Threat Post

1. Once Popular Online Ad Format Opens Top Tier Sites to XSS Attacks

   Online ad industry moves away from once prolific ads that are now deemed insecure because of DOM-based XSS vulnerabilities.

2. Malware on SHEIN Servers Compromises Data of 6.4M Customers

   A data breach targeting women's apparel giant SHEIN occurred between June and August 2018.

3. Mac Mojave Zero-Day Allows Malicious Apps to Access Sensitive Info

   Malicious apps can trivially thwart Mojave 10.14's new privacy protections.

4. Cybercriminals Target Kodi Media Player for Malware Distribution

   A recent cryptomining campaign shows criminal ingenuity.

5. Adwind RAT Scurries By AV Software With New DDE Variant

   The spam campaign mostly targets victims in Turkey and Germany.

6. Google’s Forced Sign-in to Chrome Raises Privacy Red Flags

   Chrome users are now automatically signed into the browser if they're signed into any other Google service, such as Gmail.

7. Assessing the Human Element in Cyber Risk Analysis

   The human factor doesn't have to be an intangible when assessing cyber risks within a company.

8. Tricky DoS Attack Crashes Mozilla Firefox

   There are currently no mitigations for the Firefox attack, a researcher told Threatpost.

9. Podcast: Two Billion IoT Devices Still Vulnerable to BlueBorne Bug

   Up to two billion devices are still vulnerable to the BlueBorne IoT attack - and may not ever get a patch.

10. Critical Vulnerability Found in Cisco Video Surveillance Manager

    Cisco has patched vulnerability in its video surveillance manager software that could give an unauthenticated, remote attacker the ability to execute arbitrary commands on targeted systems.