Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Latest Cybersecurity News

Noteworthy stories that might have slipped under the radar: surge in cyberattacks between India and Pakistan, Radware cloud WAF vulnerabilities, xAI key leak.

Supply chain attack compromises the popular rand-user-agent NPM package to deploy and activate a backdoor.

VMS firm Valsoft Corporation says the personal information of over 160,000 people was compromised in a February 2025 data breach.

Three NPM packages posing as developer tools for Cursor AI code editor’s macOS version contain a backdoor.

Sightline Security’s founder explains why nonprofits need cybersecurity solutions tailored to their unique missions — and why vendors need to listen.

Hundreds of SAP NetWeaver instances hacked via a zero-day that allows remote code execution, not only arbitrary file uploads, as initially believed.

VC firm Insight Partners is informing partners and employees that their information was exposed in the January 2025 cyberattack.

Private messages, Bitcoin addresses, victim data, and attacker information were leaked after someone hacked a LockBit admin panel.

British startup exits stealth with $20 million in seed-stage financing led by US investors Scout Ventures and Artis Ventures.

Four people have been arrested in Poland and several websites associated with DDoS-for-hire services have been shut down.

SonicWall patches three SMA 100 vulnerabilities, including a potential zero-day, that could be chained to execute arbitrary code remotely.

People on the Move

Edge Delta has appointed Joan Pepin as its Chief Information Security Officer.

Vats Srivatsan has been appointed interim CEO of WatchGuard after Prakash Panjwani stepped down.

Network security policy management firm FireMon has appointed Alex Bender as Chief Marketing Officer.

Jeffrey Engle has been named CEO of CYBERWELL, the cybersecurity division of WELL Health Technologies.

Cryptographic security solutions provider Garantir has named Trell Rohovit as CEO.

More People On The Move
LockBit ransomware hacked LockBit ransomware hacked

Private messages, Bitcoin addresses, victim data, and attacker information were leaked after someone hacked a LockBit admin panel.

SonicWall vulnerability exploited SonicWall vulnerability exploited

SonicWall patches three SMA 100 vulnerabilities, including a potential zero-day, that could be chained to execute arbitrary code remotely.

Oil and gas ICS SCADA attacks Oil and gas ICS SCADA attacks

Agencies say the attacks leverage basic intrusion techniques, but poor cyber hygiene within critical infrastructure organizations could lead to disruptions and damage.

Top Cybersecurity Headlines

John Kindervag is best known for developing the Zero Trust Model. He is a hacker, but not within our common definition of a hacker today.

Android’s May 2025 security update includes patches for an exploited vulnerability in the FreeType open source rendering engine.

The proposed $491 million cut is being positioned as a “refocusing”of CISA on its core mission “while eliminating weaponization and waste.”

SecurityWeek Industry Experts

More Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this event as we dive into threat hunting tools and frameworks, and explore value of threat intelligence data in the defender’s security stack.

Register

This webinar will guide you in aligning your security testing strategy with the right tools, helping you move beyond identifying weaknesses to effectively validating your overall security posture.

Register

Upcoming Cybersecurity Events

The AI Risk Summit brings together security and risk management executives, AI researchers, policy makers, software developers and influential business and government stakeholders. [August 19-20, 2025 | Ritz-Carlton, Half Moon Bay]

Learn More

SecurityWeek’s CISO Forum Summer Summit & Golf Classic will take place August 19-20 at the Ritz-Carlton, Half Moon Bay, CA. (www.cisoforum.com)

Learn More

The Threat Detection & Incident Response Summit delves into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. [May 21, 2025 – Virtual]

Learn More

SecurityWeek’s Cloud and Data Security Summit returns with a deliberate focus on exposed attack surfaces and weaknesses in public cloud infrastructure and APIs. [July 16, 2025 – Virtual]

Learn More

Vulnerabilities

Cybercrime

Vulnerability management has become a term that continues to be thrown around in security circles as a quick and easy path to threat remediation. However, the reality is that most companies are not actually managing vulnerabilities, but rather conducting scans that produce thousands of potential threats. Identifying possible security risks and actually managing them through to remediation are completely different things.

San Jose, California-based Zscaler, a provider of cloud-based security solutions, today added new analytics technology to its cloud security suite designed to provide enterprise security teams with real-time visibility into employee Internet activity across web, cloud email, and mobile application platforms.

Increased use of applications, mobility, virtualization, and network security consolidation as well as the evolution of sophisticated threats has driven the evolution of the traditional stateful firewall to what is commonly referred to as a next-generation firewall (NGFW).

After rushing out a Java update to address 50 security vulnerabilities back on Feb. 1, two weeks ahead of schedule, Oracle has acknowledged that the release missed some fixes and that it would issue an updated version of the February 2013 Critical Patch Update on the originally scheduled date.

The Myanmar government has rejected claims that it is responsible for efforts to hack into the email accounts of foreign and local journalists working in the country. According to reports, at least 12 reporters received messages from Google last week when they tried to access their Gmail accounts that alerted them to possible attempts by hackers to compromise their account.

According to a report from Bloomberg, President Obama could issue an executive order aimed at cybersecurity as soon as this week. Word if the pending directive comes via two former White House officials briefed on the plans, the news agency reported.

If you need a one off example this week of why internal policies are important, or why failure to adhere to them could spell trouble, look no further than Bit9. According to the application whitelisting company, it was their failure to follow organizational deployment mandates, which led to one of their code-signing certificates being hijacked by an attacker.

The recent New York Times hack was yet another high-profile attack that demonstrated the evolution towards multi-vector, sophisticated attacks. In this case, the mission of the perpetrators was very specific -- retrieving editorial information and data related to a particular story -- but it could easily have been nastier.

DHAKA - Bangladesh has formed a fast-track court to try cyber criminals after a spike in crimes involving mobile phones and social networking sites such as Facebook, an official said Thursday.

ATHENS - Cybercrime attacks are going unreported in Greece with companies either unaware of incidents or trying to sweep them under the carpet, experts told a security conference on Thursday.

WASHINGTON - A criminal inquiry was launched Friday into how a hacker appeared to breach email accounts belonging to former presidents George H.W. Bush and George W. Bush, as well as other members of their family.

It’s funny how often, as I go about my day job in network security assessment and risk management, I run into parallels with other fields. One good example comes from cosmology (although I suppose I should be careful using words like “parallel” about the people who worry about the curvature of space).

Adobe issued an update for its Flash Player on Thursday, which hardens the media player against two vulnerabilities being actively exploited. Of note, is the warning that one of the flaws is being used in drive-by attacks targeting users of both Windows and Mac OS X.

Event image poster

The leading global conference series for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Learn More

Application Security

Application Security

Code quality and security firm CodeAnt has secured $2 million in seed funding and it has been valued at $20 million.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.