Hacking Desk
The KEV named SharePoint
Hacking
Microsoft named TerminalFix
Threat Intelligence blog, 28 August. A ClickFix variant that sends the paste to Windows Terminal. Reverse tunnel. This page is the vendor note, not a kit.
Hacking
PaperCut shipped Emergency Patch Release 2 for NG and MF
Urgent bulletin 27 August AEST. Confirmed customer incidents. Restrict the Application Server web. Release 2 on 28 August for v24, v25 and v26. Two CVEs. This page is news, not a how-to.
Hacking
CISA named the week’s exploited bugs and put due dates on the cards
26 and 27 August adds to the KEV catalog. NetScaler and SQL Server were due 29 August. A kernel row is due today. The list stays. The how-to does not.
Hacking
Blue Water won DEF CON CTF at the West Hall
DEF CON 34 posted Blue Water first, 0x4B52 second, SuperDiceCodeLovers third. AUTOCRYPT Red Team cleaned the car-hacking board in 25 hours. Official results, 6–9 August, Las Vegas.
Hacking
DEF CON banned recording glasses. Prescription recorders are not exempt.
The Register filed the rule on 28 July, ahead of DEF CON 34. Surreptitious filming stays a Code of Conduct hit. EFF’s Eva Galperin welcomed it. Visible cameras are still fine.
Hacking
Lights Out got an auditor
Black Hat USA, 5 August, 3:35–4:15 p.m. PT, Mandalay Bay. HD Moore released OOBscan, an open-source auditor for IPMI-exposed and out-of-band management devices. DEF CON 34 on 8 August. runZero recap 14 August.