SecurityWeek

Cisco is warning customers that a new IOS XE zero-day vulnerability tracked as CVE-2023-20198 is being exploited to hack devices. 

A critical vulnerability in the Royal Elementor WordPress plugin has been exploited as a zero-day since August 30.

Privacy-focused messaging firm Signal is pouring cold water on widespread rumors of a zero-day exploit in its popular encrypted chat app.

Australian AI researchers teach an unmanned military robot’s operating system to identify MitM cyberattacks.

Microsoft is adding new features to the Kerberos protocol, to eliminate the use of NTLM for Windows authentication.

UK’s financial watchdog FCA imposes a £11 million (approximately $13.5 million) fine to Equifax over the 2017 data breach.

A vulnerability affecting Milesight industrial routers, tracked as CVE-2023-43261, may have been exploited in attacks. 

A threat actor targets Israelis with spyware masquerading as an Android application for receiving rocket alerts.

Environmental Protection Agency (EPA) withdraws recent water sector cybersecurity rules due to lawsuits by states and water associations.

CISA is now flagging vulnerabilities and misconfigurations that are known to be exploited in ransomware attacks.

Juniper Networks patches over 30 vulnerabilities in Junos OS and Junos OS Evolved, including nine high-severity bugs.

Noteworthy stories that might have slipped under the radar: Ex-Uber security chief files appeal, tech giants announce new security offerings. 

Dozens of Squid caching proxy vulnerabilities remain unpatched two years after a researcher reported them to developers.

Microsoft is offering rewards of up to $15,000 in a new bug bounty program dedicated to its new AI-powered Bing.

Progress Software confirms the SEC has launched its own investigation into costly ransomware zero-days in the MOVEit file transfer software.

A backdoor deployed on a compromised WordPress website poses as a legitimate plugin to hide its presence.

Apple has released iOS 16.7.1 and iPadOS 16.7.1 to patch CVE-2023-42824, a kernel vulnerability that has been exploited in attacks.

A recently observed phishing campaign targeting Microsoft accounts is using LinkedIn smart links to bypass defenses.

Industrial routers made by Chinese company Yifan are affected by several critical vulnerabilities that can expose organizations to attacks. 

How much do CISOs make? Survey provides compensation trends for Chief Information Security Officers, but don't take surveys at full face value.