SecurityWeek

The new year is only a couple of weeks old and there have already been several ICS related security incidents in the news. The media often sensationalizes these incidents. This is creating hype and growing worldwide awareness and concern over the threat of cyber attacks against industrial and critical physical infrastructures. I believe that 2017 will be the year ICS security becomes a mainstream media topic.

Oracle on Tuesday released its first Critical Patch Update (CPU) for 2017. The software update addresses 270 security issues across its products, 121 of which were found in Oracle E-Business Suite.

A researcher claims to have received a $40,000 bounty from Facebook for finding a remote code execution vulnerability introduced by the ImageMagick image processing suite.

A security vulnerability that allowed a privileged attacker to arbitrary write values within kernel space lurked in Nexus 9’s kernel for two years before being patched, IBM security researchers reveal.

Not Adhering to Responsible Disclosure has the Potential to Amplify the Threats Posed by Certain Vulnerabilities and Incidents

In 2016, 3.3 billion user credentials were spilled onto the internet, according to figures from Shape Security's Credential Spill Report.

Unknown to vendors but exploited by cybercriminals, zero-day vulnerabilities are the most threatening security issues, but Microsoft's Windows 10 can block exploitation of these vulnerabilities before they are even patched, Microsoft says.

Shanghai - App stores in China must register with the state from Monday, a government statement said, as China tightens its control over the internet. App stores are "not strict" when they examine and approve apps, the China Cyberspace Administration, the country's internet watchdog, said in a statement.

Germany-based security services provider Cure53 has conducted a security audit of Dovecot and determined that the software lives up to its reputation of being highly secure.

A researcher has disclosed a couple of unpatched vulnerabilities affecting the official McDonald’s website after the company ignored his attempts to responsibly report the issues.

Being hit by ransomware usually means that you no longer have access to your files unless you pay a ransom or find another way to decrypt them, but a newly released tool allows users to move encrypted files to a new location.

Swiss-based industrial and building automation solutions provider Carlo Gavazzi has released firmware updates for some of its energy monitoring products to address potentially serious vulnerabilities that could expose devices to remote cyberattacks.

Some third-party applications unnecessarily store keys or secrets that could be abused to leak a variety of user credentials and other type of sensitive data, software security startup Fallible warns.