Copilot Chat now has undisclosed usage caps for unlicensed users
Microsoft is expanding unpublished limits for users without the paid add-on. Features run dry and upgrade prompts appear, so expect helpdesk calls.
Affects: Microsoft 365 users of Copilot Chat without the paid add-on
Microsoft fixes Excel 2016 copy-paste bug again after it returned
Microsoft fixed an Excel 2016 copy-paste bug, reintroduced it, and has now fixed it a second time.
Affects: Excel 2016 users
CISA lists patched Apple flaw as exploited for info-stealers
CISA added a medium-severity flaw in multiple Apple operating systems to its KEV catalogue after reports of active exploitation. Attackers are using it to deliver info-stealing malware.
Affects: Apple devices running unpatched Apple operating systems
OpenSSH flaw lets attackers log in to password-disabled accounts
The "*sshole" bug lets an oversized password log attackers into accounts with password login blocked on Alpine and other musl-based Linux. A decade-old flaw, now fixed.
Affects: Alpine Linux and other musl-based Linux systems running OpenSSH
Critical Rails flaw lets attackers write files via ImageMagick uploads
An unauthenticated attacker can write arbitrary files to the server by uploading a crafted file. Only apps that process uploads with ImageMagick are exposed.
Affects: Ruby on Rails apps that process uploads with ImageMagick
DigiCert breach exposes customer data and identity documents
A server migration mistake exposed an internal business system to the internet. Unauthorised parties accessed customer information and identity documents.
Affects: DigiCert customers, including those who submitted identity documents
Zyxel GS1900 switch fix fails to stop zero-day
Switches that got Zyxel's earlier patch can still be hit by the exploit, Binarly found. Attackers who reach the web interface can run commands without logging in. Nearly 1,000 switches were already compromised.
Affects: Zyxel GS1900 series switches, including patched units
Cisco UCS Central Software has a remote code execution flaw
Cisco disclosed that an authenticated remote attacker could achieve code execution or information disclosure through the web management interface. The snippet doesn't mention exploitation.
Affects: Cisco UCS Central Software
SonicWall warns of unpatched flaws in end-of-life GMS
SonicWall disclosed two security flaws in Global Management System that it will not fix because the product is end-of-life.
Affects: SonicWall GMS (end-of-life) deployments
OpenAI AI generated 948 Linux root exploits in 30 hours
OpenAI's pipeline built 948 local privilege-escalation exploits for Linux, so low-privileged accounts on unpatched systems are effectively root. Expect exploit development to speed up.
Affects: Unpatched Linux systems
Cyberattack hits refrigeration provider, endangering French blood stocks
Attackers changed temperature and defrost settings at three French blood service sites via a refrigeration equipment provider. The US has also warned of an ongoing threat to industrial refrigeration.
Affects: Internet-reachable industrial refrigeration systems and their suppliers
This is what you get — free, in your inbox.
Subscribers also get the full “From the Floor” take with every issue — not just the summary you just read.
Written from 12 years on the helpdesk floor. Always free.