Here is our latest roundup of news about digital security in our connected world. Click here to see the whole series.

DigiCert news

• DigiCert Secure Software Manager now supports the GPG Keyring. For those who need to sign code on Linux or for git commits, or who need OCI-compliant container signing with Redhat tools, this is a significant milestone.  
• DigiCert, partnered with EONTI, was selected by the Western Canadian NG9-1-1 network operator to secure the next generation of 911 systems.
  
• DigiCert will support Matter, a new protocol to provide a standard for secure, reliable interoperability for smart home devices, mobile apps and cloud services. DigiCert can help manufacturers become Matter-compliant now, in preparation for the holiday shopping season when many consumers will be looking to purchase new smart home devices.
  

Browser

• Apple will start supporting VMCs in iOS 16 and MacOS Ventura. This shows a growing trend of adoption of VMCs. 
  

TLS/SSL

• On July 21, it was publicly confirmed that Entrust suffered a cyberattack on June 18 of this year. Their internal network was breached by a third party, and corporate data was stolen. However, it is not yet known if customer and/or vendor data was stolen. Entrust sent a security notice to their customers on July 6 letting them know of the data breach, saying that “we have found no indication to date that the issue has affected the operation or security of our products and services.”
  

Malware

• Google pulled about 60 malware-infected apps from the Play Store, but they have already been installed on over 3 million Android devices. The malware can steal credentials, spy on SMS messages, contact lists, and even sign up the victim for premium WAP services. The impacted apps include Vlog Star Video Editor, Creative 3D Launcher, Wow Beauty Camera, Gif Emoji Keyboard and more.
• GitHub was flooded this month with about 35,000 clone project files that stored malware. While it’s common to clone open-source projects among developers, in this case attackers cloned legitimate projects but added malware to them and reposted them to GitHub. GitHub has since removed most of the malicious repositories. 
  
• Researchers warn that attackers are increasingly using fake Microsoft and Google software updates to spread malware. HavanaCrypt is the latest ransomware to attempt fake updates in Windows 10, Microsoft Exchange and Google Chrome.
  

Vulnerabilities

• An OpenSSL bug in the 3.0.4 release could lead to remote code execution. OpenSSL released an advisory on the situation in early July and recommends that users upgrade to OpenSSL 3.0.5 as soon as possible to avoid the issue. 
  
• Apple released security patches for all of their devices to fix dozens of vulnerabilities in July. The patches solve at least 37 different flaws on iOS, iPadOS, macOS, watchOS and tvOS. 
  
• Google Drive has been used to distribute malware, researchers warned in mid-July. APT29, the threat group behind the SolarWinds attack, is using Google Drive to target diplomats and embassies in Portugal and Brazil with malware. 
  

Data breaches

• The British Army experienced a hack on their Twitter and YouTube accounts in early July. The hackers posted videos on cryptocurrency on their YouTube channel and NFT-related posts on Twitter. A culprit has not been named, but the British Army has regained control of both accounts. 
  
• An anonymous hacker revealed that the data of about one billion people in China has been publicly accessible for over a year. This could be one of the largest leaks in history. The anonymous hacker claimed the data was collected by the Shanghai police and the data was available through an unsecured backdoor link since April 2021. 
  
• Neopets, a popular online pet game, was hit by a data breach of the personal information of potentially millions of account users. Data at risk included email addresses and passwords, and the company recommends changing passwords as soon as possible.