SecurityWeek

A denial-of-service (DoS) attack that caused disruptions at a power utility in the United States earlier this year exploited a known vulnerability in a firewall used by the affected organization.

The U.S. Cyber Command (USCYBERCOM) this week released 11 malware samples to VirusTotal, all of which appear related to the notorious North Korean-linked threat group Lazarus. 

An initial public exploit targeting the recently addressed BlueKeep vulnerability in Microsoft Windows has been added to Rapid7’s Metasploit framework. 

A Philadelphia man has pleaded guilty to trying to hack the IRS to obtain President Donald Trump's tax returns.Andrew Harris pleaded guilty Thursday to two computer fraud counts in federal court. The 23-year-old faces up to two years in prison and $200,000 fine.

Private equity firms Permira and Advent International are interested in acquiring Symantec’s consumer business for more than $16 billion, The Wall Street Journal reports.

Researchers have discovered several vulnerabilities, including ones that have been classified as serious, in a human-machine interface (HMI) programming software made by U.S.-based Red Lion.

The China-linked threat actor tracked by Symantec as Thrip has continued to target entities in Southeast Asia even after the cybersecurity firm exposed its operations.

Cisco Talos has released two new open source tools for IDA Pro, namely GhIDA, an IDA Pro plugin, and Ghidraaas (Ghidra as a Service), a docker container.

Popular online reference website Wikipedia went down in several countries after the website was targeted by what it described as a "malicious attack".The server of the Wikimedia Foundation, which hosts the site, suffered a "massive" Distributed Denial of Service (DDoS) attack, the organization's German account said in a tweet late Friday.

Apple hit back Friday at a Google research report suggesting iPhones may have been targeted by a long-running hacking operation, calling it inaccurate and misleading.

“What happens if our network is compromised?” is a question that security professionals have been asking for some time. But for a variety of reasons – ranging from network transformation efforts to more sophisticated attack methods – this question has now become, “how do we even know if our network has been compromised?” 

Tide Foundation Creating Marketplace Where PII Can be Safely Sold

South Korean-based manufacturer DK-LOK was found to leak internal and external communications, including data on clients, vpnMentor’s researchers warn.An industrial pipe, valve, and fittings manufacturer, DK-LOK has clients all around the world, and also has branches in various countries, including the United States.

Officials with the pension system for retired Oklahoma Highway Patrol troopers and other state law enforcement officers say the FBI is investigating after computer hackers stole $4.2 million in funds.A notice posted on the Oklahoma Law Enforcement Retirement System website on Friday said no pension benefits of any members are at risk.

Yahoo News reported this week that an Iranian mole recruited by Dutch intelligence helped the United States and Israel sabotage Iran’s nuclear program by planting the

Exim mail servers are vulnerable to attacks due to a security hole that allows a local or remote attacker to execute arbitrary code with root privileges.

Cisco this week addressed a High severity vulnerability in the Webex Teams client for Windows that could allow an attacker to execute commands remotely.The issue is created “due to improper restrictions on software logging features used by the application on Windows operating systems.”

The Android operating system is affected by a zero-day privilege escalation bug residing in the V4L2 driver, Trend Micro’s Zero Day Initiative (ZDI) reveals.

Website and mobile application protection company PerimeterX this week announced a $14 million extension to the Series C funding round it completed in February 2019.

Mozilla this week released Firefox 69 in the stable channel with patches for 20 vulnerabilities, including one code execution bug rated Critical severity.