Introduction On November 26, 2023,  the Guidelines for secure AI system development was jointly released by the UK National Cyber Security Centre (NCSC), the US Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the US National Security Agency (NSA), the Federal Bureau of Investigation (FBI), and the cybersecurity and information security departments of over […]

What is Zero Trust Security? Zero-trust security is not a specific technology or product, but a security model based on the concept that “All entities are untrusted”. Forrester defines zero trust as “Zero Trust is an information security model that denies access to applications and data by default. Threat prevention is achieved by only granting […]

CDIC, Nov 29-30, 2023, BITEC Bangna, Thailand. The CDIC conference & exhibition was held with the theme of “Powering Techno-Drive in Digi-Hype Behaviour towards Digital Trust”. NSFOCUS participated this pivotal event as Gold Sponsor in APAC to introduce our latest effective continuous threat exposure management (CTEM) program and XDR-powered threat analysis and response.  “Cyber Defense Initiative Conference […]

Rampant Ransomware Attacks On November 8, 2023, U.S. Eastern Time, ICBC Financial Services (FS), the U.S. arm of China’s largest bank, fell victim to a ransomware attack, disrupting certain systems. Reports indicate that the attack, linked to a Citrix vulnerability known as “CitrixBleed,” was orchestrated by the LockBit group. ICBC FS is actively investigating the […]

Overview Recently, NSFOCUS CERT found a remote code execution vulnerability in Apache ActiveMQ Jolokia (CVE-2022-41678). In the configuration of ActiveMQ, jetty allows org.holokia.http.AgentServlet to process requests for/api/Jolokia. An authenticated attacker can send a specially crafted HTTP request to write a malicious file through the Jolokia service, thus implementing remote code execution. At present, the vulnerability […]

In the digital age, Web application and API security (WAAP) has demonstrated the importance of the development of the web application and API economy, and it is becoming the new standard of the next generation of WAF. WAAP is essential in today’s digital environment. As organizations increasingly rely on web applications and APIs to support […]

The Future of Data Protection: The Emergence of Confidential Computing In today’s information age, data has become an invaluable resource ubiquitous across various sectors, from financial institutions to healthcare and scientific research. However, as data continues to grow, concerns about data privacy and security become increasingly prominent. Incidents of data breaches, hacking, and misuse of […]

Overview Recently, NSFOCUS CERT found that Apache Arrow issued a security notice, which fixed an arbitrary code execution vulnerability in the PyArrow library (CVE-2023-47248). Due to PyArrow reading Arrow IPC, Feather, or Parquet data from untrusted sources, PyExtensionType creates an automatic loading feature that allows for deserialization of data from non PyArrow sources. When using […]

“My ChatGPT isn‘t working properly.“ “I can’t log in, and it’s not responding at all.” Just as OpenAI released a series of new features recently, ChatGPT experienced prolonged service disruptions last Wednesday. Subsequently, OpenAI issued a statement revealing that they were facing periodic outages across ChatGPT and the API due to a reflective Distributed Denial […]

The market for services protecting against distributed denial of service attacks, or Anti-DDoS, has a significant focus on mitigating attacks aimed at the network layer of companies’ infrastructure. In this type of attack, infected vectors are commonly used to generate requests without the aim of concrete communication, intending to flood internet transmission links with an […]