Management & Strategy
As a cybersecurity professional, I appreciate the impact that cyber policy can have on the adoption of and effective utilization of technology. We see...
Hi, what are you looking for?
SecurityWeek
Malware & Threats
Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server.
Supply Chain Security
Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published.
Supply Chain Security
LiteLLM was compromised through the Trivy hack and abused to distribute information-stealing malware to its users.
Application Security
The startup analyzes subtle telemetry signals to detect attacks that traditional security tools cannot see inside accelerator-powered AI infrastructure.
Cybercrime
The Chinese APT known as TA423 (aka Red Ladon, APT40 and Leviathan) has been operating a cyberespionage campaign across Australia, Malaysia and Europe. The...
Application Security
Google today introduced a new bug bounty program to reward security researchers who discover and report vulnerabilities in the company’s open source projects.As part...
Application Security
BalkanID, a Texas startup building technology in the Identity Governance and Administration (IGA) space, has added $2.3 million to its seed financing round, bringing...
Application Security
Google has officially announced the open sourcing of ‘Paranoid’, a project for identifying well-known weaknesses in cryptographic artifacts.
Cloud Security
The attacks disclosed recently by Twilio and Cloudflare were part of a massive phishing campaign that targeted at least 130 other organizations, according to...
Cyberwarfare
Microsoft this week published technical details on ‘MagicWeb’, a new post-exploitation tool used by Russia-linked cyberespionage group APT29.
Endpoint Security
A researcher from the Ben-Gurion University of the Negev in Israel has published a paper describing a method that can be used to silently...
Application Security
Remote code execution vulnerability fixed in GitLab Community Edition (CE) and Enterprise Edition (EE) updates.
Cybercrime
Website security firm Sucuri is warning of an increase in fake distributed denial-of-service (DDoS) protection notifications that lead to the delivery of malware.DDoS protection...
Management & Strategy
A cybersecurity analysis of hundreds of media industry vendors showed that many companies are slow to patch critical vulnerabilities, according to MDR and third-party...
Malware & Threats
Secureworks security researchers have analyzed ‘DarkTortilla’, a .NET-based crypter used to deliver both popular malware and targeted payloads.
Cybercrime
Dark web intelligence firm Cyble reports seeing an increase in cyberattacks targeting virtual network computing (VNC).The VNC graphical desktop-sharing system relies on the Remote...
Cybercrime
China-linked cyberespionage group Iron Tiger was observed using the compromised servers of a chat application for the delivery of malware to Windows and macOS...
Supply Chain Security
A serious vulnerability affecting the eCos SDK made by Taiwanese semiconductor company Realtek could expose the networking devices of many vendors to remote attacks.
Application Security
Hundreds of companies and organizations showcased their products and services this week at the 2022 edition of the Black Hat conference in Las Vegas.
Cybercrime
Cybercriminals breached Cisco Systems and stole non-sensitive dataProfit-driven cybercriminals breached Cisco systems in May and stole gigabytes of information, but the networking giant says...
Black Hat
LAS VEGAS – The security industry makes its annual pilgrimage to the hot Sonoran desert this week for skills training, hacking demos, research presentations...
Application Security
Enterprise software vendor Twilio (NYSE: TWLO) has been hacked by a relentless threat actor who successfully tricked employees into giving up login credentials that...
Malware & Threats
Google-owned malware analysis service VirusTotal has published a report showing how threat actors abuse trust to bypass defenses and deliver their malware.According to data...
Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality.
(Danelle Au)
Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop.
(Torsten George)
Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk.
(Tod Beardsley)
The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job.
(Sravish Sridhar)
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
(Joshua Goldfarb)