Hackers exploited a flaw in third-party software and stole the personal information of school district staff and students.
The post Frontline Education Data Breach Impacts Over 1.3 Million appeared first on SecurityWeek.
Password manager mSecure has warned customers to change their passwords, reset two-factor authentication, and potentially remove their passkeys after detecting suspicious activity, but it has not explained what happened or whether anyone's secrets were exposed.
In an email sent to customers on November 3, seen by The Register, US-based developer mSeven Software said it launched an investigation after discovering something amiss with its password management application.
"mSeven Software ('mSeven') recently learned of suspicious activity associated with the mSecure password management application," the company wrote. "In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist."
The company has yet to answer what the suspicious activity involved, when it occurred, or whether attackers accessed customer information.
Its advice to customers, however, suggests that they should take this seriously.
"Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application," the email continued. "This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys."
For anyone with hundreds of passwords stored in mSecure, that's potentially hours of work. And without knowing what happened, customers have no way of telling which credentials they actually need to replace.
The warning has understandably gone down poorly with customers, who have taken to mSecure's support forum demanding answers.
"Please provide more context to your email below advising there has been a security breach," one customer wrote. "It is not acceptable to offer the vague advice 'take steps'. Please state what remedial action is required, and what data was compromised."
Others are wondering whether they're expected to spend the next several days changing every password they've ever saved.
"I have over 800 passwords in mSecure, is the email saying I need to change all of them!" another customer asked.
A separate user, who said they had more than 500 passwords stored in the application, questioned whether the warning applied to every two-factor authentication method and passkey associated with their accounts, or just those used to access mSecure itself.
The confusion has also spilled onto Reddit, where customers have shared copies of the vague notification and questioned what might have happened.
mSeven has yet to respond to The Register's questions, leaving customers to guess whether their data has actually been compromised or the company is simply being cautious. That's not exactly reassuring from a business whose entire purpose is keeping other people's secrets safe.
The company's email concludes: "We regret any inconvenience that this may cause." For customers contemplating hundreds of password resets, "inconvenience" may be putting it mildly. ®
Microsoft Edge now automatically disables website notifications when Microsoft Defender SmartScreen or the Scareware blocker detects a scam reached through those notifications.
Microsoft introduced the protection with Edge 156, rolled out in October 2026. The change targets persistent notification abuse, where malicious websites repeatedly deliver fabricated antivirus warnings and deceptive security alerts after users grant permission.
The attack begins when a malicious page persuades visitors to select “Allow” on a browser notification request, sometimes disguising that action as human verification.
Once permission is granted, attackers can send alerts after the original page closes, repeatedly directing victims toward fraudulent destinations.
This delivery mechanism also appears in Matrix Push C2, a browser-native command-and-control framework that abuses web push notifications to distribute phishing lures, fake update prompts, and links leading to malicious payloads.
Microsoft identified the abuse pattern while reviewing user-submitted Scareware blocker reports. Many detected scam pages originated from website notifications, exposing a recurring pathway that existing page-level blocking did not eliminate.
Edge now connects the detected scam with the website responsible for sending its notification and disables that site’s notifications. On the next browser startup, an information bar explains the intervention.
Users can inspect blocked websites and restore notification permissions through Edge Settings when they believe a decision was incorrect. This approach interrupts the repeat-delivery channel rather than only blocking an individual scam destination.
Comparable notification permission revocation mechanisms in Chrome target abusive websites and coordinated notification networks, although Microsoft’s disclosed trigger specifically connects SmartScreen or Scareware blocker detections to notification sources.
Microsoft says Scareware blocker directly protects tens of thousands of users daily, while associated intelligence supports SmartScreen protections for millions more. Its preview findings indicated that each submitted report could help protect 50 additional users.
Edge also adds a “Block and report” option to notification permission requests, allowing users to flag deceptive prompts before notifications arrive.
The option appears in the menu beside “Block.” Reports can include the requesting URL and a screenshot showing how the page attempted to obtain consent.
Microsoft says this evidence can inform SmartScreen before the first abusive notification is delivered, extending intervention from detected scam destinations back to the initial permission-acquisition stage.
Deceptive verification pages require careful distinction. Notification abuse asks users to authorize browser messages, while ClickFix command execution persuades victims to paste and run commands through Windows interfaces.
Both exploit familiar verification workflows, but the resulting actions differ: one establishes a notification channel; the other can launch malware directly.
Microsoft’s announcement describes notification-source blocking and reporting, not a universal defense against every fake CAPTCHA infection chain.
Users can still disable unwanted notifications manually through the notification’s three-dot menu. Microsoft cautions that other buttons inside deceptive alerts may open additional popup windows instead of resolving the supposed security problem.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
The post Microsoft Edge Now Automatically Blocks Malicious Browser Notifications Used in Scareware Attacks appeared first on Cyber Security News.
The browser update resolves dozens of memory safety bugs and incorrect/missing authorization issues.
The post Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical appeared first on SecurityWeek.
SolarWinds has released Dameware 2026.3.1 to address CVE-2026-28336, a critical command injection flaw that could compromise remotely controlled hosts.
The issue carries a severity score of 9.9 and requires authentication, distinguishing it from an unauthenticated attack.
The fixed release became available on November 3, 2026. The affected product range includes Dameware 2026.3 and all previous versions, with 2026.3.1 identified as the corrected release.
SolarWinds describes the impact as compromise of the remotely controlled host but does not disclose the affected command handler, injectable parameter, payload structure, or execution privileges.
Those omissions limit conclusions about the precise exploitation sequence and whether particular deployment configurations change exposure.
Authentication is a prerequisite, not evidence that exploitation requires administrator privileges. The release notes do not specify the minimum account permissions necessary to trigger the command injection.
This differs from the privilege escalation and remote code execution issues disclosed in SolarWinds Serv-U, where published reporting identifies specific authenticated roles and access-control failures. Those Serv-U exploitation conditions should not be transferred to Dameware.
The same Dameware update fixes CVE-2026-28335, an authenticated buffer overflow carrying an 8.4 severity score that can result in remote code execution.
Bernatowicz also reported that issue. A third fix addresses CVE-2026-28327, an 8.2-rated DLL hijacking flaw restricted to installation activity.
Exploiting the DLL issue requires local machine access and administrator privileges, making its prerequisites materially different from the command injection disclosure.
The distinction between authenticated and unauthenticated execution remains central to interpreting these advisories. Separate deserialization of untrusted data and integrity-check failures in SolarWinds Observability Self-Hosted involved unauthenticated attackers under specified configuration conditions.
SolarWinds has not described equivalent configuration prerequisites for CVE-2026-28336 in the Dameware release notes. The disclosed common consequence is remote compromise, rather than a shared underlying exploit mechanism.
Command injection also appears in unrelated SNMP command execution reporting involving Zimbra, where crafted emails reached an optional monitoring component.
That documented entry point does not establish how Dameware processes malicious input. SolarWinds’ Dameware release notes provide neither exploit commands nor indicators of compromise and do not report active exploitation.
Consequently, claims of a public attack chain or observed campaign would exceed the vendor’s published account. Remediation is available through the Dameware 2026.3.1 upgrade.
SolarWinds recommends using the same administrator account used for the previous installation and notes that elevated privileges may be necessary.
Its installation guidance also calls for backing up applicable Remote Support registry settings and saved hosts, or Mini Remote Control settings and hosts, because newer versions changed saved-host protection mechanisms.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
The post Critical SolarWinds Dameware Flaw Allows Attackers to Execute Commands on Remote Systems appeared first on Cyber Security News.
Log in
