Sep 11, 2023
1 new incident, 2 with updates.
Started
- ClosedHighPatched
libwebp heap overflow exploited in the wild (CVE-2023-4863)
A heap overflow in libwebp's lossless decoder, found by Apple SEAR and Citizen Lab after the BLASTPASS iPhone exploit, was exploited in the wild. Because libwebp is everywhere, browsers, Electron apps and image libraries that bundle it all had to ship updates.
libwebp (Google Chrome and everything that bundles libwebp)Closed Sep 13, 2023
Updated
- ClosedHighPatched
BLASTPASS: NSO zero-click iPhone exploit chain (CVE-2023-41064, CVE-2023-41061)
Citizen Lab caught BLASTPASS, a zero-click iMessage exploit chain that delivered NSO Group's Pegasus through malicious PassKit attachments carrying images. Apple fixed the ImageIO and Wallet bugs in emergency updates the same day.
Apple iOS, iPadOS, macOS and watchOSClosed Sep 11, 2023
- ClosedHighNo fix needed
MGM Resorts and Caesars hit by Scattered Spider
Scattered Spider, an ALPHV/BlackCat affiliate, used social engineering to breach two Las Vegas casino giants. Caesars lost its loyalty program database and reportedly paid about $15M. MGM shut down systems for days and estimated a $100M hit, with pre-March-2019 customer data stolen.
MGM Resorts International; Caesars EntertainmentClosed Oct 5, 2023
