The number of these attacks has been steadily growing, from 17 in 2017 to 80 in 2021. Google alone has suffered at least six zero day attacks already this year. And while this trend is alarming, what’s even more disturbing is the highly organized development process behind these attacks that has evolved over time. -Full Security Week Story
Google Forms abused in new COVID-19 phishing wave in the U.S.
COVID-19-themed phishing messages are once again spiking in the U.S. following a prolonged summer hiatus that appears to be over. According to a report by email security company INKY shared with BleepingComputer before publication, the malspam volumes have doubled in September compared to the previous three months and are set to rise even more. -Full Bleeping Computer Story
Colorado.gov Back Online After Cyber Attack
Colorado restored its state web portal home page and is working with state and federal partners to investigate the incident. Other sources have named pro-Russian hackers, Killnet, as the perpetrators. -Full GovTech Story
Microsoft Latest Patch Fixes New Windows Zero-Day With No Patch for Exchange Server Bugs
Recent news reports show that Microsoft's Patch Tuesday update for the month of October has addressed a total of 85 security vulnerabilities, including fixes for an actively exploited zero-day flaw in the wild. -Full IT Security Guru Story
Education, Grants, & Tips
What Cities Should Know About the State and Local Cybersecurity Grant Program
The U.S. Department of Homeland Security (DHS) and Federal Emergency Management Agency (FEMA) recently released the notice of funding opportunity for the State and Local Cybersecurity Grant Program (SLCGP). This program is funded through the Bipartisan Infrastructure Law and provides a total of $1 billion dollars in cybersecurity related funding over the next four years, with $185 million dollars available for FY22, specifically targeted to state, local and territorial governments across the nation. -Full NLC Article
EPA Water & Wastewater Grant
Technical assistance to improve cyber incident preparation, response, and recovery to maintain critical operations and meet water quality goals. No closing date.
Microsoft has released updates to address multiple vulnerabilities in Microsoft software. An attacker can exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Microsoft’s October 2022 Security Update Summary and Deployment Information and apply the necessary updates. Read Full Entry »
CISA, the Federal Bureau of Investigation (FBI), and the National Security Agency (NSA) have released a joint Cybersecurity Advisory (CSA) providing the top Common Vulnerabilities and Exposures (CVEs) used since 2020 by People’s Republic of China (PRC) state-sponsored cyber actors. PRC state-sponsored cyber actors continue to exploit known vulnerabilities to actively target U.S. and allied networks, including software and hardware companies to illegally obtain intellectual property and develop access into sensitive networks. Read Full Entry »
Cisco has released security updates to address vulnerabilities in multiple Cisco products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page. CISA encourages users and administrators to review the following advisories and apply the necessary updates: Read Full Entry »
CISA Current Activity PageThe US-CERT Current Activity web page is a regularly updated summary of the most frequent, high-impact types of security incidents currently being reported to the US-CERT.
