Kubernetes bug enables remote code execution on Windows nodes: Cyber Security

TLDR:

• A security bug in Kubernetes allows for remote code execution on Windows nodes.
• Google is adding real-time phishing protection to Chrome.

A security bug has been discovered in the Kubernetes container-management system that allows attackers to remotely execute code with system privileges on Windows endpoints. This bug, tracked as CVE-2023-5528, could potentially lead to a full takeover of all Windows nodes in a Kubernetes cluster. The exploit allows manipulation of Kubernetes volumes, enabling attackers to gain remote code execution. A patch is available for vulnerable systems.

Google has announced an enhancement to Chrome’s Safe Browsing feature with real-time phishing and malware protection. This upgrade shifts the process to real-time checks against a server-side list, blocking 25% more phishing attempts by verifying sites in real-time. The update also extends to Android devices with added privacy measures to prevent tracking of user browsing activity. Sources used for these updates include Bleeping Computer and Dark Reading.

Additionally, Cybersecurity Today reports a massive cyber-attack on the French government, with attacks of unprecedented intensity targeting several departments. While the impact of the attacks has been mitigated, the attacks are ongoing, with the identity of the attackers remaining unclear. The French cybersecurity agency and government departments are working to counter the attacks. Politico provides further details on the cyber-attack.

Research conducted by the Salt Labs team identified vulnerabilities in ChatGPT plugins, posing security risks for users. Vulnerabilities included exploitable plugin installation processes, framework flaws, and open authorization redirection manipulation. OpenAI has addressed the vulnerabilities and intends to deprecate plugins in the next month, replacing them with new user-generated GPTs. Concerns remain about security and quality control for existing and future GPTs. Salt Labs notified OpenAI and relevant third parties about the vulnerabilities.