SecurityWeek

A vulnerability related to the IP-in-IP tunneling protocol that can be exploited for denial-of-service (DoS) attacks and to bypass security controls has been found to impact devices from Cisco and other vendors.

Apple on Monday released security patches to address a zero-day vulnerability that had been used to jailbreak iPhones running iOS 13.5.Tracked as CVE-2020-9859, the vulnerability was found in the iOS kernel and it can allow an application to achieve unsandboxed, kernel-level code execution.

The cybercriminals behind the recent attack on Elexon, which manages the electricity market in the United Kingdom, have started leaking data allegedly stolen from the company.

A distributed denial-of-service (DDoS) attack crippled the websites and systems of Minneapolis late last week, but no data appears to have been breached.

Cloud security firm Zscaler has acquired Edgewise Networks, a company that helps customers secure application-to-application communications using a zero-trust approach through microsegmentation.The acquisition was announced on Thursday and terms of the deal were not disclosed.

An unprotected Amazon Web Services (AWS) S3 bucket exposed the details of 2,700 users who signed up for the Joomla Resources Directory (JRD), Joomla’s Incident Response Task Group reported last week.

A security researcher claims Apple paid a $100,000 bug bounty reward for a critical vulnerability in Sign in with Apple, the company’s privacy-focused authentication system.

Two researchers have discovered a new timing channel attack technique that remains effective even if multiple processes are running on a system.

U.S. passenger railroad service Amtrak last week started informing some customers that their personal information may have been compromised as a result of unauthorized access to Guest Reward accounts.

An update released last week by VMware for the macOS version of Fusion attempts to fix a serious privilege escalation vulnerability introduced by a previous patch.

Britain said Friday it was pushing the United States to form a club of 10 nations that could develop its own 5G technology and reduce dependence on China's controversial telecoms giant Huawei.

Google announced on Thursday that it’s taking action against misleading and malicious notifications in Chrome with the release of version 84, which is scheduled for July 14.Browser notifications can be useful for certain types of services but some websites abuse them to mislead users, deliver malware, or phish personal information.

The United States Department of Justice (DoJ) this week announced that a New York City man was charged for his participation in a cybercrime scheme involving the theft and trafficking of payment card data.

The U.S. National Security Agency (NSA) on Thursday published information on the targeting of Exim mail servers by the Russia-linked threat actor known as Sandworm Team.

GitHub revealed on Thursday that tens of open source NetBeans projects hosted on its platform were targeted by a piece of malware as part of what appears to be a supply chain attack.

Cisco on Thursday said that it plans to acquire privately held network intelligence firm ThousandEyes, as the networking giant looks to boost network visibility and intelligence across its enterprise networking, cloud and application services portfolios.

Germany said Thursday it is seeking EU sanctions against a Russian man over his alleged role in the hacking of the German parliament at a time when evidence shows he was working for Russian intelligence.

Minted, an online marketplace of crowdsourced art and graphic designs, this week confirmed that it was the victim of a data breach earlier this month.

Cisco this week announced that it has patched two actively exploited Salt vulnerabilities, but not before malicious actors leveraged the flaws to hack some of the company’s servers.

NTT Communications (NTT Com), a subsidiary of Japanese tech giant NTT Corp, on Thursday disclosed a data breach impacting hundreds of customers.