SecurityWeek

SAP this week released seven new security notes as part of the October 2019 Security Patch Day, with two of these notes rated Hot News (Critical).

Global ransomware attacks are on the decline, but such malicious cyber strikes are getting bolder and homing in on more profitable companies, with data encryption a key target, Europe's police agency said Wednesday.

The European Union hinted strongly it viewed Chinese tech group Huawei as a security risk to its roll-out of 5G networks in a report released Wednesday.

The Iranian state-sponsored threat actor known as Charming Kitten employed new spear-phishing methods in a campaign observed in August and September, ClearSky’s security researchers report.

A security audit funded by Mozilla has led to the discovery of a critical remote command execution vulnerability in the popular iTerm2 macOS terminal emulator.

Representatives of the utilities industry believe the risk of cyberattacks on the sector has increased and many expect an attack on critical infrastructure in the next year, according to a study conducted by Siemens and the Ponemon Institute.

In 2010, SANS reported that knowledge of the Pass the Hash attack first described some thirteen years earlier was still poor. By 2019, knowledge of the threat vector that has now been in the public domain for more than two decades has improved, but is still not complete.

A group of cybersecurity companies this week announced the Open Cybersecurity Alliance (OCA), a joint effort focused on the development of open source security technologies.

After the UK’s National Cyber Security Centre (NCSC) issued an alert, the National Security Agency (NSA) in the United States has also warned organizations that multiple state-sponsored threat actors have been exploiting the recently disclosed vulnerabilities affecting enterprise VPN products from Pulse Secure, Fortinet and Palo Alto Networks.

Blockchain Can Protect Systems and Devices While Supporting IoT Devices that Have Few Security Defenses

Apple this week released its latest desktop operating system iteration, macOS Catalina 10.15, which includes patches for a total of 16 vulnerabilities.

A critical remote code execution (RCE) vulnerability affecting several D-Link routers that reached their end of life (EOL) remains unpatched.

The United States and the United Kingdom have signed an agreement designed to help law enforcement agencies gain faster access to data related to serious crimes. This is the first such agreement based on the Clarifying Lawful Overseas Use of Data Act, or CLOUD Act, which was enacted into U.S. federal law on March 23, 2018.

Twitter on Tuesday apologized after "inadvertently" using phone numbers and email addresses for advertising even though the personal data was provided for account security.Twitter users' phone numbers and email addresses -- submitted to allow for account authentication -- were matched with advertisers' own data to enable targeted ads.

Virtualization and cloud infrastructure giant VMWare (NYSE: VMW) announced on Tuesday that it has completed its acquisition of endpoint security firm Carbon Black (NASDAQ: CBLK) in an all-cash transaction for $26 per share, representing an enterprise value of $2.1 billion.

A couple of vulnerabilities affecting the TwinCAT PLC runtime from Beckhoff can be exploited for denial-of-service (DoS) attacks, which may be triggered by malicious actors or by accident.

An analysis of more than 2.2 billion emails between April and June (Q2) 2019 exposes the current tactics, techniques and targets of contemporary attackers. 

Microsoft’s Patch Tuesday updates for October 2019 fix 60 vulnerabilities, but none of them appear to have been exploited in attacks and only nine are considered critical.

Despite everything that has happened over the last four years, the security posture of the 2020 presidential candidates' campaign websites is little better and often worse than it was in 2016.

Google’s October 2019 set of security patches for Android address a total of 26 vulnerabilities in the operating system, including a couple of remote code execution bugs impacting Android 10.