SecurityWeek

Financially-motivated hackers believed to be operating out of Russia recently targeted companies in Western Europe, and the attacks apparently involved a combination of two Windows vulnerabilities that Microsoft did not expect to be exploited.

U.S. Sen. Mark R. Warner (D-VA) this week sent letters to six Internet networking device vendors urging them to ensure that their products remain secure during the COVID-19 social distancing efforts.

GitHub this week announced that it has paid out over $1 million in rewards to the security researchers participating in its bug bounty program on HackerOne.The security bug bounty program was launched on the hacker-powered platform in 2016, but GitHub has been accepting vulnerability reports since February 2014.

The majority of primary campaign websites of United States presidential candidates run code that can pose security and privacy risks to consumers, The Media Trust has discovered.

ACROS Security’s 0patch service has developed unofficial patches for two actively exploited Windows vulnerabilities for which Microsoft has yet to release fixes.

Proton Technologies, the company behind the privacy-focused ProtonMail and ProtonVPN services, this week disclosed the existence of a vulnerability in Apple’s iOS mobile operating system that prevents VPN applications from encrypting all traffic.

A recently observed campaign is attempting to infect the iPhones of users in Hong Kong with an iOS backdoor that allows attackers to take over devices, Trend Micro reports.

AMD has confirmed that a hacker has stolen files related to some of its graphics products, but the company says it’s not too concerned about the impact of the leak.

Log management platform Humio this week announced that it closed a $20 million Series B funding round, bringing the total investment raised to date to $32 million.

People who made purchases from the official Tupperware website over the past couple of weeks may have had their payment card information stolen, cybersecurity firm Malwarebytes warned on Wednesday.

Apple this week announced that third-party cookies are now blocked by default in Safari on macOS, iOS and iPadOS.The feature represents the latest enhancement the Cupertino-based company brought to its Intelligent Tracking Prevention (ITP) and is meant to improve the privacy of its users by removing previously accepted exceptions.

A vulnerability that OpenWrt addressed in its opkg fork could have been exploited for the remote execution of arbitrary code.

Rockville, Maryland-based startup Sepio Systems, a rogue device mitigation firm, has raised a further $4 million that supplements the Series A round of $6.5 million announced in November 2019.

A global survey of 1,000 security professionals commissioned by industrial cybersecurity company Claroty has revealed that over 70% would rather work in IT enterprise cybersecurity than industrial security.

The Federal Bureau of Investigation recently took down a Russian-based online platform where various cybercrime products and services were being sold, the Department of Justice announced on Tuesday.In addition to shutting down the platform, the FBI arrested its suspected administrator, alleged Russian hacker Kirill Victorovich Firsov.

Security patches released this week by Apple for many of its products address a variety of vulnerabilities, including multiple issues that could lead to arbitrary code execution on the affected devices.

A China-linked threat actor tracked as APT41 has targeted many organizations around the world by exploiting vulnerabilities in Citrix, Cisco and Zoho ManageEngine products, FireEye reported on Wednesday.

The COVID-19 coronavirus outbreak will likely have an impact on early-stage venture investment in cybersecurity, but investors and industry professionals are optimistic.

Publicly available hacking tools, many of which have been developed for research and testing purposes, lower the bar for threat actors looking to target industrial control systems (ICS) and operational technology (OT) networks, FireEye warned this week.

General Electric (GE) revealed last week that the personal information of some employees may have been compromised as a result of a data breach suffered by Canon Business Process Services.