Application Security
Security firm Imperva has analyzed web application vulnerability trends in 2016 and determined that while some types of flaws have declined, others have become...
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
Successful exploitation could lead to unexpected behavior or denial-of-service (DoS) conditions.
Vulnerabilities
It abuses CLFS and Windows Defender to trigger arbitrary file creation in the context of the antimalware process.
Malware & Threats
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root.
Vulnerabilities
Dubbed 4EverAble2Shell, the flaw could allow remote, unauthenticated attackers to execute code with root privileges.
Endpoint Security
Google Project Zero researcher Tavis Ormandy has discovered two serious certificate-related issues in Kaspersky Lab’s anti-malware products. The flaws were addressed by the security...
Application Security
The updates released for the “libpng” library in late December patch an old vulnerability introduced by developers in 1995.Libpng is the official Portable Network...
Cybercrime
The lack of proper security mechanisms in travel booking systems exposes passengers’ personal information and allows fraudsters to steal tickets and loyalty bonuses, researchers...
Application Security
Experts have determined that the remote code execution vulnerabilities affecting the PHPMailer and SwiftMailer email-sending libraries are caused by PHP design flaws.
Vulnerabilities
Support for Windows XP and Vista will be removed from Firefox, currently the last major web browser out there to still support the two...
Compliance
The U.S. Food and Drug Administration (FDA) has released guidance on the postmarket management of cybersecurity for medical devices, encouraging manufacturers to implement security...
Vulnerabilities
PHP 7’s “unserialize” function is plagued by a series of vulnerabilities that could allow an attacker to take full control over affected servers, Check...
Vulnerabilities
Various ZyXEL customized routers are plagued by several vulnerabilities and by default login credentials, SecuriTeam security researchers warn.
Application Security
The developers of PHPMailer have patched a critical vulnerability that can be exploited by a remote attacker for arbitrary code execution, a researcher said...
Network Security
[Update] Vulnerabilities in NETGEAR WNR2000 routers allow an attacker to retrieve the administrator password and take full control of the affected networking device, a security researcher...
Data Protection
Inflight Internet and entertainment provider Gogo has announced the launch of a Bugcrowd-based public bug bounty program covering the company’s main websites.
Cloud Security
Cisco has warned customers about a critical privilege escalation vulnerability that has been exploited against Cisco CloudCenter Orchestrator (CCO) systems.
ICS/OT
Siemens has made available workarounds and patches that address medium and high severity vulnerabilities found in the company’s Desigo PX and SIMATIC automation products.
Cloud Security
VMware has released patches that address important and critical vulnerabilities affecting the company’s vSphere Data Protection (VDP) and ESXi products.The critical flaw was discovered...
Audits
Google this week announced the availability of Project Wycheproof, an open source tool designed for finding known vulnerabilities in popular cryptographic software libraries.
Management & Strategy
Rapid7 has been designated as a Common Vulnerability and Exposures (CVE) Numbering Authority (CNA), which enables the security firm to assign CVE identifiers to...
Cybercrime
New evidence uncovered by researchers after the group calling itself “Shadow Brokers” made available some new files reinforces the theory that the exploits and...
Identity & Access
WordPress security firm Wordfence has warned that the number of brute force attacks aimed at WordPress websites has increased significantly in December compared to...
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)