SecurityWeek

Researchers document VoltSchemer attacks that manipulate power voltage to take over commercial wireless chargers.

Security experts describe exploitation of the CVSS 10/10 flaw as “trivial and embarrassingly easy.”

A new Biden executive order to boost the cybersecurity of US ports highlights the risks associated with the use of Chinese cranes.

Apple unveils PQ3, a new post-quantum cryptographic protocol for iMessage designed to protect communications against quantum computing attacks.

Security teams need to combine the angles of client-side and server-side detection in order to have the best chance of mitigating the risk of advanced mobile malware.

Attackers weaken Redis instances to deploy the new Migo malware and install a rootkit and cryptominers.

Google and Mozilla resolve high-severity memory safety vulnerabilities with the latest Chrome and Firefox updates.

German control system solutions provider PSI Software says it is still recovering from a ransomware attack.

NSA says Rob Joyce is retiring as cybersecurity director and will be replaced by David Luber, the current deputy director of cybersecurity.

The ransomware threat is declining as actors pivot to infostealing, according to IBM, which says that attacks on cloud services and critical infrastructures are growing.

ConnectWise ships patches for extremely critical security defects in its ScreenConnect remote desktop access product and urges emergency patching.

Shadowserver Foundation has identified roughly 28,000 Microsoft Exchange servers impacted by a recent zero-day.

Supply chain security insights: A successful attack against a supplier can lead to multiple opportunities against the supplier’s downstream customers.

Volt Typhoon and two other threat groups that emerged in 2023 can pose a serious threat to ICS/OT, according to industrial cybersecurity firm Dragos.

Attackers are exploiting a recent remote code execution flaw in the Bricks Builder WordPress plugin to deploy malware.

Cactus ransomware has added Schneider Electric to its leak site, claiming to have stolen 1.5 terabytes of data.

The LockBit ransomware operation has been severely disrupted by an international law enforcement operation resulting in server seizures and arrests.

Recent Anatsa Android banking trojan attacks have become more targeted, showing an evolution in tactics.

Alleged Raccoon Infostealer operator Mark Sokolovsky is awaiting trial in the US, after being extradited from the Netherlands.

Russian cyberespionage group targets European government, military, and critical infrastructure entities via Roundcube vulnerabilities.