Les vulnérabilités critiques à suivre (30 octobre 2023)

Voici la sélection des vulnérabilités de cybersécurité les plus critiques découvertes la semaine passée.

Vous retrouvez ci-dessous les liens directs vers les articles les plus intéressants. Pour information, cette veille est préparée avec un vrai cerveau non artificiel, alors bonne lecture et merci de soutenir le Décodeur !

Les actus sélectionnées cette semaine

Google expands its bug bounty program to target generative AI attacks
New guidance outlines what discoveries garner financial rewards.

Windows : plus d’un million de PC infectés, ce malware est resté invisible pendant 5 ans
Les chercheurs de Kaspersky ont trouvé un malware bien caché depuis 5 ans. Il a infecté au moins 1 million de PC sous Windows et Linux.

HackerOne paid ethical hackers over $300 million in bug bounties
HackerOne has announced that its bug bounty programs have awarded over $300 million in rewards to ethical hackers and vulnerability researchers since the platform’s inception.

Hackers earn over $1 million for 58 zero-days at Pwn2Own Toronto
The Pwn2Own Toronto 2023 hacking competition has ended with security researchers earning $1,038,500 for 58 zero-day exploits (and multiple bug collisions) targeting consumer products between October 24 and October 27.

Apple fixes bug that undermined iOS privacy feature for years | TechCrunch
Apple has released a fix for a years-old vulnerability in iOS that rendered one of its privacy-enhancing features near useless since launch.

Attaque iLeakage : Safari peut révéler des informations très sensibles
Safari, le navigateur d’Apple, a une fuite. En exploitant des failles de sécurité liées non seulement à WebKit (le moteur de rendu du logiciel) mais aussi aux puces du constructeur, des pirates seraient en mesure de récupérer des informations confidentielles. Le constructeur travaille à un correctif.

New iLeakage attack steals emails, passwords from Apple Safari
Academic researchers created a new speculative side-channel attack they named iLeakage that works on all recent Apple devices and can extract sensitive information from the Safari web browser.

F5 fixes BIG-IP auth bypass allowing remote code execution attacks
A critical vulnerability in the F5 BIG-IP configuration utility, tracked as CVE-2023-46747, allows an attacker with remote access to the configuration utility to perform unauthenticated remote code execution.

VMware vCenter Server Flaw Let Attacker Execute Remote Code
VMware has been discovered CVE-2023-34048 and CVE-2023-34056, associated with Out-of-Bounds Write and Partial Information Disclosure.

Google Offers Its $12 Million Bug Bounty To Hackers Who Find AI Threats
Google has opened the doors to hackers looking to hack the AI systems and services it is offering. Here’s everything you need to know.

SolarWinds fixed three critical RCE flaws in its Access Rights Manager product
Researchers discovered three critical remote code execution vulnerabilities in the SolarWinds Access Rights Manager (ARM) product.

Hackers update Cisco IOS XE backdoor to hide infected devices
The number of Cisco IOS XE devices detected with a malicious backdoor implant has plummeted from over 50,000 impacted devices to only a few hundred after the attackers updated the backdoor to hide infected systems from scans.

Samsung Galaxy S23 hacked twice on first day of Pwn2Own Toronto
Security researchers hacked the Samsung Galaxy S23 twice during the first day of the consumer-focused Pwn2Own 2023 hacking contest in Toronto, Canada.

Citrix Bleed exploit lets hackers hijack NetScaler accounts
A proof-of-concept (PoC) exploit is released for the ‘Citrix Bleed’ vulnerability, tracked as CVE-2023-4966, that allows attackers to retrieve authentication session cookies from vulnerable Citrix NetScaler ADC and NetScaler Gateway appliances.

Hackers can force iOS and macOS browsers to divulge passwords and much more
iLeakage is practical and requires minimal resources. A patch isn’t (yet) available.

Pro-Russia hackers target inboxes with 0-day in webmail app used by millions
Previously unknown XSS in Roundcube let Winter Vivern steal government emails.

Samsung Galaxy S23 hacked two more times at Pwn2Own Toronto
Security researchers hacked the Samsung Galaxy S23 smartphone two more times on the second day of the Pwn2Own 2023 hacking competition in Toronto, Canada.

D.C. Board of Elections: Hackers may have breached entire voter roll
The District of Columbia Board of Elections (DCBOE) says that a threat actor who breached a web server operated by the DataNet Systems hosting provider in early October may have obtained access to the personal information of all registered voters.

Cette veille indépendante vous est utile ?
Offrez un café pour soutenir le serveur (et le rédacteur).

L'essentiel Cybersécurité, IA & Tech

Rejoignez la communauté. 3 fois par semaine, recevez l'analyse des tendances par Marc Barbezat. Pas de spam, juste de l'info.

Ou suivez le flux temps réel

☕ Je soutiens DCOD

💡 Ne manquez plus l’essentiel

Les derniers articles

Le top 5 des actus cybersécurité -3 déc 2025

Quand une victime transforme une demande de rançon en soutien à la recherche

Cyber IA : actualités du 3 déc 2025

Comment Jeffrey Epstein a utilisé le SEO pour dissimuler un scandale

Radicalisation sur les plateformes de jeu : une infiltration massive

Toutes les catégories

Les vulnérabilités critiques à suivre (30 octobre 2023)

Les actus sélectionnées cette semaine

Google expands its bug bounty program to target generative AI attacks

Windows : plus d’un million de PC infectés, ce malware est resté invisible pendant 5 ans

HackerOne paid ethical hackers over $300 million in bug bounties

Hackers earn over $1 million for 58 zero-days at Pwn2Own Toronto

Apple fixes bug that undermined iOS privacy feature for years | TechCrunch

Attaque iLeakage : Safari peut révéler des informations très sensibles

New iLeakage attack steals emails, passwords from Apple Safari

F5 fixes BIG-IP auth bypass allowing remote code execution attacks

VMware vCenter Server Flaw Let Attacker Execute Remote Code

Google Offers Its $12 Million Bug Bounty To Hackers Who Find AI Threats

SolarWinds fixed three critical RCE flaws in its Access Rights Manager product

Hackers update Cisco IOS XE backdoor to hide infected devices

Samsung Galaxy S23 hacked twice on first day of Pwn2Own Toronto

Citrix Bleed exploit lets hackers hijack NetScaler accounts

Hackers can force iOS and macOS browsers to divulge passwords and much more

Pro-Russia hackers target inboxes with 0-day in webmail app used by millions

Samsung Galaxy S23 hacked two more times at Pwn2Own Toronto

D.C. Board of Elections: Hackers may have breached entire voter roll

L'essentiel Cybersécurité, IA & Tech

Marc Barbezat

Des idées de lecture cybersécurité

💡 Ne manquez plus l’essentiel

Les derniers articles

Toutes les catégories

Les actus sélectionnées cette semaine

L'essentiel Cybersécurité, IA & Tech

A lire également

Des idées de lecture cybersécurité