SecurityWeek

CISA unveils a new Hardware Bill of Materials (HBOM) framework for buyers and sellers to communicate about components in physical products.

Israeli security startup Gem Security has raised a total of $34 million to tackle cloud threat detection and incident response.

Attackers can find tons of information on Tesla cars and their drivers by searching for misconfigured TeslaMate instances online.

Firefox 118 patches six high-severity vulnerabilities, including a memory leak potentially leading to sandbox escape.

Threat actors have been using stolen GitHub personal access tokens to push malicious code posing as Dependabot contributions.

Google has released the source code of BinDiff, a binary file comparison tool popular within the security research community, on GitHub.

macOS 14 Sonoma has been officially released by Apple and the latest version of the operating system patches over 60 vulnerabilities.

GPUs from AMD, Apple, Arm, Intel, Nvidia and Qualcomm are vulnerable to a new type of side-channel attack named GPU.zip.

Microsoft announced that the latest Windows 11 update (23H2) will bring more support for passkeys and several new security features.  

UAE-linked APT group Stealth Falcon has used the new Deadglyph backdoor in an attack targeting a governmental entity in the Middle East.

Sony has launched an investigation after a ransomware group claimed to have compromised all systems and offered to sell stolen data.

CISO churn is a hidden cybersecurity threat. Major security initiatives or implementations can take longer than the residency of a single CISO, and constant churn can leave cracks or gaps in security.

The Xenomorph Android banking trojan can now mimic financial institutions in the US and Canada and is also targeting crypto wallets.

Mixin Network suspends deposits and withdrawals after hackers steal $200 million in digital assets from its centralized database.

A stealthy APT known as Gelsemium has been observed targeting a government entity in Southeast Asia for persistence and intelligence collection.

Kosi Goodness Simon-Ebo, a Nigerian national, pleaded guilty in a US court to his involvement in a million-dollar BEC fraud scheme.

Nearly 900 US schools are impacted by the MOVEit hack at the educational nonprofit National Student Clearinghouse.

City of Dallas has approved an $8.5 million budget to restore systems following a Royal ransomware attack in May 2023.

A critical vulnerability in the TeamCity CI/CD server could allow unauthenticated attackers to execute code and take over vulnerable servers.

Predator spyware delivered to iPhones and Android devices using iOS and Chrome zero-day vulnerabilities and MitM attacks.