SecurityWeek

A newly observed campaign leveraging the RIG exploit kit is targeting outdated versions of popular applications such as Flash, Internet Explorer, or Microsoft Edge to distribute the Cerber ransomware, Heimdal Security warns.

A report emerged on Friday that the popular mobile messaging app WhatsApp packs a backdoor allowing its operator (Facebook) to tap into users’ end-to-end encrypted conversations, but experts have refuted the claim as an exaggeration and F.U.D.

Advantech has patched a couple of serious vulnerabilities in WebAccess, a web-based software package for human-machine interfaces (HMI) and supervisory control and data acquisition (SCADA) systems.

A recently observed targeted attack campaign that hit a major financial services provider was distributing an unknown keylogger disguised as a Silverlight update, Proofpoint researchers reveal.

President-elect Donald Trump's transition team announced Thursday that former New York mayor Rudi Giuliani "will be sharing his expertise and insight as a trusted friend concerning private sector cyber security problems and emerging solutions developing in the private sector." The details of this new role are vague and sparse; but it would be fair to say that it has raised eyebrows in the security industry.

An estimated 35,000 Elasticsearch clusters exposed to the public Internet are potential victims to a series ransom attacks that have already hit over 33,000 MongoDB databases.

Researchers at Cisco Talos have identified several potentially serious vulnerabilities in Aerospike Database Server, including remote code execution and information disclosure issues. The flaws were reported to Aerospike and addressed. 

A hacker claims to have stolen hundreds of gigabytes of data from Cellebrite, the Israel-based mobile forensics company rumored to have helped the FBI hack an iPhone belonging to the terrorist Syed Rizwan Farook.

With Effective Security, Healthcare Organizations Can Take Advantage of Opportunities to Enable Innovation and Growth with Greater Speed, Efficiency, and Agility

The mysterious hacking group calling themselves “The Shadow Brokers” has apparently decided to put an end to their failed attempts to sell exploits and hacking tools they claimed to have stolen from the NSA-linked Equation Group.

The EyePyramid malware used to steal information from Italian politicians, bankers and business leaders is not very sophisticated, but, as many successful espionage operations have shown, it doesn’t need to be.

A new variant of the Ploutus ATM (automated teller machine) malware was recently observed, capable of interacting with KAL’s Kalignite multivendor ATM platform, FireEye security researchers warn.

Google has launched a beta version of a new Cloud Key Management System (KMS) to supplement the existing Google-managed server-side encryption and customer-controlled on-premise key management. It has broadened, it claims, "the continuum of encryption options available on Google Cloud Platform (GCP)." The beta KMS is currently available in 49 countries.

GoDaddy informed customers this week that it has revoked nearly 9,000 SSL certificates after discovering a software bug that made its domain validation process unreliable.

Actionable Threat Intelligence Enables a Proactive Approach to Cybersecurity, with Connectivity to the Entire Security Footprint

Careful Design of Network and System Security Architecture Can Substantially Enhance Security

Updates released on Wednesday by the Internet Systems Consortium (ISC) for the DNS software BIND patch four high severity, remotely exploitable denial-of-service (DoS) vulnerabilities.

Eight security flaws and 62 bugs have been addressed with the release of WordPress 4.7.1 on Wednesday. The latest update for the content management system (CMS) has been classified as a security release.

Can we Learn From the Blunders of U.S Officials on Their Handling of Classified Information?