SecurityWeek

The Kronos banking Trojan is showing renewed strength and has been very active over the past several months, Proofpoint security researchers warn. 

One of the Solaris vulnerabilities patched by Oracle with its July 2018 Critical Patch Update (CPU) exists due to an ineffective fix implemented by the company for a flaw first discovered in 2007.

Recent reports of a newly detected Smoke Loader infection campaign and the re-emergence of Magecart-based cyber-attacks illustrate a common tactic used by cyber criminals and state-sponsored attackers alike ― credential harvesting. According to the Verizon 2017 Data Breach Investigation Report, 81% of hacking-related breaches leverage either stolen, default, or weak credentials.

It’s summer time, which means privileged users are away on vacations and contractors or co-workers are taking up the slack. Managing the temporary access that this requires is not something you want to leave to chance. 

Vancouver, Canada-based customer identity and access management (cIAM) firm LoginRadius has raised $17 million Series A funding led by ForgePoint Capital and Microsoft's venture fund, M12.

The United States and Australia have signed an agreement that will enable the two allies to conduct research and development to advance their combined cyber capabilities, officials said Tuesday.

Researchers discovered that two vulnerabilities in the Apache OpenWhisk serverless cloud platform could have allowed malicious actors to overwrite and execute arbitrary code.

The infamous Hide ‘N Seek botnet is now targeting vulnerabilities in home automation solutions, network security firm Fortinet says.

Network traffic analysis firm Gigamon on Tuesday announced plans to acquire network security startup ICEBRG.

Siemplify, a New York, NY-based provider of security orchestration, automation and response (SOAR) tools, today announced that it has raised $14 million in a Series B funding round led by Jump Capital.This latest funding brings the total amount raised by the company to $28 million. 

UK-based industrial software company AVEVA has patched two critical remote code execution vulnerabilities discovered by researchers in its InTouch and InduSoft development tools.

Complex Compliance Requirements are Delaying U.S. Government's Digital Transformation, Study Shows

At least two threat groups have started exploiting a critical Oracle WebLogic vulnerability patched earlier this month. The attacks began shortly after several proof-of-concept (PoC) exploits were made public.

The National Institute of Standards and Technology (NIST) recently updated its cybersecurity framework (CSF), rolling out changes to all five pillars: Identify, Protect, Detect, Respond, and Recover. These changes present some challenges for industrial organizations that want or need to comply with this CSF.

A publicly accessible server belonging to robotics vendor Level One Robotics and Controls, Inc. contained sensitive documents connected to more than one hundred manufacturing companies.

This isn’t another article about the skills shortage. We’ve all read plenty of those, detailing the alert fatigue plaguing analysts and the number of unfilled positions the industry can expect by 2020. Not only does the shortage seem to get bigger and more dramatic with every article I read, but all this talk isn’t getting us any closer to a solution.

A high severity vulnerability affecting some Bluetooth implementations can allow an attacker in physical proximity of two targeted devices to monitor and manipulate the traffic they exchange. Some of the impacted vendors have already released patches.

The Apache Software Foundation informed users over the weekend that updates for the Tomcat application server address several vulnerabilities, including issues that can lead to information disclosure and a denial-of-service (DoS) condition.

The European Union said Monday it has launched an anti-trust investigation into the planned purchase by French aerospace and defence group Thales of SIM manufacturer Gemalto.

A wave of attacks is targeting Android devices with port 5555 open, likely in an attempt to ensnare them into a botnet, Trend Micro warns.