Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Latest Cybersecurity News

Cyberattack disrupted UNFI’s operations in June; company estimates $50–$60 million net income hit but anticipates insurance will cover most losses.

A threat actor that may be financially motivated is targeting SonicWall devices with a backdoor and user-mode rootkit.

Virtual event brings together leading experts, practitioners, and innovators for a full day of insightful discussions and tactical guidance on evolving threats and real-world defense strategies in cloud security.

Compumedics has been targeted by the VanHelsing ransomware group, which stole files from the company’s systems.

iCOUNTER, which helps organizations defend against targeted attacks, has launched under the helm of former Mandiant president and COO John Watters.

Google refused to share any details on how its Big Sleep AI foiled efforts to exploit a SQLite vulnerability in the wild.

Chinese hacking group Salt Typhoon targeted a National Guard unit’s network and tapped into communications with other units.

Cameron John Wagenius pleaded guilty to charges related to hacking into US telecommunications companies.

Italian company Exein has raised €70 million (~$81 million) in a Series C funding round led by Balderton.

Google has released a Chrome 138 security update that patches a zero-day, the fifth resolved in the browser this year.

Obfuscated JavaScript code is embedded within SVG files for browser-native redirection to malicious pages.

People on the Move

Robert Shaker II has joined application security firm ActiveState as Chief Product and Technology Officer.

MorganFranklin Cyber has promoted Nick Stallone and Ferdinand Hamada into newly created roles.

Jessica Newman has joined Sophos as General Manager of Global Cyber Insurance.

Breach and attack simulation solutions provider AttackIQ has appointed Pete Luban as Field Chief Information Security Officer.

Silobreaker announced the appointment of Geoff Brown as its new Chief Executive Officer.

More People On The Move
US National Guard hacked by China US National Guard hacked by China

Chinese hacking group Salt Typhoon targeted a National Guard unit’s network and tapped into communications with other units.

Belk ransomware attack Belk ransomware attack

DragonForce says it stole more than 150 gigabytes of data from US department store chain Belk in a May cyberattack.

Train hacking Train hacking

A vulnerability affecting systems named End-of-Train and Head-of-Train can be exploited by hackers to cause trains to brake. 

Top Cybersecurity Headlines

Louis Vuitton customers in the UK, South Korea, Turkey and possibly other countries are being notified of a data breach.

The latest release of the xAI LLM, Grok-4, has already fallen to a sophisticated jailbreak.

Since August 2015, Google has delivered a constant stream of monthly security patches for Android. Until July 2025.

SecurityWeek Industry Experts

More Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

This online session will explore resilience planning in response to geopolitical tensions and help CISOs navigate the current state of federal cybersecurity initiatives.

Register

Join the summit to explore critical threats to public cloud infrastructure, APIs, and identity systems through discussions, case studies, and insights into emerging technologies like AI and LLMs.

Register

Upcoming Cybersecurity Events

The AI Risk Summit brings together security and risk management executives, AI researchers, policy makers, software developers and influential business and government stakeholders. [August 19-20, 2025 | Ritz-Carlton, Half Moon Bay]

Learn More

SecurityWeek’s CISO Forum Summer Summit & Golf Classic will take place August 19-20 at the Ritz-Carlton, Half Moon Bay, CA. (www.cisoforum.com)

Learn More

The Threat Detection & Incident Response Summit delves into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. [May 21, 2025 – Virtual]

Learn More

SecurityWeek’s Cloud and Data Security Summit returns with a deliberate focus on exposed attack surfaces and weaknesses in public cloud infrastructure and APIs. [July 16, 2025 – Virtual]

Learn More

Vulnerabilities

Cybercrime

Jared Wein, a Software Engineer at Mozilla, has come up with a rather clever security feature for Web browser plugins such as Flash – manual activation. The feature is currently only available in the nightly build of Firefox, but Wein expects it to be ready for Firefox 14.The manual activation is called “click-to-play” and once it is enabled, plugins will require an additional click – or manual activation – before rendering Web content. For example, videos on YouTube will require...

On Friday, security researcher David Emery reported the discovery of a problem within Mac OS X 10.7.3, which results in a user’s password being recorded to a log file in plain text.Emery explained that a debug switch in the current release of Lion was activated sometime before its release, resulting in the user’s legacy Filevault password being written to a log file in plain text. This log will remain on the system for several weeks, and anyone with read access...

Jericho Botnet Analysis: Infection, Persistence and Malicious FunctionsWe’ve talked a lot about modern malware as a concept, but I’d like to use this week’s column to call out one particular sample of malware that I’ve had my eye on for the last several weeks – a new banking botnet that has been referred to as the Jericho Botnet.

CVE-2012-0779 Used in Targeted Attacks Aimed At Manufacturers of Products Used by Defense IndustryOn Friday, Adobe issued a security bulletin to address a recently discovered critical vulnerability in its Flash Player, that according to reports, is being used in targeted attacks.

On Wednesday, a remote code execution vulnerability in PHP was accidentally exposed to the Web, prompting fears that it may be used to target vulnerable websites on a massive scale. The bug itself was traced back to 2004, and came to light during a recent CTF competition.The group that discovered the bug was waiting for a patch to be published before they released any information. However, on Wednesday details were leaked to Reddit prompting the group (Eindbazen) disclose what they...

During what can only be classified as a partial drive-by download attack, visitors to arriving at a compromised domain using an Android device may be subjected to malware that automatically downloads. However, unlike established drive-by attacks, the malware will require user permission to install.The attack was initially reported by a user on Reddit, and the malware family involved has been around since late 2011.

Microsoft is planning to release seven security bulletins – three of which are rated 'critical' – as part of this month's Patch Tuesday update.The fixes span a number of different products, with the critical bulletins covering issues in Microsoft Windows, Silverlight, Microsoft Office and the .NET Framework. All totaled, 23 security vulnerabilities are on tap to be patched.

Event image poster

The leading global conference series for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Learn More

Application Security

Application Security

RevEng.ai has raised $4.15 million in seed funding for an AI platform that automatically detects malicious code and vulnerabilities in software.

Cloud Security

Cloud Security

Virtual event brings together leading experts, practitioners, and innovators for a full day of insightful discussions and tactical guidance on evolving threats and real-world...

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.