Create accountLogin

Recent searches

No recent searches

Search options

Not available on kolektiva.social.
kolektiva.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Kolektiva is an anti-colonial anarchist collective that offers federated social media to anarchist collectives and individuals in the fediverse. For the social movements and liberation!

Administered by:

Server stats:

3.6K
active users

kolektiva.social: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

#infosec

730 posts366 participants50 posts today
Public
Lenin alevski 🕵️💻

How much damage can a printer driver vulnerability really cause? 🖨️💥

A lot, if you're looking at CVE-2025-1268—a critical code execution flaw rated 9.4 on the CVSS scale, recently discovered by Microsoft’s MORSE (Offensive Research and Security Engineering) team. The bug affects a wide range of Canon printer drivers used in production printers, office multifunction devices, and smaller laser printers.

The vulnerability stems from an out-of-bounds memory issue in how certain Canon drivers handle EMF recoding—specifically in Generic Plus PCL6, UFR II, LIPS4, LIPSXL, and PS driver families. If a malicious application feeds it a crafted print job, this could lead to remote code execution or disrupt printing altogether.

What makes this more concerning is the attack surface: these printers are commonly deployed across enterprise and small business environments. If exploited, an attacker could run arbitrary code with the same privileges as the print process—often SYSTEM-level on Windows systems. That's not just a printer glitch; it's a potential network breach vector.

Canon has acknowledged the issue and plans to release updated drivers across regional websites. The company also warned about other vulnerabilities involving buffer overflows, which could allow for similar attacks or Denial-of-Service if the device is exposed directly to the Internet.

In short, unpatched printer drivers are more than an inconvenience—they're a legitimate security risk. If you're running Canon hardware, it may be time to review your driver versions and update where needed.

#Infosec #Cybersecurity #Software #Technology #News #CTF #Cybersecuritycareer #hacking #redteam #blueteam #purpleteam #tips #opensource #cloudsecurity

— ✨
🔐 P.S. Found this helpful? Tap Follow for more cybersecurity tips and insights! I share weekly content for professionals and people who want to get into cyber. Happy hacking 💻🏴‍☠️

Public
HelloRisk

SABSA® Certified but asking yourself how to start or continue your Security Architecture journey? 
How to build the (Enterprise) Security Architecture for the company?

Look no further. We have designed a training dedicated to the application of hashtag#SABSA. Where we during the course provide you workshops to experience how it can be done, provide you with examples you can use, help you start your template and roadmap to start when you’re back at work.

There’s no need to be certified in SABSA to attend this course. We will provide you the right information about the essential elements to help you kickstart your (E)SA journey.

Register for a course now at hellorisktraining.com

HelloRisk Training · Home - HelloRisk TrainingOffered in both virtual and face-to-face formats.
#SABSA#riskmanagement#infosec
Public
BeyondMachines :verified:

Fortinet reports hacker technique for Persistent Access to FortiGate Devices after patching
#cybersecurity #infosec #advisory #databreach
beyondmachines.net/event_detai

BeyondMachinesFortinet reports hacker technique for Persistent Access to FortiGate Devices after patchingFortinet discovered a sophisticated post-exploitation technique where threat actors maintain persistent read-only access to vulnerable FortiGate devices by creating a symbolic link between user and root filesystems in the SSL-VPN language files folder, allowing continued access to sensitive configuration files even after security patches for the initial vulnerabilities have been applied.
Public
🌱 Ligniform :donor:​

Just experienced the "Verify your identity, run this powershell script" attack.

User said they ran it 4-5 times to be sure. Fair enough.

Blaming users is never the right course of action here, especially when Defender picked it up (as a high) and did nothing except raise an alert.

Makes me want to write some EDR rules for this though, some that actually work.

Just a normal day!

#InfoSec#CyberSecurity#EDR
Public
BeyondMachines :verified:

Siemens reports multiple critical vulnerabilities in SENTRON 7KT Data Manager, won't be patched
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

BeyondMachinesSiemens reports multiple critical vulnerabilities in SENTRON 7KT Data Manager, won't be patchedSiemens disclosed nine severe security vulnerabilities in all versions of the SENTRON 7KT PAC1260 Data Manager, including hardcoded credentials (CVSS 10.0) and multiple command injection flaws (CVSS 9.4), but rather than providing patches, the company recommends customers replace the affected devices with the newer 7KT PAC1261 model.
Public
Xavier «X» Santolaria :verified_paw: :donor:

📨 Latest issue of my curated #cybersecurity and #infosec list of resources for week #15/2025 is out!

It includes the following and much more:

🇺🇸 The U.S. Department of Justice has disbanded its National #Cryptocurrency Enforcement Unit;

🇳🇱 To tackle #espionage, Dutch government plans to screen university students and researchers;

🐛 Another busy #PatchTuesday;

🐛 #NIST will mark all CVEs published before January 1, 2018, as 'Deferred';

🇺🇸 Trump Signs Memorandum Revoking Security Clearance of Former #CISA Director Chris Krebs;

🇨🇳 #China Admitted to Volt Typhoon #Cyberattacks on US Critical Infrastructure;

Subscribe to the #infosecMASHUP newsletter to have it piping hot in your inbox every week-end ⬇️

infosec-mashup.santolaria.net/

X’s InfoSec Newsletter🕵🏻‍♂️ [InfoSec MASHUP] 15/2025The U.S. Department of Justice has disbanded its National Cryptocurrency Enforcement Unit; To tackle espionage, Dutch government plans to screen university students and researchers; Another busy Patch Tuesday; NIST will mark all CVEs published before January 1, 2018, as 'Deferred'; Trump Signs Memorandum Revoking Security Clearance of Former CISA Director Chris Krebs; China Admitted to Volt Typhoon Cyberattacks on US Critical Infrastructure;
ExploreLive feeds
About