SecurityWeek

Unofficial patches have been released for two unfixed Oracle Java Runtime Environment (RE) vulnerabilities discovered by Google Project Zero researcher Mateusz Jurczyk.

Updates released this week by Rockwell Automation for its Allen-Bradley Stratix industrial switches patch several denial-of-service (DoS) vulnerabilities introduced by the use of Cisco software.

Some of the nation’s top research universities are cutting ties with Chinese tech giant Huawei as the company faces allegations of bank fraud and trade theft.

NVIDIA this week released security patches to address multiple vulnerabilities in the Tegra Linux Driver Package (L4T), including several flaws assessed with a “high” severity rating.The most important of the bugs is CVE‑2018‑6269, a vulnerability residing in the Tegra kernel driver (the issue features a CVSS score of 8.8).

A recently identified malware family is actively scanning the Internet for exposed web services and default passwords, AT&T Alien Labs reports.

Hundreds of users have been targeted with malware over the past month as part of attacks that Kaspersky Lab has linked to last year’s Roaming Mantis campaign.

Cisco on Thursday announced new patches it has released for the RV320 and RV325 routers to correctly address vulnerabilities that have been targeted in attacks for over two months.

For many organizations, the network perimeter has been replaced with a variety of new network edges. Many of these include unique challenges that can severely complicate an organization’s ability to maintain a consistent and manageable security infrastructure. These security challenges are two-fold. 

An increasing reliance on online digital technologies, driven in no small part by the many operational benefits they deliver, has prompted organizations to consider investing in capabilities that protect against the digital risks that can often characterize their adoption. Unfortunately, when it comes to digital risk there is no universal remedy for establishing maturity.

TXOne Networks, a joint venture between cybersecurity firm Trend Micro and industrial networking solutions provider Moxa, this week unveiled its first product, an industrial intrusion prevention system (IPS).

Microsoft does not seem too concerned about the risk posed by unpatched Internet Explorer and Edge vulnerabilities for which proof-of-concept (PoC) exploits were recently made public.

Facebook has been found asking users for their email passwords. A screen form told users that their email address needed to be confirmed in order to update their contact information, and suggested that it could be done via gmx.net. All the user needed do was enter their email account password into the Facebook form.

German chemicals giant Bayer confirmed Thursday reports it had suffered a hacking attack, but insisted that so far no data appeared to have been stolen.The Leverkusen-based group "detected indications of (hacker group) Winnti infections at the beginning of 2018," a spokesman told AFP, confirming reports by German public broadcasters BR and NDR.

Two companies exposed more than 540 million records containing information on Facebook users and their activities by leaving the data unprotected in Amazon Web Services (AWS) S3 buckets.

A new variant of the XLoader Trojan is targeting Android devices by posing as a security application, and also attempts to infect iPhones and iPads through a malicious iOS profile, Trend Micro reports. 

Canadian authorities last week raided a residence in connection with Orcus Technologies, the developer of Orcus RAT, a tool sold on underground markets for its remote access capabilities. 

Microsoft says it has awarded more than $2,000,000 in bug bounty rewards to security researchers who have reported vulnerabilities via the company’s bounty program. 

Long equipment life cycles and other factors expose manufacturing companies to a wide range of threats, according to a new report published on Wednesday by Trend Micro.

Several serious vulnerabilities have been patched by Taiwan-based industrial automation company Advantech in its WebAccess SCADA software.

The number of data breaches has skyrocketed in recent years. Contrary to popular belief and Hollywood story lines, cyber-attacks are rarely carried out by legions of highly sophisticated coders gone rogue, deploying the most advanced techniques to penetrate organizations’ perimeter defenses.