GitLab issues security fix for hardcoded password flaw in OmniAuth

The cloud-hosted software version control service released versions 14.9.2, 14.8.5, and 14.7.7 of its self-hosted CE and EE software, fixing one “critical” security vulnerability (CVE-2022-1162), as well as two rated “high,” nine rated “medium,” and four rated “low.” “A hard-coded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in Read more about GitLab issues security fix for hardcoded password flaw in OmniAuth[…]

Fraudsters use ‘fake emergency data requests’ to steal info

Cybercriminals have used fake emergency data requests (EDRs) to steal sensitive customer data from service providers and social media firms. At least one report suggests Apple, and Facebook’s parent company Meta, were victims of this fraud. Both Apple and Meta handed over users’ addresses, phone numbers, and IP addresses in mid-2021 after being duped by Read more about Fraudsters use ‘fake emergency data requests’ to steal info[…]

Ubiquiti Files Case Against Security Blogger Krebs Over ‘False Accusations’ (for doing his job)

In March of 2021 the Krebs on Security blog reported that Ubiquiti, “a major vendor of cloud-enabled Internet of Things devices,” had disclosed a breach exposing customer account credentials. But Krebs added that a company source “alleges” that Ubiquiti was downplaying the severity of the incident — which is not true, says Ubiquiti. Krebs’ original Read more about Ubiquiti Files Case Against Security Blogger Krebs Over ‘False Accusations’ (for doing his job)[…]