Email Security
A vulnerability in the GitHub Actions workflow for PyPI’s source repository could be exploited to perform a malicious pull request and eventually execute arbitrary...
Hi, what are you looking for?
SecurityWeek
Fraud & Identity Theft
Signal has also made a security announcement: an automatic key verification feature to complement its safety number system.
Fraud & Identity Theft
The payments giant says BioCatch’s behavioral and device intelligence will help financial institutions combat account takeovers, scams and other forms of digital fraud.
Data Breaches
Hackers recently obtained non-sensitive customer information and other documents from the company.
Fraud & Identity Theft
US conducts sweeping crackdown on Southeast Asian cyberscam operations as part of what officials say is a “new theater of war”.
Data Protection
A newly discovered Android banking Trojan relies on screen recording and keylogging instead of HTML overlays for the capturing of login credentials, according to...
Cybercrime
Two Belarusian nationals were arrested earlier this month in Poland on the suspicion they engaged in multiple ATM jackpotting attacks.The two are believed to...
Application Security
Security researchers at Guardicore Labs are sharing details of a critical vulnerability in Hyper-V that Microsoft patched in May 2021.
Fraud & Identity Theft
Israel-based ecommerce fraud prevention company Riskified has announced the pricing of its initial public offering (IPO) as it prepares to start trading publicly on...
Cloud Security
Foxit Software this week released security updates for its PDF Reader and PDF Editor applications, to address multiple vulnerabilities, including some leading to remote...
Application Security
The U.S. government and its allies are pleading with defenders to pay attention to gaping holes in perimeter-type devices, warning that advanced threat actors...
Application Security
Google says it paid out more than $29 million in bug bounty rewards for vulnerability reports received over the past 10 years.
Application Security
Apple on Monday released a major security update with fixes for a security defect the company says “may have been actively exploited” to plant...
Application Security
Mozilla has completely removed support for the File Transfer Protocol (FTP) from the latest release of its flagship Firefox web browser.
Application Security
Threat actors are abusing Argo Workflows to target Kubernetes deployments and deploy crypto-miners, according to a warning from security vendor Intezer.
Application Security
European bug bounty and vulnerability disclosure policy platform YesWeHack this week announced the closing of a €16 million ($18.8 million) round of venture capital...
Application Security
After years of mostly sitting on the sidelines, Microsoft is starting to be aggressive with cybersecurity acquisitions.The world’s largest software company said Wednesday it...
Application Security
Microsoft on Monday announced that it secured a court order to take down numerous malicious homoglyph domains that a criminal group registered to impersonate...
Application Security
Juniper Networks has shipped security patches to cover numerous vulnerabilities across its product portfolio, including a series of critical bugs in third-party software used...
Application Security
Microsoft’s problems with security defects in the Windows Print Spooler utility are getting worse by the week.
Audits
Cisco on Thursday released patches for a high severity vulnerability in the Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software, warning that...
Application Security
An Iran-linked hacking group tracked as Tortoiseshell has expanded its list of targets to newer industries and more geographies, according to a new warning...
Application Security
Palo Alto Networks this week announced the availability of patches for security flaws in the Prisma Cloud Compute cloud workload protection solution and Windows...
Cyberwarfare
Network appliance vendor SonicWall has issued an urgent security notice to warn of imminent data-encrypting ransomware attacks targeting known -- and already patched --...
Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default.
(Matt Honea)
Security teams must treat autonomous agents as highly privileged identities.
(Etay Maor)
For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality.
(Danelle Au)
Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop.
(Torsten George)
Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk.
(Tod Beardsley)