SecurityWeek

Bipartisan legislation formally unveiled this week would require the Department of Homeland Security to send notifications on breaches affecting the election systems. 

The web server that the Zoom Client installs on Macs can be abused to execute code remotely, security researchers have discovered. 

The Forum of Incident Response and Security Teams (FIRST) on Friday announced version 3.1 of the Common Vulnerability Scoring System (CVSS).CVSS is a widely adopted standard for rating the severity of software vulnerabilities, and it provides a framework for communicating the characteristics and impact of security flaws.

The United States Conference of Mayors has promised that its members will “stand united” against paying ransoms in case their systems are hit by ransomware.

Organizations can no longer simply dust off their incident response (IR) plan when a breach happens. If you haven’t gone through the rigors of various exercises to know what to expect and what to do, pulling out your IR plan during a cyber attack or after a breach has occurred has little impact. Zero-dollar IR retainers aren’t the best path forward either. They’re cost effective if you aren’t breached, but breaches happen.

Tokyo-based cryptocurrency exchange said Friday it had halted all services after losing cryptocurrency worth more than $32 million in the latest apparent hack involving virtual money.

Apple has disabled the Walkie-Talkie app on the Apple Watch after learning of a serious vulnerability that can be exploited to spy on users.

Premera Blue Cross, the largest health insurer in the Pacific Northwest, has agreed to pay $10 million to 30 states following an investigation into a data breach that exposed confidential information on more than 10 million people across the country.

Google contractors regularly listen to and review some recordings of what people say to artificial-intelligence system Google Assistant, via their phone or through smart speakers such as the Google Home.

Mozilla this week made public a new browser fuzzing framework designed to enable the fast deployment of fuzzers at scale. 

Mozilla is taking the first step toward denying a request by United Arab Emirates-based DarkMatter to be included as a top-level certificate authority in Mozilla’s root certificate program.

Cybersecurity spending has outpaced general IT spend for the last few years, and in 2019 with budgets growing up to 5 percent according to some analysts, this trend is clearly continuing. 

Apple on Wednesday released an update to remove the Zoom web server from all Macs, following controversy that it puts users’ security at risk. 

Taking active steps to safeguard your organization’s digital presence on and offline is not a new recommendation; if anything, elaborate security measures are emblematic of our times.  Passwords, multi-factor access protocols, biometrics and other forms of user authentication have become standard, and for good reason: the incidence of data loss, theft and misuse is huge.

An update released recently by McAfee for one of its products is preventing Windows users from logging on to their systems, and some major organizations appear to have been affected.

Developers of the open source web browser Pale Moon revealed on Wednesday that the project’s archive server was compromised and all executable files were infected with malware.

Hardcoded Credentials in Kiosk Software Allowed Remote Attackers to Compromise API

Endpoint security firm enSilo on Thursday announced new capabilities for its platform, a $23 million Series B funding round, and significant revenue growth.

SAP this week released 11 Security Notes as part of the Patch Day – July 2019, one of which was a Hot News Note addressing a Critical vulnerability in Diagnostics Agent.Tracked as CVE-2019-0330 and featuring a CVSS score of 9.1, the bug is an OS command injection that could lead to the compromise of the entire SAP system. 

One of the two Windows zero-day vulnerabilities fixed by Microsoft with its July 2019 Patch Tuesday updates was used by a threat group known as Buhtrap to target a government organization in Eastern Europe, according to cybersecurity firm ESET.