SecurityWeek

Honeywell on Tuesday announced the launch of a new cybersecurity solution for operational technology (OT) in commercial buildings.

CISA Concerned About Risk Posed by Log4Shell to Critical InfrastructureThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) says it’s currently unaware of any significant breaches related to the recently disclosed Log4j vulnerabilities.

A vulnerability addressed recently in Apple’s macOS platform could be exploited to gain unauthorized access to a user’s personal data, Microsoft explains.

Researchers from industrial cybersecurity firm Claroty and developer security company Snyk have analyzed more than a dozen URL parsing libraries and showed how inconsistencies can lead to various types of vulnerabilities. Industrial organizations have been advised not to ignore these findings.

The so-called ‘great resignation’ currently upending the U.S. labor market is starting to affect cybersecurity programs with a growing number of senior leaders opting for early retirement and mid-level managers leaving in droves for less stressful, fully remote work opportunities.

Medical Review Institute of America (MRIoA) on Friday started notifying some individuals that their personal information was compromised in a cyberattack.

The European Union crime agency has been ordered by the 27-nation bloc’s data protection watchdog to erase information related to individuals with no proven link to crime.The European Data Protection Supervisor said Monday that Europol was notified of the order on Jan. 3 following an inquiry that started in 2019.

The Apache Software Foundation (ASF) is calling out for-profit companies leeching on open-source code, warning that “only a tiny percentage” of downstream vendors are contributing to securing the open-source ecosystem.

The U.S. State Department and the National Counterintelligence and Security Center (NCSC) on Friday issued a warning over the use of commercial surveillance tools.

The relatively recent Abcbot botnet appears to be operated by the same cybercriminals that launched a Xanthe-based cryptojacking campaign first detailed a couple of years ago, Cado Security says.

Cybersecurity firm SonicWall says it has released patches for some of its email security and firewall products to address a bug that resulted in failed junk box and message log updates.

WordPress 5.8.3, a security release that became available last week, patches four injection-related vulnerabilities.Two of the flaws are SQL injections — one affects WP_Meta_Query (discovered by Ben Bidner of the WordPress security team) and one affects WP_Query (discovered by ngocnb and khuyenn of GiaoHangTietKiem JSC).

The India-linked threat actor tracked as Patchwork was observed employing a new variant of the BADNEWS backdoor in a recent campaign, but the hackers also infected one of their own computers, giving researchers a glimpse into their operations.

Taiwan-based QNAP Systems on Friday warned users of an increase in attacks targeting network-attached storage (NAS) appliances, urging them to secure their devices as soon as possible.

Threat hunters in the U.K.’s National Health Service have raised an alarm for an unknown threat actor hitting vulnerable VMWare Horizon servers with exploits for the ubiquitous Log4j security flaw.

Eight new macOS malware families emerged in 2021, according to Patrick Wardle, a security researcher who specializes in Apple products.

A critical, unauthenticated remote code execution vulnerability has been impacting the H2 database console since 2008.An open-source Java SQL database, H2 is an in-memory solution that eliminates the need to store data on disk, and is one of the most popular Maven packages, having roughly 7,000 artifact dependencies,

A judge said Thursday he will fine Cyber Ninjas, the contractor that led Arizona Republicans’ 2020 election review, $50,000 a day if the firm doesn’t immediately turn over public records related to the unprecedented inquiry.

A California man this week admitted before a U.S. district judge to his role in a $50 million internet-enabled fraud scheme.Court documents claim that, between 2012 and 2020, Allen Giltman, 56, of Irvine, California, created fraudulent websites to ask for funds from investors.