SecurityWeek

Oracle has decided to give Java developers more time to ensure that their JAR files are not signed with the MD5 algorithm. Java Runtime Environment (JRE) will no longer trust these types of files starting with April 2017.

The number of data breaches disclosed by organizations in the United States has increased by 40 percent in 2016 compared to the previous year, according to a report released on Thursday by CyberScout (formerly IDT911) and the Identity Theft Resource Center (ITRC).

The Department of Homeland Security (DHS) has made improvements to its information security program, but problems have still been identified in several areas, according to a report made public this week by the Office of Inspector General (OIG).

The ancient Greeks are credited with many inventions that continue today in some form – the water mill, odometer, alarm clock and cartography, to name a few. As a security professional what comes to mind instantly is the Trojan horse, devised to sneak Greek soldiers behind the walls of the city of Troy and win the war.

Docker recently resolved a runc privilege escalation vulnerability that could be exploited by a malicious program to escape container and access the host.

An alleged Russian hacker wanted for fraud has been detained in Spain and jailed pending extradition to the United States, police and a court spokesman said Thursday.

Following a series of ransom attacks against MongoDB and Elasticsearch databases in recent weeks, many users of CouchDB and Hadoop are now finding their databases are under attack as well.

The U.S. Department of Homeland Security has published the National Cyber Incident Response Plan (NCIRP), which aims to describe the government’s approach in dealing with cyber incidents involving public or private sector entities.

The investigation is ongoing, but Ukraine’s national power company Ukrenergo has confirmed that the recent electricity outage in the Kiev region was caused by a cyberattack.

Encrypted email provider ProtonMail announced this week the launch of a Tor hidden service whose role is to help combat the censorship and surveillance efforts of totalitarian governments.

Google Project Zero researcher Tavis Ormandy discovered that a Chrome extension installed silently by Adobe last week had been affected by a cross-site scripting (XSS) vulnerability. Adobe quickly patched the flaw after learning of its existence.

Security researchers have described what they consider to be "the first Mac malware of 2017." It has a simple structure and includes some antiquated code; but nevertheless appears to have existed undetected for some time -- perhaps even several years -- while possibly targeting biomedical research institutions.

A recently observed malware distribution campaign has been specifically devised to target users of the Chrome browser on Windows-based computers, Proofpoint security researchers warn.

For the 10th anniversary of the Pwn2Own hacking contest, Trend Micro and the Zero Day Initiative (ZDI) have introduced new exploit categories and they are prepared to offer more than $1 million worth of prizes.

The infamous Carbanak malware is now capable of using Google services for command and control (C&C) communication, Forcepoint security researchers warn.

The United States Computer Emergency Readiness Team (US-CERT) has issued a warning after the threat group calling itself Shadow Brokers has offered to sell what it claims to be a zero-day exploit targeting the Server Message Block (SMB) network file sharing protocol.

Gaining and retaining security talent is a major headache for almost all security leaders -- indeed, the consensus is that the world is suffering under a chronic security skills gap. But most of the evidence for this skills gap is empirical; there is little hard evidence in facts and figures.

The new year is only a couple of weeks old and there have already been several ICS related security incidents in the news. The media often sensationalizes these incidents. This is creating hype and growing worldwide awareness and concern over the threat of cyber attacks against industrial and critical physical infrastructures. I believe that 2017 will be the year ICS security becomes a mainstream media topic.

Oracle on Tuesday released its first Critical Patch Update (CPU) for 2017. The software update addresses 270 security issues across its products, 121 of which were found in Oracle E-Business Suite.