crypto wallets, 2FA extensions, web browsers, Discord, Steam, etc. Medusa is being developed to evade detection by software solution and has a unique operation design, terminates an execution if it fails to connect to an attacker’s servers and exclude certain countries. It is being sold on the underground market and information is available through a user-friendly web panel.
| Date: | Jul 3, 2023 |
|---|---|
| Source: | The Hacker News |
| Author: | Ravie Lakshmanan |
| Tag: | Hack, Malware |
Conclusion
We conclude ‘This Week in Cybersecurity’ news roundup. We hope you’ve enjoyed reading these short summaries. Remember to always be vigilant by following the best security practices and stay safe online. 
Feel free to contribute any news article of the week that is not on the list in the ‘In the News’ category of Passbolt community forum and earn a batch 
.
Share your thoughts and experiences, add relevant cybersecurity news and connect with others who are passionate about online security.
We handpicked interesting article/articles of the week to be featured on our monthly video edition of “This Month in Cybersecurity” 
Cast your vote below for the article/articles you’d like us to see featured in the video:
Mastodon 
StackRot 
Instagram Threads 
U.K.'s Online Safety Bill 
Fortinet 
Medusa
0 voters