Meta’s Llama framework, widely used for AI-powered applications, has been found vulnerable to a critical flaw labelled CVE-2024-50050. The issue arises from untrusted data deserialisation, a common vulnerability in software systems, which allows attackers to execute malicious code remotely on the llama-stack inference server.
While its CVSS score is 6.3, supply chain security experts have rated it critical, assigning a severity of 9.3 due to the potential impact on enterprise AI systems. If exploited, this flaw could compromise not only the affected server but also any system relying on it for critical functions.
AI models like Llama are becoming increasingly integrated into critical applications across industries. This vulnerability highlights the importance of maintaining robust security practices for machine learning frameworks.
Recommendations:
Researchers have identified 119 security vulnerabilities in LTE and 5G networks, which are vital to modern communication. The flaws, documented under 97 CVEs, range from issues allowing attackers to intercept data to vulnerabilities that could disrupt network services.
These flaws affect both the radio access networks and core network elements, posing risks to users and service providers alike. If exploited, they could enable man-in-the-middle attacks, denial-of-service (DoS), or unauthorised access to network controls.
With 5G adoption accelerating, secure networks are critical for industries relying on IoT, telemedicine, and smart infrastructure. Exploits targeting these flaws could have a ripple effect on connected systems.
Recommendations:
A dismissed contractor deliberately disrupted the British Museum’s IT systems, exploiting residual access privileges. The breach, which was identified a week after the individual’s termination, highlights the growing threat of insider attacks.
Insider threats, whether from current or former employees, account for a significant portion of cybersecurity incidents. This case illustrates how failing to revoke access quickly can lead to malicious activity.
Recommendations:
A concealed backdoor, triggered by a specific “magic packet,” has been discovered in Juniper routers. This backdoor allows attackers to gain unauthorised access, bypassing standard authentication mechanisms.
Routers are the backbone of corporate networks. A vulnerability like this could allow attackers to intercept traffic, deploy malware, or gain control of critical systems.
Recommendations:
TalkTalk has initiated an investigation into claims of a data breach affecting its systems. While the company asserts that the scale of the breach is likely overstated, the ongoing scrutiny emphasises the importance of transparency and rapid response during such incidents.
The mere perception of a data breach can damage customer trust. A slow or ineffective response can exacerbate the situation, leading to greater repetitional harm.
Recommendations:
A new wave of phishing attacks is targeting professionals on LinkedIn. Attackers impersonate senior executives, recruiters, or colleagues, sending connection requests to gain trust before sharing malicious links or requesting sensitive information.
LinkedIn is a trusted platform for professionals, making it an attractive target for attackers looking to infiltrate corporate networks.
Recommendations: