SecurityWeek

Malicious hackers have started exploiting a critical WinRAR vulnerability disclosed less than one week ago, just as RARLab has released the final version of the update that should patch the flaw.

According to a survey of 2,600 IT professionals conducted by security awareness training firm KnowBe4, only 38 percent of large companies use multi-factor authentication (MFA) while a whopping 62 percent of small to midsize companies don’t. MFA, which requires more than one method of authentication to verify identity, may not be the sexiest thing around, but with it in place, organizations can make it that much harder for attackers to accomplish their goals.

Huawei's chairman said Tuesday that the United States has "no evidence" that its equipment to build next-generation 5G wireless networks could be used as a vehicle for Chinese spy operations.

A malicious campaign attempting to infect business users in the United States with a backdoor has been ongoing for over half a year, Proofpoint reports. 

A vulnerability patched recently in the Drupal content management system (CMS) has been exploited in the wild to deliver cryptocurrency miners and other payloads. The attacks started just three days after a fix was released.

Malicious actors could plant firmware backdoors on bare metal cloud servers and use them to disrupt applications, steal data, and launch ransomware attacks, firmware security company Eclypsium warned on Tuesday.

China's global dominance in telecommunications networks could pose security threats for decades, Britain's cybersecurity chief warned in a speech in Singapore on Monday.

Mozilla is considering rejecting a request by United Arab Emirates-based DarkMatter to be accepted as a top-level certificate authority in Mozilla’s root certificate program.

Siemens has informed customers that some of its products are affected by recently disclosed vulnerabilities affecting the WibuKey digital rights management (DRM) solution from Wibu Systems.

Starting a business risk intelligence (BRI) program often requires overcoming challenges that involve resource allocation, operational bandwidth, or stakeholder support, to name a few. And occasionally, these challenges can be exacerbated by myths and misconceptions about what BRI is and can accomplish.

On February 19, the European Telecommunications Standards Institute (ETSI) published the ETSI TS 103 645 V1.1.1 -- or more simply, a high-level outcome-focused standard (PDF) for cybersecurity in the consumer-oriented Internet of Things (IoT).

Consumer groups voiced dismay Friday after a US Senate panel considering privacy legislation scheduled a largely industry-packed witness list for an upcoming hearing.

California Attorney General Xavier Becerra and Assemblymember Marc Levine last week introduced a new piece of legislation that would require organizations to notify consumers if their passport or biometric information has been compromised in a data breach.

Federal prosecutors have recommended a sentence of nearly three years in prison for a former Virginia high school teacher convicted of hacking into private digital accounts of celebrities and others.

Duo Labs, part of Cisco-owned Duo Security, has launched a new service designed to analyze Chrome extensions and deliver security reports on them. 

Several phone apps are sending sensitive user data, including health information, to Facebook without users' consent, according to a report by The Wall Street Journal.An analytics tool called "App Events" allows app developers to record user activity and report it back to Facebook, even if the user isn't on Facebook, according to the report .

Key parts of the internet infrastructure face large-scale attacks that threaten the global system of web traffic, the internet's address keeper warned Friday.

The Face ID and Touch ID authentication feature introduced recently to WhatsApp for iOS can be easily bypassed, but a patch has been released.

Entrust Datacard and Thales have signed a definitive agreement for Entrust to acquire the nCipher general purpose hardware security module (GP HSM) division of Thales. Financial details have not been disclosed.