SecurityWeek

A root certificate used by Let’s Encrypt expired on September 30 and, despite being notified a long time in advance, many companies experienced problems.

Computer systems are being restored in Pottawatomie County are after hackers launched a ransomware attack on Sept. 17, county officials said Friday.The county resolved the attack by paying less than 10% of the hackers’ original demands, County Administrator Chad Kinsley said in a statement.

The number of cybersecurity-related mergers and acquisitions announced in the past months has remained constant, with roughly 40 deals announced in September 2021 as well.

Rasmus Sten, a software engineer with F-Secure, has released proof-of-concept (PoC) exploit code for a macOS Gatekeeper bypass that Apple patched in April this year.

Google last week pledged $1 million in financial support to the Secure Open Source (SOS) rewards program run by the Linux Foundation.The pilot program financially rewards developers who help improve the security of critical open source projects and is meant to complement existing vulnerability management programs.

An Alabama woman whose 9-month-old daughter died has filed suit against the hospital where she was born claiming it did not disclose that its computer systems had been crippled by a cyberattack, which resulted in diminished care that resulted in the baby’s death.

Private equity giant Symphony Technology Group (STG) this week announced the merger of McAfee Enterprise and the newly acquired FireEye Products into a single entity with $2 billion in annual revenue.

New "ChamelGang" APT group group has not been associated with any existing threat actor

Third-party identity risk solutions provider SecZetta this week announced that it has raised $20.5 million in Series B funding, which brings the total raised by the company to $30.5 million.The new investment round was led by SYN Ventures and new investor MassMutual Ventures. Existing investors ClearSky and Rally Ventures also contributed.

U.S. senators this week introduced a bill that would require critical infrastructure organizations to inform the Cybersecurity and Infrastructure Security Agency (CISA) if they experience a cyberattack, and it would also require most private companies to notify the government if they have made a payment in response to a ransomware attack.

Luxury retail company Neiman Marcus Group on Thursday confirmed that customer information was indeed stolen in a data breach.During the incident, which occurred in May 2020, hackers were able to exfiltrate information associated with online customer accounts, including payment card data, the company says.

Google on Thursday announced the rollout of a Chrome update to address four security vulnerabilities, including two that are already being exploited in the wild.

Since 2004 October has been Cybersecurity Awareness Month, providing an opportunity for everyone to learn about ways to stay safe and secure online with straightforward advice and suggestions from experts. Of the past 17 years, the last two have been unique as the world moved to new ways of working, and there’s been a need to course-adjust along the way.

A researcher has disclosed the details of a privilege escalation vulnerability he discovered in a Google Cloud component. The flaw was patched by Google in late August, but some users will need to manually update their systems to prevent potential exploitation.

A threat group is distributing the little-known Sarwent Trojan via a fake website that impersonates Amnesty International and claims to deliver protection against the Pegasus mobile malware.

Apple’s AirTag product is affected by a vulnerability that could be exploited by hackers to lure unsuspecting users to phishing or other types of malicious websites.

Natural disasters such as extreme weather conditions can have a major disruptive effect on electricity supply. Power utilities are forced into emergency response status, which normally requires every available engineer from both in-house and third parties being called upon to find and fix the problems. 

A recently discovered cybercrime campaign leveraging mobile premium services has made over 10 million victims worldwide, potentially causing hundreds of millions in losses, according to mobile security firm Zimperium.

The United States Cybersecurity and Infrastructure Security Agency (CISA) this week released a tool to help organizations assess their insider threat risk posture.