SecurityWeek

Estée Lauder has confirmed suffering a data breach just as two ransomware groups claimed to have targeted the company, both allegedly stealing vast amounts of information.

While traditional security awareness teaches users how to recognize social engineering, new behavior changing trains the brain on the correct recognition and response to phishing. 

Multiple DDoS botnets have been observed targeting CVE-2023-28771, a Zyxel firewall vulnerability patched in April.

The Rust-based peer-to-peer worm ‘P2PInfect’ is targeting a Lua sandbox escape vulnerability in internet-accessible Redis servers.

Securing APIs is a noble, though complex journey. Security teams can leverage these 10 steps to help secure their APIs.

The recently discovered SophosEncrypt ransomware is impersonating the cybersecurity firm Sophos.

Adobe releases a second round of patches for recent ColdFusion vulnerabilities, including flaws that have been exploited in attacks.

Famed hacker Kevin Mitnick has died after a battle with pancreatic cancer.  At the time of his death, he was Chief Hacking Officer at security awareness training firm KnowBe4.

Facing intense pressure after Chinese APT hack, Microsoft plans to expand logging defaults for lower-tier M365 customers.

Norwegian recycling giant Tomra says internal systems have been taken offline to contain an extensive cyberattack.

Attackers are exploiting two path traversal vulnerabilities in the Stagil navigation for Jira – Menus & Themes plugin.

Over a dozen vulnerabilities patched by GE in its Cimplicity HMI/SCADA product are reminiscent of ICS attacks conducted by the Russian Sandworm group.

Security awareness training isn’t working to the level it needs to. Social engineering, however, is getting better. Why doesn’t awareness training work, and how can we improve it?

Oracle has released 508 new security patches as part of the July 2023 CPU, including more than 70 that address critical vulnerabilities

Citrix has patched several vulnerabilities, including CVE-2023-3519, a critical remote code execution zero-day that has been exploited in attacks.

Chrome 115 released with patches for 20 vulnerabilities, including 11 reported by external researchers, who earned thousands of dollars in bug bounties.

The two foreign companies are being sanctioned for “for trafficking in cyber exploits used to gain access to information systems.” 

The NSA and CISA have published guidance on hardening 5G standalone network slices against potential threats.

Olalekan Jacob Ponle, a Nigerian national living in the UAE, was sentenced to 8 years in a US prison for his role in an $8 million BEC scheme.

A threat actor’s real identity was uncovered after they infected their own computer with an information stealer.