Chrome's 8th Zero-Day 🌐 + 33 Flaws Knock N-able Offline 🔓

Two stories today hit close to home: one lives in the browser you're probably reading this in, and the other sits inside the tools many IT providers use to manage thousands of small businesses. Here's what you need to know.

Update Chrome Now: Zero-Day #8 Is Already Under Attack

Google just pushed an emergency update for Chrome to fix a security hole that hackers are already using in real attacks. The bug lives in the part of Chrome that reads XML data, and it can let an attacker run their own code on your computer, which is a fancy way of saying they could take over your machine just by getting you to load the wrong web page. This is the eighth time this year Google has had to rush out a fix for a flaw that was being exploited before anyone could patch it. With billions of people using Chrome (and many other browsers built on the same engine), this one affects nearly everyone. The fix is easy: open Chrome, go to Settings > About Chrome, let it update, and restart. Businesses should make sure updates are being pushed to every company device today, not next week.

Read more

33 Zero-Days Force N-able to Pull the Plug on N-central

N-able, whose N-central software is used by IT service providers (MSPs) to remotely manage their customers' computers, took its cloud-hosted version offline and told self-hosted customers to shut their servers down. Why? A researcher publicly released details on 33 previously unknown security flaws, nicknamed "Able2Shell," along with working attack code. The flaws range from stealing passwords to fully taking over the server with the highest level of control. N-able says it hasn't seen real-world attacks yet, but security firm watchTowr has already spotted hackers trying them out. This matters because one compromised management tool can be a master key to every business that MSP supports, so if you rely on an outside IT provider, ask them today whether they use N-central and what they're doing about it.

Read more

Stay ahead of threats with GOCO Security at gocosecurity.com.