SecurityWeek

A vulnerability impacting nearly all antivirus products out there could have been exploited to disable anti-malware protection or render the operating system unusable, RACK911 Labs security researchers reveal.

The Mail application in iOS is affected by two critical zero-day vulnerabilities that appear to have been exploited in targeted attacks since at least January 2018, cybersecurity automation company ZecOps reported on Wednesday.

Microsoft issued an out-of-band advisory this week to address Autodesk FBX vulnerabilities in Office, Office 365, and Paint 3D. Multiple bugs that were addressed in the Autodesk FBX software development kit (SDK) earlier this month could lead to code execution and denial of service conditions. 

Google on Wednesday warned that nation-backed hackers are exploiting the coronavirus pandemic to target health care organizations and those working to fight the pandemic.

The COVID-19 Health Crisis is Forcing Enterprise Security Teams to Deliver More With Less

Thousands of small business owners reeling from the aggressive measures taken to halt the spread of the coronavirus may have had their personal information exposed last month on a government website that handles disaster loan applications.

A vulnerability in Zoom’s video conferencing service could have been abused to enumerate all of the registered Zoom users within an organization, Cisco Talos reports.

A researcher was able to exfiltrate data from air-gapped computers using vibrations produced by controlling the rotation speed of the machines’ internal fans.

Cybercriminals are taking advantage of the pandemic, including hackers who target hospitals and medical research institutions that are studying the coronavirus, the head of the FBI’s cyber division said Tuesday.

Oil and gas organizations have been targeted in recent spearphishing campaigns using the "Agent Tesla" spyware Trojan, security firm Bitdefender says. 

April is a time for tax-related phishing scams, and we haven't been let down this year despite the dominance of COVID-19-themed phishing campaigns. DMARC should stop phishing, right? Not unless the targeted domain itself is spoofed.

Dramatic Increase in Company Compromises Correlates with Coronavirus-Sparked Lockdowns At the end of March 2020, researchers detected a spike in the number of firms potentially compromised each week. Previously, the number in Finland per week was around 200. Now it suddenly jumped to 800 -- and the reason is a cause for concern.

San Francisco-based identity and access management (IAM) solutions provider ForgeRock has raised $93.5 million in a Series E funding round, which brings the total raised by the company to more than $230 million.

A security researcher says IBM has told him that it would not be patching several vulnerabilities found in its Data Risk Manager product, despite demonstrating that they can be exploited by a remote, unauthenticated attacker to execute arbitrary code with root privileges. [UPDATE BELOW]

South Korean video gaming company Gravity is the latest victim of the China-linked threat actor tracked as the Winnti Group, security researchers say.

The Supreme Court agreed Monday to decide a case from Georgia about the reach of a federal computer hacking law.

A DLL side-loading vulnerability related to the Microsoft Terminal Services Client (MSTSC) can be exploited to bypass security controls, but Microsoft says it will not be releasing a patch due to exploitation requiring elevated privileges.

Google this week announced the availability of a cloud-based solution meant to help work-from-home employees securely access enterprise resources.

Google this week announced the creation of a COVID-19 grant fund aimed to help bug hunters who participate in its Vulnerability Reward Program (VRP).