SecurityWeek

The last 18 months have been nothing short of historic for critical infrastructure companies. First, came a series of dramatic developments that highlighted the risks to industrial environments:

Domain registrar and web hosting giant GoDaddy says the recently disclosed data breach impacts several of its brands, including 123Reg, Domain Factory, Heart Internet, Host Europe, Media Temple and tsoHost.

The United States Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) this week reminded organizations of all types – with a focus on critical infrastructure – that cybercriminals tend to launch impactful cyberattacks during holidays and weekends.

Security researcher David Schütz says he received over $10,000 in bug bounty payouts from Google after reporting a Google Cloud project vulnerability and subsequent bypasses to rolled-out fixes.

Norway-based assurance and risk management solutions provider DNV is acquiring industrial cybersecurity company Applied Risk in an effort to create an “industrial cybersecurity powerhouse.”The companies will merge under the DNV brand. Financial terms of the deal have not been disclosed.

Japan and Vietnam on Tuesday signed a cybersecurity agreement as the two Asian nations rapidly step up their military ties amid concerns over China’s growing assertiveness.

The troubles for Israeli surveillance software maker NSO Group continue to pile up with news that Apple has filed suit to ban the company from using its software, services or devices.

A security researcher has released proof-of-concept (PoC) exploit code for a recently patched code execution vulnerability affecting on-prem Microsoft Exchange Server installations.

Without the sacrifice of our frontline workers over the past two challenging years, many of our communities would not have been able to receive vital care. However, while healthcare providers have been busy protecting our communities, who has protected the sensitive personal data collected in the process? 

A vulnerability discovered in CloudLinux’s Imunify360 security product could have been exploited for remote code execution using specially crafted files.

Low-code/no-code application security provider Zenity today announced that it has emerged from stealth mode with $5 million in seed funding.The investment round was led by Vertex Ventures and UpWest, but Zenity says it is also backed by former Google CISO Gerhard Eschelbeck and former SuccessFactors CIO Tom Fisher.

The Bioeconomy ​​Information Sharing and Analysis Center (BIO-ISAC) on Monday raised the alarm on cyberattacks targeting biomanufacturing facilities.

Germany-based retail giant Schwarz Group this week announced the acquisition of security posture management company XM Cyber for $700 million.Schwarz Group, known for brands such as Lidl and Kaufland, is the world’s fourth-largest retailer. Last year, it announced launching a cloud computing service for third-party retailers.

Cyber insurance and security solutions provider Resilience on Monday announced raising $80 million in a Series C funding round.

Security researchers at Claroty have raised the alarm for a series of severe code execution vulnerabilities affecting virtual private network (VPN) solutions relying on OpenVPN.

Philips is working on patches for several vulnerabilities discovered by researchers in some of the company’s medical products.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Coast Guard Cyber Command (CGCYBER) have shared new details on in-the-wild attacks targeting a recently patched flaw in Zoho’s ManageEngine ADSelfService Plus product.

Domain registrar and web hosting giant GoDaddy has been hacked and customer data for some 1.2 million WordPress users were exposed to the attacker for more than three months.

Danish wind turbine giant Vestas Wind Systems has been hit by what appears to be a ransomware attack that took out parts of its internal IT infrastructure and caused unspecified data compromise.

Prodaft security researchers exploited a vulnerability in the recovery servers used by the Conti Ransomware-as-a-Service (RaaS), which allowed them to gain insight into the inner workings of the ransomware.