Microsoft accuses China-backed nation state hackers of abusing the country’s vulnerability disclosure requirements to discover and develop zero-day exploits (Jonathan Greig/The Record)

Eduard Kovacs / SecurityWeek:
Pwn2Own Toronto 2022: participants earned a total of $400K for new exploits targeting Samsung Galaxy S22, printers, routers, and NAS devices on the first day  —  On the first day of the Pwn2Own Toronto 2022 hacking competition, participants earned a total of $400,000 for new exploits targeting phones, printers, routers and NAS devices.

Eduard Kovacs / SecurityWeek:
Pwn2Own Toronto 2022: participants earned a total of $400K for new exploits targeting Samsung Galaxy S22, printers, routers, and NAS devices on the first day  —  On the first day of the Pwn2Own Toronto 2022 hacking competition, participants earned a total of $400,000 for new exploits targeting phones, printers, routers and NAS devices.

Lawrence Abrams / BleepingComputer:
Security engineer says Uber hacker had access to its HackerOne bug bounty program; source: the hacker downloaded all vulnerability reports before losing access  —  Uber suffered a cyberattack Thursday afternoon with a hacker gaining access to vulnerability reports and sharing screenshots …

Sergiu Gatlan / BleepingComputer:
Google updates Chrome to address an actively exploited high-severity zero-day vulnerability in Mojo, its sixth patch for zero-day vulnerabilities in 2022  —  Google has released Chrome 105.0.5195.102 for Windows, Mac, and Linux users to address a single high-severity security flaw …

Lawrence Abrams / BleepingComputer:
Microsoft releases 63 security fixes, including patches for two zero-day flaws, one of which is under active exploit, and five critical RCE vulnerabilities  —  Today is Microsoft’s September 2022 Patch Tuesday, and with it comes fixes for an actively exploited Windows vulnerability and a total of 63 flaws.

Corin Faife / The Verge:
Microsoft reveals a now-patched “high severity vulnerability” in TikTok for Android that could let attackers take over accounts that clicked on a malicious link  —  Hackers could have used the exploit to post videos, send messages, and edit account details