SecurityWeek

Cisco on Friday shared details on what the company says is new breed of Point-of-Sale (PoS) malware that is more sophisticated and much better designed than previously seen PoS threats.

Yoast has released a new version of its popular Google Analytics plugin for WordPress to address a persistent cross-site scripting (XSS) vulnerability that could have been exploited to execute arbitrary code.

Multiple DLL hijacking vulnerabilities have been identified in a software component used in Rockwell Automation’s FactoryTalk View Studio and the FactoryTalk Services Platform.

Facebook has addressed a serious vulnerability that could have been exploited by malicious applications to gain access to users’ private photographs.The security hole was discovered by Laxman Muthiyah, who got a $10,000 reward from Facebook for his findings.

Researchers at Dutch software security company Securify have identified a total of eight vulnerabilities in EMC M&R and EMC Secure Remote Services.

Researchers who took part in the Pwn2Own 2015 hacking competition at the CanSecWest security conference have earned a total of $552,500, plus non-monetary prizes such as laptops and Zero Day Initiative (ZDI) points.

Target has agreed to pay $10 million to settle a class action lawsuit stemming from the data breach the company experienced in 2013. According to reports, Target will pay the money into an escrow account. Those that have documentation proving they incurred losses related to the breach are entitled to up to $10,000.

Seconds count when dealing with a security incident. A new survey from Osterman Research however has found that many companies believe it would take hours or more for them to detect a breach – with nearly 30 percent stating it would take days, weeks or longer.

Versions 6.35 and 7.35 of the Drupal content management system (CMS) are available for download. These security releases address two moderately critical vulnerabilities.One of the vulnerabilities can be exploited under certain circumstances to forge password reset URLs. An attacker can leverage the flaw to gain access to user accounts without knowing their password.

A new Ponemon Institute study sponsored by IBM shows that many organizations neglect security when building mobile applications for their customers.

Washington  - Attackers hacking into American computer networks appear to be leaving "cyber fingerprints" to send a message that critical systems are vulnerable, the top US cyber-warrior said Thursday.

OpenSSL 1.0.2a, 1.0.1m, 1.0.0r, and 0.9.8zf have been released. The latest updates include fixes for several bugs and security issues.

A threat actor dubbed “Rocket Kitten” has breached the systems of several organizations in Israel and Europe. Evidence uncovered by researchers suggests that the group might have ties to Iran.

The first day of the Pwn2Own 2015 hacking competition has come to an end and the results are in. Participants have been awarded a total of $317,500 for breaking Adobe Flash, Adobe Reader, Windows, Internet Explorer and Mozilla Firefox.

Google has been reviewing applications before they are published on Google Play in order to better protect users, according to the company. As part of the process, Google has tasked a team of experts to identify violations of its developer policies with the goal of catching those problems earlier in the app lifecycle.

Technology firms will ultimately prevail in their efforts to use strong encryption on devices that cannot be accessed by the government, Google executive chairman Eric Schmidt said Wednesday.

Last fall, the Gartner analyst firm predicted that through 2015, 75 percent of mobile applications would fail basic tests related to security and enterprise policy.

HP has released software updates to address several vulnerabilities affecting ArcSight Enterprise Security Manager (ESM) and ArcSight Logger, products that are part of the company's enterprise security portfolio.

Researchers who identify vulnerabilities in Pinterest’s domains or mobile applications can now earn monetary rewards, the social media company has announced.

The Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) has released a series of advisories detailing security issues identified by researchers in products from XZERES, Honeywell, and Johnson Controls.