Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Latest Cybersecurity News

CISA and other agencies call to action for the US government to take steps to close the software understanding gap.

Noteworthy stories that might have slipped under the radar: several multi-million dollar settlements, CrowdStrike-themed phishing emails, and MITRE launches D3FEND 1.0.

Law firm Wolf Haldenstein Adler Freeman & Herz LLP says more than 3.4 million people were impacted by a December 2023 data breach.

Google releases OSV-SCALIBR, an open source library for software composition analysis and file system scanning.

The US Treasury has sanctioned two individuals and four entities involved in the North Korean fake IT worker scheme.

Industry professionals comment on the Biden administration’s new executive order on cybersecurity. 

Three vulnerabilities in SimpleHelp could allow attackers to compromise the remote access software’s server and the client machine.

Cisco has unveiled AI Defense, a solution designed to help organizations protect development and use of AI applications. 

Microsoft researchers catches Russia’s Star Blizzard hackers spear-phishing with QR codes and WhatsApp group chats.

New research shows that over 4 million systems on the internet, including VPN servers and home routers, are vulnerable to attacks due to tunneling protocol flaws.

Authentication solutions provider Wultra has raised €3 million (~$3.1 million) for its post-quantum technology.

People on the Move

Karl Triebes has joined Ivanti as Chief Product Officer.

Steven Hernandez has joined USAID as CISO and Deputy CIO.

Data security and privacy firm Protegrity has named Michael Howard as its CEO.

Anand Ramanathan has been appointed as Chief Product Officer at Deepwatch.

Managed security platform provider Deepwatch has appointed Sammie Walker as CMO.

More People On The Move
Healthcare data breach Healthcare data breach

In 2024 organizations informed the US government about 585 healthcare data breaches affecting a total of nearly 180 million user records.

CISA CISA

Jen Easterly hopes CISA is allowed to continue its election-related work under new leadership despite “contentiousness” around that part of its mission.

Fortinet vulnerability exploited Fortinet vulnerability exploited

Fortinet patches critical vulnerabilities, including a zero-day that has been exploited in the wild since at least November 2024. 

Top Cybersecurity Headlines

Patch Tuesday: Microsoft’s January Patch Tuesday rollout includes fixes for 160 security defects, the largest number of CVEs addressed in any single month since at least 2017.

Attackers are exploiting a critical vulnerability in Aviatrix Controller to execute arbitrary code in AWS cloud environments.

Chinese cyberspies targeted offices dealing with foreign investments and sanctions in the recent US Treasury hack. 

SecurityWeek Industry Experts

More Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Explore trends and technologies that will shape the future of cybersecurity. Discover strategies for vendor selection, integration to minimize redundancies, and maximizing ROI from your cybersecurity investments. Gain actionable insights to ensure your stack is ready for tomorrow’s challenges.

Register

Dive into critical topics such as incident response, threat intelligence, and attack surface management. Learn how to align cyber resilience plans with business objectives to reduce potential impacts and secure your organization in an ever-evolving threat landscape.

Register

Upcoming Cybersecurity Events

The AI Risk Summit brings together security and risk management executives, AI researchers, policy makers, software developers and influential business and government stakeholders. [June 2025, Stay Tuned]

Learn More

SecurityWeek’s CISO Forum Summer Summit & Golf Classic will take place June 25-26 at the Ritz-Carlton, Half Moon Bay, CA

Learn More

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.(February 26, 2025)

Learn More

Supply Chain Security Summit
Join us as we explore the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects. (March 19, 2025)

Learn More

Vulnerabilities

Cybercrime

Analyzing Outbound and Inbound Traffic, and Network Segmentation Can Help Protect Your Network, Even After It Has Been Compromised.In my previous column I took a long look at modern malware with a focus on how to prevent malware from getting into your network in the first place. In case you missed it, you can read it here.

General Dynamics today announced that its Information Technology unit has been awarded an $86 million contract to provide information assurance and cyber security services to the Defense Intelligence Agency.Under the contract, General Dynamics will provide cyber security services to help ensure the authenticity, integrity and confidentiality of the DIA's information, and protect the agency’s enterprise-level assets, networks, security domains and data resources globally.

SEC Looking to Protect Investors and Boost Breach DisclosureOn Thursday, the U.S. Securities and Exchange Commission’s Corporation Finance division released guidance to publically traded companies on cybersecurity incident disclosure. The goal is to inform investors of risk, and release more information when filing with the SEC.

Air Force officials revealed more details about a malware infection that impacted systems at the Creech Air Force Base in Nevada. The malware attack received media attention last week when Wired.com reported malware had infected the cockpits of fighter drones used by the Air Force. Citing sources on the base, Wired reported that the malware was first discovered in September and had resisted attempts to clean computer systems.

Walking the tightrope between data security and the desire for maximum performance is a high-wire act well known to organizations that rely on the critical information contained within their databases. Their search for the right mix now prompts them to find the best way to identify users tapping into sensitive databases, while minimizing any impact on performance. Anonymity—there are times when it is not only desirable but vital.

Akamai Technologies, the Cambridge, Massachusetts based company that at any point delivers between 15-30% of all global Web traffic, today introduced two new solutions designed to address the increasingly complex challenges of doing business online– Akamai DDoS Defender and Akamai Compliance Management Modules.

On Wednesday, SIEM vendor LogRhythm announced the latest release of its SIEM-focused security intelligence platform, LogRhythm 6.0. The release is a step forward, and includes pattern recognition and responsive monitoring, which can act on its own if warranted. In addition, baseline changes offer faster indexing and processing of logs, as well as increased storage capacity.

Event image poster

The leading global conference series for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Learn More

Application Security

Application Security

CISA and other agencies call to action for the US government to take steps to close the software understanding gap.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.