CocoaPods, a dependency manager used in over three million applications coded in Swift and Objective-C, has left thousands of packages exposed and ready for takeover for nearly a decade. The issue was discovered by Israeli firm EVA Information Security and affects 1,870 Pods that remained unclaimed by their owners. The problem allowed an attacker to…
Wise, a fintech firm, and Affirm, a buy-now-pay-later services provider, have revealed that the recent data breach suffered by Evolve Bank impacts some of their customers. The breach was caused by the LockBit ransomware group, which stole customer information including names, Social Security numbers, bank account numbers, and contact information from Evolve’s databases and file…
Meta’s ad-free subscription in the European Union (E.U.) has been accused by regulators of breaching competition rules, specifically the Digital Markets Act (DMA). The issue lies with Meta’s “pay or consent” model, which forces users to choose between seeing ads or paying to avoid them, failing to provide a less personalized but equivalent alternative. Read…
Splunk announced patches for 16 vulnerabilities in its Enterprise and Cloud Platform products, including six high-severity bugs. Three of these high-severity issues are remote code execution flaws that require authentication for successful exploitation. The first RCE bug affects Splunk Enterprise versions 9.2.x, 9.1.x, and 9.0.x and can be mitigated by disabling the ‘splunk_archiver’ application or…
A South Korean ERP vendor’s product update server was compromised and used to deliver malware instead of updates. The attack, detected by AhnLab, resembles tactics used by North Korea-linked group Andariel. The malware, named Xctdoor, can steal system information, execute commands from the attacker, and capture screenshots, keylogs, and clipboard logs. It can also transmit…