SecurityWeek

A remote code execution (RCE) vulnerability addressed recently in Concrete5 exposed numerous websites to attacks, Edgescan reports.A point and click, open-source content management system, Concrete5 allows users create websites at ease and is used by many high-profile entities worldwide, including BASF, GlobalSign, REC, the U.S. Army, and more.

Password management solutions provider Keeper Security on Monday announced that it has raised $60 million in growth funding from private equity company Insight Partners.

Anti-fraud platform provider SpyCloud on Tuesday announced that it raised $30 million in a Series C funding round. To date, the company has received $58.5 million in investments.

A report published recently by the U.S. Army describes North Korea’s cyber warfare capabilities and provides information on various units and their missions.

In the last few years, we’ve seen ample evidence of how cyberattacks on critical infrastructure can be leveraged by nation-states and other powerful adversaries as weapons in geopolitical conflicts.

Google is working on improving the security of Chrome users by alerting them when filling out forms on secure pages that are delivered insecurely.Set to be introduced in Chrome 86, the feature targets the so-called mixed forms (they are found on HTTPS pages that submit over HTTP), which are considered a risk to users’ security and privacy.

Cybercriminals claiming to represent well-known threat groups such as Fancy Bear and Armada Collective have been threatening organizations with distributed denial of service (DDoS) attacks, Akamai warns.

Trustwave’s security researchers have identified a total of five uninstallers meant to remove the GoldenSpy backdoor from infected computers.

The actively exploited Windows spoofing vulnerability patched last week by Microsoft has been known for more than two years, researchers pointed out.

Industrial cybersecurity solutions provider Radiflow recently announced the launch of an automated risk analysis platform for industrial automation and control systems.

The SANS Institute says the recently disclosed security incident involved phishing emails being sent to several of its employees.

The US administration Monday expanded its sanctions on China's Huawei, a move aimed at further limiting the tech giant's access to computer chips and other technology.

The Cybersecurity and Infrastructure Security Agency (CISA) has published an alert to provide information on attacks delivering the KONNI remote access Trojan (RAT).

Security researchers at Binary Defense created a “vaccine” that was able to keep systems protected from the Emotet Trojan for six months.

Thousands of user accounts for online government services in Canada were recently hacked during cyber attacks, authorities said Saturday.The attacks targeted the GCKey service, used by some 30 federal departments and Canada Revenue Agency accounts, the Treasury Board of Canada Secretariat explained in a press release.

Tyler C. King, a 31-year-old from Dallas, Texas, was sentenced this week to 57 months in prison for crimes related to the hacking of an unnamed major tech company based in New York.

Authorities in Maryland have issued an advisory about an apparent email phishing scam targeting firearms dealers in the state.Maryland State Police said it was issued after the Maryland State Police Licensing Division was notified Tuesday about emails received by at least two firearms dealers.

With $4 million in seed funding, Adaptive Shield this week emerged from stealth mode to automate the security of software-as-a-service (SaaS) applications.The Tel Aviv, Israel-based startup seeks to tackle the issue of incorrect configuration of SaaS applications, which can expose them to cyberattacks, data leaks, and other risks.

Check Point security researchers have identified a series of vulnerabilities that potentially opened the gate for a variety of attacks targeting Alexa, Amazon’s virtual assistant.

A newly discovered piece of malware designed to target macOS systems spreads through Xcode projects and exploits what researchers have described as two zero-day vulnerabilities.