September witnessed a series of alarming cybersecurity incidents, highlighting critical vulnerabilities and significant data breaches. Among the most concerning was the discovery of multiple vulnerabilities in MikroTik's RouterOS, which are being exploited in attacks against routers. CERT Polska reported six vulnerabilities, with two classified as critical, allowing unauthorized administrative access to devices. The first critical flaw permits attackers to bypass SSH authentication due to improper RSA key verification. The second allows for privilege manipulation during SSH sessions, potentially granting full administrative rights. These vulnerabilities pose a severe risk, especially if the routers have SSH access enabled from the internet.
In a separate incident, the hacker group DataSuckers claimed responsibility for breaching the travel operator Tez Tour, defacing its website and allegedly compromising user data. They reported stealing an astonishing 395.5 million records, including sensitive information such as passports and credit card details. Tez Tour acknowledged the incident but stated no evidence of data leakage had been found. The hackers revealed that they exploited outdated software and inadequate security measures within the company’s infrastructure to execute their attack.
Additionally, Microsoft released a historic patch update, addressing a staggering 966 vulnerabilities, with 723 fixes for Windows and 222 for Office. This surge in patches is attributed to the integration of artificial intelligence in vulnerability detection and analysis, indicating a growing trend in cybersecurity management.
These events underscore the pressing need for companies to strengthen their cybersecurity measures and stay vigilant against emerging threats. As the landscape evolves, competitors must prioritize security to maintain consumer trust and protect sensitive data.
Informational material. 18+.
