Tales from the SOC: AI – Enterprise best practices | S1 Ep026
Co-hosts Duck and David present a good-humored but informative guide to using AI safely in your business.
This article was originally published here:
https://pducklin.com/2025/03/27/firefox-follows-chrome
That zero-day bug in Chrome that we warned about earlier this week?
Turns out that even though Firefox isn’t based on Google’s Chromium code, Mozilla programmers made a similar sort of mistake in their own browser engine.
Technically, the bug is different, because the Firefox bug is CVE-2025-2857 while the Chrome equivalent is CVE-2025-2783.
But the story behind the Chrome zero-day encouraged the Firefox developers to review their own sandbox implementation, where they say they “identified a similar pattern in our inter-process communication [IPC] code.”
Strictly speaking, the Firefox patch can be considered proactive rather than a zero-day, but it’s no less important to apply it as soon as you can.
After all, once the Firefox team knew where to look and what to look for, they came across the CVE-2025-2857 bug very quickly.
Assume, therefore, that a determined cybercriminal who was in on the original Chrome zero-day might be able to do something very similar, and create a working exploit for Firefox in short order, too.
Remember these two things:
Use Help > About Firefox to ensure you’re up to date.
Look for the version number 136.0.4 after the update is done. (Don’t forget to restart Firefox to unload the old one and reload the new version.)
The version number will be one of ESR 115.21.1 or ESR 128.8.1 if you’re using a Firefox Extended Support Release, or ESR for short. The ESR versions are popular in business networks because they include all relevant security fixes, but don’t force you to take new software features at the same time.
Learn more about SolCyber’s mobile security solution that goes beyond traditional MDM (mobile device management) software, and offers active on-device protection that’s more like the EDR (endpoint detection and response) tools you are used to on laptops, desktops and servers:
Paul Ducklin is a respected expert with more than 30 years of experience as a programmer, reverser, researcher and educator in the cybersecurity industry. Duck, as he is known, is also a globally respected writer, presenter and podcaster with an unmatched knack for explaining even the most complex technical issues in plain English. Read, learn, enjoy!
Co-hosts Duck and David present a good-humored but informative guide to using AI safely in your business.
Effectively building, implementing, and operationalizing a cybersecurity strategy is no small feat, and often requires significant employee power and resources — resources that many businesses don’t have. The skills needed to develop and implement a security strategy are incredibly technical, and the security labor shortage has meant most talent is scooped up by large enterprises. That leaves many businesses with few options, including outsourcing security to a third party, delegating security tasks to IT, or skipping cybersecurity efforts altogether. While […]
During my 25 years of working in the security space, I’ve seen many shifts both in the security industry and the world outside of it. The technology that has been developed in the last two decades has drastically affected the way we work and the way we secure our business operations and data. I’ve watched as the industry shifted from securing data on servers to the cloud, and I believe another equally disruptive shift is coming soon. There are many […]
By subscribing you agree to our Privacy Policy and provide consent to receive updates from our company.
