SecurityWeek

Microsoft issued an emergency out-of-band update on Tuesday to fix a critical vulnerability (CVE-2015-2502) being actively exploited in the wild and affecting all versions of Internet Explorer from IE 7 through 11.

Malicious actors have started abusing the Portmapper service to amplify their distributed denial-of-service (DDoS) attacks and hide their origin, Colorado-based telecommunications company Level 3 Communications has warned.

Trend Micro mobile threat response engineer Wish Wu has identified a new Android vulnerability caused by an issue in the mobile operating system’s mediaserver component. The flaw has been patched by Google.

Eric L. Crocker, 39, of Binghamton, New York, pleaded guilty on Monday to one count of violating the CAN-SPAM ACT. The man was a member of the recently dismantled cybercrime forum Darkode.

US authorities said Monday a breach of taxpayer records was more extensive than originally estimated, and that some 300,000 accounts appear now to have been affected. The Internal Revenue Service said it identified some 220,000 taxpayers whose tax records could have been stolen through its online "get transcript" system, which was shut down after news of the breach.

Russian anti-virus vendor Kaspersky Lab is denying accusations that it conducted operations designed to trick software from competing firms into classifying harmless files as malicious.

Researchers identified a vulnerability in the Google Admin application for Android that could have been exploited to read arbitrary files from the app’s sandbox. Google says it has released an update to patch the flaw.

A researcher has published a proof-of-concept (PoC) exploit for a local privilege escalation vulnerability affecting OS X Yosemite, including the latest 10.10.5 version.

The Industrial Control Systems Computer Emergency Response Team (ICS-CERT) has published a total of six advisories to warn organizations about a series of Supervisory Control and Data Acquisition (SCADA) system vulnerabilities disclosed by a researcher at the recent DEFCON conference in Las Vegas.

In a previous column, I discussed how “cyberphysical” is an appropriate term to capture this new world we are entering, where machines operate automatically and rapidly based on real-time feedback. The next step is to understand why this cyberphysical matters to the wider population that these machines will service.

Malicious actors can exploit vulnerabilities in BitTorrent, the popular peer-to-peer (P2P) file sharing protocol, to launch distributed reflective denial-of-service (DRDoS) attacks, researchers warned at the recent USENIX conference.

The US National Security Agency has used a unique, decades-old partnership with AT&T to snoop on Internet usage, according to newly disclosed documents leaked by Edward Snowden.

A group of Georgia Tech researchers have been awarded $100,000 by Facebook for coming up with a novel technique for detecting bad casting vulnerabilities.

Over the last few years, I’ve had the opportunity to meet and consult with companies about how they stay ahead of cybercrime threats to their businesses.

Mary Ann Davidson, Oracle's Chief Security Officer, published a blog post titled “No, You Really Can’t” on Monday asking customers to stop performing their own security tests on the company’s products.

A patch released by Google for one of the recently disclosed Stagefright vulnerabilities affecting the Android mobile operating system is flawed, researchers have warned.

Apple Releases Security Updates for OS X, iOS, Safari, OS X ServerApple released on Thursday security updates for OS X, iOS, Safari and OS X Server. The updates are designed to patch well over 100 vulnerabilities, including the recently disclosed local privilege escalation zero-day.

Researchers have once again demonstrated that when it comes to securing data, configuration issues can be just as dangerous as vulnerabilities.

Germany-based enterprise software maker SAP has released patches for a total of 22 vulnerabilities as part of its August 2015 Security Patch Day.