Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Latest Cybersecurity News

Security researchers at Cisco Talos and Volexity flag two Pakistani espionage campaigns targeting Indian government entities.

Retired U.S. Army General Paul M. Nakasone brings cybersecurity experience to OpenAI’s Board of Directors and Safety and Security Committee.

The increase in mass exploitation involving edge services and devices is likely to worsen.

Ascension says patient information was stolen in an early-May ransomware attack that involved an employee downloading malware.

Noteworthy stories that might have slipped under the radar: Overview of the ICS malware Fuxnet, Google accused of tracking users, scammers impersonate CISA staff.

Rockwell Automation has patched three high-severity vulnerabilities in its FactoryTalk View SE HMI software.

CISA urges federal agencies to apply mitigations for an exploited Progress Telerik vulnerability as soon as possible.

Microsoft is not rolling out Recall with Copilot+ PCs as it’s seeking additional feedback and working on improving security.

YesWeHack has raised more than $52 million to date to build and market a crowdsourced vulnerability reporting platform.

Pyte has raised $5 million for its secure computation platform, bringing the total investment in the company to $12 million. 

Protect AI warns of a dozen critical vulnerabilities in open source AI/ML tools reported via its bug bounty program.

People on the Move

Retired U.S. Army General and former NSA Director Paul M. Nakasone has joined the Board of Directors at OpenAI.

Jill Passalacqua has been appointed Chief Legal Officer at autonomous security solutions provider Horizon3.ai.

Cisco has appointed Sean Duca as CISO and Practice Leader for the APJC region.

Megan Samford named Chief Security Officer of Schneider Electric’s US National Security Agreements & US Federal Business.

Timothy Yost has been named Chief Financial Officer at BlueVoyant.

More People On The Move
Windows Recall security Windows Recall security

Microsoft is not rolling out Recall with Copilot+ PCs as it’s seeking additional feedback and working on improving security.

ICS vulnerabilities ICS vulnerabilities

Analysis and insights on the prevalence and impact of password exposure vulnerabilities in ICS and other OT products.

Microsoft Patches Zero-Click Outlook Vulnerability That Could Soon Be Exploited

Microsoft’s June 2024 Patch Tuesday updates resolve a zero-click Outlook vulnerability leading to remote code execution.

Top Cybersecurity Headlines

The TellYouThePass ransomware gang started exploiting a recent code execution flaw in PHP days after public disclosure.

Apple has released a visionOS update that patches CVE-2024-27812, which may be the first flaw specific to the VR headset.

Arm warns that CVE-2024-4610, a Mali GPU kernel driver vulnerability addressed two years ago, is exploited in attacks.

Mandiant says a financially motivated threat actor has compromised hundreds of Snowflake instances using customer credentials stolen via infostealer malware that infected non-Snowflake owned systems.

Fortinet announces plans to acquire Lacework, a late-stage cloud security startup that was once listed as a “unicorn” company valued north of $1 billion.

SecurityWeek Industry Experts

More Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn how you can transform your security strategy to build your organization’s resilience in the face of evolving threats.

Register

The AI Risk Summit brings together security and risk management executives, AI researchers, policy makers, software developers and influential business and government stakeholders.

Register

Upcoming Cybersecurity Events

The AI Risk Summit brings together security and risk management executives, AI researchers, policy makers, software developers and influential business and government stakeholders. [June 25-26, Ritz-Carlton, Half Moon Bay, CA]

Learn More

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Learn More

Designed for senior level cybersecurity leaders to discuss, share and learn innovative information security and risk management strategies, SecurityWeek’s CISO Forum, will take place June 25-26 at the Ritz-Carlton, Half Moon Bay, CA

Learn More

SecurityWeek’s Threat Detection and Incident Response (TDIR) Summit dives into Threat hunting tools and frameworks, and explores the value of threat intelligence data in the defender’s security stack.

Learn More

Vulnerabilities

Cybercrime

FireEye, a Milpitas, California-based company focused on threat protection solutions, today announced that David DeWalt, former president and chief executive officer of McAfee, has joined the company as chairman of the board of directors.

According to the latest data from Google’s Transparency Report, there has been a surge in the number of removal requests coming from governments and government officials. Even worse, the United States is one of the nations that have made rather large strides in the amount of data removal requests.

According to a report from The Daily Yomiuri, six men have been arrested in Japan for allegedly scamming some 20 million Yen from victims during an Android-based malware scheme. According to the local news magazine, three of the men are IT executives.

CISM and CRISC Named Top Paying IT Certifications as 250 Others Slide Downward According to the IT Skills and Certifications Pay Index (ITSCPI) from Foote Partners, ISACA’s CISM (Certified Information Security Manager) and CRISC (Certified in Risk and Information Systems Control) certifications are the two highest paying credentials in the IT security.

A story published by online Mac OS-related news site Mac Rumors outlines a new requirement for applications running on iOS 6 – strict privacy enforcement. The requirements were explained in the release notes for iOS 6, and seem to address some of the privacy issues Apple has had to contend with lately.

Just days after several large Web-based organizations united to fight malicious online ads, MLB.com was spotted serving malicious ads and directing visitors to Rouge Anti-Virus. Rogue Anti-Virus applications actually generate decent income for some of the criminals who spread them, as they are paid for getting someone to install it, and will sometimes take a cut of the fee if someone registers it.

Sourcefire’s FireSIGHT and FireAMP Mobile Provide Visibility and Control to Help Discover and Block Mobile Threats on Enterprise NetworksCybersecurity solutions provider Sourcefire today announced new solutions designed to help enterprises protect against advanced threats stemming from mobile devices and the challenges associated with the “Bring Your Own Device” (BYOD) trend.

Automatic Transfer System Circumvents Banking Security Measures, Uses "Man in the Browser" Attack to Automate Bank FraudTrend Micro today released a new report that identifies an Automatic Transfer System (ATS) that enables cybercriminals to circumvent many bank security measures and drain victims' bank accounts without leaving visible signs of malicious activity.

The HoneyNet project has launched a new tool dubbed Ghost, developed by a German student, which aims to combat USB-based malware. The researcher from Bonn University, Sebastian Peoplau, developed his tool as part of his bachelor thesis, but it may end up being a go to resource for prevention on standalone and critical systems.

Vladislav Anatolievich Khorokhorin, better known in some circles as ‘Badb’ – has been extradited from France to the United States in order to face charges for credit card trafficking.Badb, according to the U.S. Department of Justice, is the world’s most prolific sellers of stolen credit cards. He made his first appearance before a U.S. judge last week in Washington, D.C., where he was arraigned and ordered detained pending trial.

Event image poster

The leading global conference series for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Learn More

Application Security

Application Security

A critical vulnerability tracked as CVE-2024-34359 and dubbed Llama Drama can allow hackers to target AI product developers.

Cloud Security