RansomHub is extorting Change Healthcare, threatening to release data stolen in a February 2024 BlackCat ransomware attack. The post Second Ransomware Group Extorting Change Healthcare appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read the…
Economic analysis and litigation support firm GMA says personal and medical information was stolen in a May 2023 data breach. The post DOJ-Collected Information Exposed in Data Breach Affecting 340,000 appeared first on SecurityWeek. This article has been indexed from…
SecurityWeek discusses cybersecurity leadership with CISOs from crowdsourced hacking organizations Bugcrowd (Nick McKenzie) and HackerOne (Chris Evans) The post CISO Conversations: Nick McKenzie (Bugcrowd) and Chris Evans (HackerOne) appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS…
Veterinary services provider CVS Group is restoring systems after a cyberattack disrupted its UK operations. The post CVS Group Restoring Systems Impacted by Cyberattack appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read the original…
Unpatched D-Link NAS device vulnerability CVE-2024-3273, potentially affecting many devices, is being exploited in the wild. The post Exploitation Attempts Target Unpatched Flaw Affecting Many D-Link NAS Devices appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS…
StrikeReady, an early-stage Silicon Valley startup working on technology to modernize cybersecurity command centers, has banked $12 million in new financing from 33N Ventures. The Palo Alto, Calif.-based StrikeReady said the Series A included equity interests for Hitachi Ventures, Monta…
Researchers at the Shadowserver Foundation identify thousands of internet-exposed Ivanti VPN appliances likely impacted by a recently disclosed vulnerability leading to remote code execution. The post Thousands of Ivanti VPN Appliances Impacted by Recent Vulnerability appeared first on SecurityWeek. This…
New Ahoi attacks Heckler and WeSee target AMD SEV-SNP and Intel TDX with malicious interrupts to hack confidential VMs. The post Confidential VMs Hacked via New Ahoi Attacks appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS…
The American Privacy Rights Act would preempt most state privacy laws — though it wouldn’t impact certain states’ laws already on the books that protect financial, health or employee data. The post Key Lawmakers Float New Rules for Personal Data…
The US Department of Health warns of financially motivated social engineering attacks targeting healthcare organizations. The post Healthcare IT Help Desk Employees Targeted in Payment-Hijacking Attacks appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read…
Crowdfense has announced a $30 million exploit acquisition program covering Android, iOS, Chrome, and Safari zero-days. The post Company Offering $30 Million for Android, iOS, Browser Zero-Day Exploits appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS…
Google fights Chrome V8 engine memory safety bugs with a new sandbox and adds it to the bug bounty program. The post Google Adds V8 Sandbox to Chrome appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS…
US National Security Agency appoints Dave Luber as its new cybersecurity director following the retirement of Rob Joyce. The post NSA Appoints Dave Luber as Cybersecurity Director appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed…
TrojAI, a provider of enterprise AI security solutions, announced a $5.75 million funding round of additional seed capital and the appointment of Lee Weiner as CEO. The post Enterprise AI Security Firm TrojAI Raises $5.75M in Seed Funding appeared first…
Incognito modes generally do not prevent the websites you visit from seeing your location, via your IP address, or stop your internet service provider from logging your activities. The post Browsing in Incognito Mode Doesn’t Protect You as Much as…
Section 702 of the Foreign Intelligence Surveillance Act expires on April 19. The post House to Take up Bill to Reauthorize Crucial US Spy Program as Expiration Date Looms appeared first on SecurityWeek. This article has been indexed from SecurityWeek…
Cisco says it will not release patches for a cross-site scripting vulnerability impacting end-of-life small business routers. The post Cisco Warns of Vulnerability in Discontinued Small Business Routers appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS…
With so much money riding on the promise of AI advances, it’s no surprise that AGI is also becoming a corporate buzzword that sometimes attracts a quasi-religious fervor. The post Tech Companies Want to Build Artificial General Intelligence. But Who…
NIST announced $3.6 million in grants for 18 education and community organizations to build the future cybersecurity workforce. The post NIST Grants $3.6 Million to Boost US Cybersecurity Workforce appeared first on SecurityWeek. This article has been indexed from SecurityWeek…
Noteworthy stories that might have slipped under the radar: the CISA hack could impact 100,000 people, Microsoft AI Copilot banned by US House, UK nuclear site prosecution. The post In Other News: 100,000 Affected by CISA Breach, Microsoft AI Copilot…
Japanese lens maker Hoya says production processes and ordering systems were disrupted by a cyberattack. The post Lens Maker Hoya Scrambling to Restore Systems Following Cyberattack appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read…
Acuity, the tech firm from which hackers claimed to have stolen State Department and other government data, confirms hack, but says stolen info is old. The post Acuity Responds to US Government Data Theft Claims, Says Hackers Obtained Old Info…
Attackers are exploiting a recent Magento vulnerability to deploy a persistent backdoor on ecommerce websites. The post Magento Vulnerability Exploited to Deploy Persistent Backdoor appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read the original…
Cybersecurity companies raised $2.3 billion in funding in Q1 2024, a 20% decrease compared to the same period of 2023, according to Pinpoint. The post Cybersecurity Firms Raised $2.3 Billion in Q1 2024: Report appeared first on SecurityWeek. This article…
Ivanti releases a carefully scripted YouTube video and an open letter from chief executive Jeff Abbott vowing to fix the entire security organization. The post Ivanti CEO Vows Cybersecurity Makeover After Zero-Day Blitz appeared first on SecurityWeek. This article has…
Omni Hotels & Resorts tells customers that recent disruptions have been caused by a cyberattack that forced it to shut down systems. The post Cyberattack Causes Disruptions at Omni Hotels appeared first on SecurityWeek. This article has been indexed from…
City of Hope is notifying 800,000 individuals of a data breach impacting their personal and health information. The post US Cancer Center Data Breach Impacting 800,000 appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read…
Google this week patched two Pixel phone zero-day vulnerabilities actively exploited by forensic companies to obtain data from devices. The post Pixel Phone Zero-Days Exploited by Forensic Firms appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS…
Data breach impacting users’ personal information prompts survey rewards platform SurveyLama to reset passwords. The post SurveyLama Data Breach Impacts 4.4 Million Users appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read the original article:…
Cloud security firm provides a detection platform able to detect and predict the likely behavior of ‘bad’ identities. The post Cloud Threat Detection Firm Permiso Raises $18 million appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS…
A critical OS command injection in Progress Flowmon can be exploited to gain remote, unauthenticated access to the system. The post Critical Vulnerability in Progress Flowmon Allows Remote Access to Systems appeared first on SecurityWeek. This article has been indexed…
New HTTP/2 DoS method named Continuation Flood can pose a greater risk than Rapid Reset, which has been used for record-breaking attacks. The post New HTTP/2 DoS Attack Potentially More Severe Than Record-Breaking Rapid Reset appeared first on SecurityWeek. This…
Video conferencing giant Zoom has paid out $10 million through its bug bounty program since it was launched in 2019. The post Zoom Paid Out $10 Million via Bug Bounty Program Since 2019 appeared first on SecurityWeek. This article has…
News analysis: SecurityWeek editor-at-large Ryan Naraine reads the CSRB report on China’s audacious Microsoft’s Exchange Online hack and isn’t at all surprised by the findings. The post Microsoft’s Security Chickens Have Come Home to Roost appeared first on SecurityWeek. This…
An analysis by Forescout shows 300,000 Chinese devices in the US, up 40% compared to the previous year, despite bans. The post Number of Chinese Devices in US Networks Growing Despite Bans appeared first on SecurityWeek. This article has been…
MITRE is unable to compile a list of all new vulnerabilities, and NIST is unable to subsequently, and consequently, provide an enriched database of all vulnerabilities. What went wrong, and what can be done? The post CVE and NVD –…
How can security practitioners make sense of the vendor landscape and separate those who talk a good game from those who can execute, perform, and solve real problems for enterprises? The post Know Your Audience When Speaking to Security Practitioners…
A critical SQL injection vulnerability in the LayerSlider WordPress plugin allows attackers to extract sensitive information. The post Critical Vulnerability Found in LayerSlider Plugin Installed on a Million WordPress Sites appeared first on SecurityWeek. This article has been indexed from…
Cyber Safety Review Board, said “a cascade of errors” by Microsoft let state-backed Chinese cyber operators break into email accounts of senior U.S. officials. The post Scathing Federal Report Rips Microsoft for Shoddy Security, Insincerity in Response to Chinese Hack…
Jackson County, Missouri, discloses ‘significant disruptions’ to IT systems, says ransomware attack likely at fault. The post Missouri County Hit by Ransomware appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read the original article: Missouri…
The discovery of the XZ Utils backdoor reminds an F-Droid developer of a similar incident that occurred a few years ago. The post XZ Utils Backdoor Attack Brings Another Similar Incident to Light appeared first on SecurityWeek. This article has…
Google pushes a new Chrome update to patch another zero-day vulnerability demonstrated at a hacking contest. The post Google Patches Chrome Flaw That Earned Hackers $42,500 at Pwn2Own appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS…
Google patches 28 vulnerabilities in Android and 25 bugs in Pixel devices, including two flaws exploited in the wild. The post Google Patches Exploited Pixel Vulnerabilities appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read…
Google is bringing to Chrome new features to bind browser sessions to the device and protect users against cookie theft. The post Chrome to Fight Cookie Theft With Device Bound Session Credentials appeared first on SecurityWeek. This article has been…
A cross-site scripting vulnerability in the WP-Members Membership plugin could allow attackers to inject scripts into user profile pages. The post Security Flaw in WP-Members Plugin Leads to Script Injection appeared first on SecurityWeek. This article has been indexed from…
Self check-in kiosks at Ibis Budget hotels were affected by a vulnerability that exposed keypad codes that could be used to enter rooms. The post Hotel Self Check-In Kiosks Exposed Room Access Codes appeared first on SecurityWeek. This article has…
Twenty-seven cybersecurity-related merger and acquisition (M&A) deals were announced in March 2024. The post Cybersecurity M&A Roundup: 27 Deals Announced in March 2024 appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read the original article:…
The OWASP Foundation says a wiki misconfiguration exposed resumes filed over a decade ago by aspiring members. The post OWASP Data Breach Caused by Server Misconfiguration appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read…
Prudential Financial says the names, addresses, and ID numbers of over 36,000 were stolen in a February data breach. The post Prudential Financial Data Breach Impacts 36,000 appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed…
Heartbleed made most certificates vulnerable. The future problem is that quantum decryption will make all certificates and everything else using RSA encryption vulnerable to everyone. The post Heartbleed is 10 Years Old – Farewell Heartbleed, Hello QuantumBleed! appeared first on…
MarineMax confirms suffering a data breach as a result of a recent ransomware attack, with the attackers claiming to have obtained 180,000 files. The post Boat Dealer MarineMax Confirms Data Breach appeared first on SecurityWeek. This article has been indexed…
Google agreed to purge billions of records containing personal information collected from more than 136 million people using its Chrome web browser as part of settlement in a lawsuit accusing it of illegal surveillance. The post Google to Purge Billions…
Veracode announces a deal to acquire Longbow Security, a Texas seed-stage startup working on automated root cause analysis technology. The post Veracode Buys Longbow Security for Automated Root Cause Analysis Tech appeared first on SecurityWeek. This article has been indexed…
NCC Group researchers warn that the Android banking malware ‘Vultur’ has been updated with device interaction and file tampering capabilities. The post ‘Vultur’ Android Malware Gets Extensive Device Interaction Capabilities appeared first on SecurityWeek. This article has been indexed from…
A vulnerability in util-linux, a core utilities package in Linux systems, allows attackers to leak user passwords and modify the clipboard. The post ‘WallEscape’ Linux Vulnerability Leaks User Passwords appeared first on SecurityWeek. This article has been indexed from SecurityWeek…
Software developers relying on AI chatbots for building applications may end up using hallucinated software packages. The post AI Hallucinated Packages Fool Unsuspecting Developers appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read the original…
Urgent security alerts issued as malicious code was found embedded in the XZ Utils data compression library used in many Linux distributions. The post Supply Chain Attack: Major Linux Distributions Impacted by XZ Utils Backdoor appeared first on SecurityWeek. This…
AT&T used the Easter holiday weekend to quietly share details on data that surfaced on the dark web roughly two weeks ago. The post AT&T Says Data on 73 Million Customers Leaked on Dark Web appeared first on SecurityWeek. This…
Noteworthy stories that might have slipped under the radar: US government conducting airline privacy review, SEC’s overreaching SolarWinds hack probe, MFA bombing of Apple users. The post In Other News: Airline Privacy Review, SEC’s SolarWinds Hack Probe, Apple MFA Bombing…
Generative-AI security startup SydeLabs emerges from stealth mode with $2.5 million in seed funding led by RTP Global. The post SydeLabs Emerges From Stealth Mode With $2.5 Million in Funding appeared first on SecurityWeek. This article has been indexed from…
US Defense Department releases defense industrial base cybersecurity strategy with a focus on four key goals. The post Pentagon Outlines Cybersecurity Strategy for Defense Industrial Base appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read…
The US Department of Energy announces $15 million funding for university-based electric power cybersecurity centers. The post Energy Department Invests $15 Million in University Cybersecurity Centers appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read…
It is the CISO’s responsibility to build and maintain a high functioning team in a difficult environment – cybersecurity is a complex, continuous, and adversarial environment like none other outside of military conflict. The post The Complexity and Need to…
JetBrains patches 26 security issues in TeamCity and takes steps to avoid malicious exploitation of vulnerabilities. The post 26 Security Issues Patched in TeamCity appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read the original…
Harvard Pilgrim Health Care says the personal information of over 2.8 million individuals was stolen in a year-old ransomware attack. The post Massachusetts Health Insurer Data Breach Impacts 2.8 Million appeared first on SecurityWeek. This article has been indexed from…
Maintainers of the Python Package Index (PyPI) repository were forced to suspend new project creation and new user registration to mitigate a malware upload campaign. The post Malware Upload Attack Hits PyPI Repository appeared first on SecurityWeek. This article has…
Splunk patches high-severity vulnerabilities in Enterprise, including an authentication token exposure issue. The post Splunk Patches Vulnerabilities in Enterprise Product appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read the original article: Splunk Patches Vulnerabilities…
Threat intelligence firm EclecticIQ documents the delivery of malware phishing lures to government and private energy organizations in India. The post Cyberespionage Campaign Targets Government, Energy Entities in India appeared first on SecurityWeek. This article has been indexed from SecurityWeek…
A significant cybersecurity challenge arises from managing the immense volume of data generated by numerous IT security tools, leading organizations into a reactive rather than proactive approach. The post Cybersecurity Mesh: Overcoming Data Security Overload appeared first on SecurityWeek. This…
Coro has raised $100 million in Series D funding for its enterprise-grade platform tailored for the small- and mid-sized market. The post Coro Raises $100 Million for All-in-One Security Platform appeared first on SecurityWeek. This article has been indexed from…
Zafran has emerged from stealth mode with a risk and mitigation platform and $30 million in funding from Sequoia Capital and Cyberstarts. The post Zafran Emerges From Stealth With Risk and Mitigation Platform, $30M in Funding appeared first on SecurityWeek.…
Cisco has released patches for multiple IOS and IOS XE software vulnerabilities leading to denial-of-service (DoS). The post Cisco Patches DoS Vulnerabilities in Networking Products appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read the…
In just the first two months of 2024, threat intelligence firm Flashpoint has logged dramatic increases in all major threat indicators. The post Threat Indicators Show 2024 Is Already Promising to be Worse Than 2023 appeared first on SecurityWeek. This…
Two Chinese cyberespionage groups have been targeting entities and member countries affiliated with ASEAN. The post Chinese Cyberspies Targeting ASEAN Entities appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read the original article: Chinese Cyberspies…
The US is offering a reward of up to $10 million for information on BlackCat ransomware affiliates that targeted US critical infrastructure. The post US Offering $10 Million Reward for Information on Change Healthcare Hackers appeared first on SecurityWeek. This…
In just the first two months of 2024, threat intelligence firm Flashpoint has logged dramatic increases in all major threat indicators. The post Threat Indicators Show 2024 is Already Promising to be Worse Than 2023 appeared first on SecurityWeek. This…
CISA is seeking comment on the implementation of CIRCIA, which will cost $2.6 billion and will impact 316,000 entities. The post CISA Moving Forward With Cyber Incident Reporting Rules Impacting 316,000 Entities appeared first on SecurityWeek. This article has been…
Although the attack on the national library of the UK occurred five months ago, the Library’s infrastructure won’t be rebuilt until mid-April 2024, and then the full restoration of systems and data can begin. The post Details and Lessons Learned…
Artificial intelligence computing giant NVIDIA patches flaws in ChatRTX for Windows and warns of code execution and data tampering risks. The post Code Execution Flaws Haunt NVIDIA ChatRTX for Windows appeared first on SecurityWeek. This article has been indexed from…
Human Security identifies 28 VPN applications for Android and an SDK that turn devices into proxies. The post VPN Apps on Google Play Turn Android Devices Into Proxies appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS…
Despite a surge in zero-day attacks, data shows that security investments into OS and software exploit mitigations are forcing attackers to find new attack surfaces and bug patterns. The post Google Report: Despite Surge in Zero-Day Attacks, Exploit Mitigations Are…
Google ships a security-themed Chrome browser refresh to fix flaws exploited at the CanSecWest Pwn2Own hacking contest. The post Chrome Update Patches Zero-Day Vulnerabilities Exploited at Pwn2Own appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed…
In the past week Rockwell Automation addressed 10 vulnerabilities found in its FactoryTalk, PowerFlex and Arena Simulation products. The post Organizations Informed of 10 Vulnerabilities in Rockwell Automation Products appeared first on SecurityWeek. This article has been indexed from SecurityWeek…
Disputed Ray AI framework vulnerability exploited to steal information and deploy cryptominers on hundreds of clusters. The post Ray AI Framework Vulnerability Exploited to Hack Hundreds of Clusters appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS…
CISA says a second SharePoint vulnerability demonstrated last year at Pwn2Own, CVE-2023-24955, has been exploited in the wild. The post CISA: Second SharePoint Flaw Disclosed at Pwn2Own Exploited in Attacks appeared first on SecurityWeek. This article has been indexed from…
Los Angeles firmware and software supply chain firm banks $10.5 million in seed-stage funding led by Two Bear Capital. The post Binarly Attracts $10.5M to Tackle Software Supply Chain Security appeared first on SecurityWeek. This article has been indexed from…
Malware hunters sound an alarm after discovering a 40,000-strong botnet packed with end-of-life routers and IoT devices being used in cybercriminal activities. The post Researchers Discover 40,000-Strong EOL Router, IoT Botnet appeared first on SecurityWeek. This article has been indexed…
Please the fireside chat as Phil Bues, Cloud Research Manager at IDC, discusses the challenges and best practices for cybersecurity leaders managing cloud identities. The post Webinar Today: How to Reduce Cloud Identity Risk appeared first on SecurityWeek. This article…
UK Judges said the U.S. must guarantee that Assange, who is Australian, “is afforded the same First Amendment protections as a United States citizen, and that the death penalty is not imposed.” The post UK Court Says Assange Can’t be…
Airbus Defence and Space is set to acquire Infodas, a Germany-based company that boasts €50 million revenue. The post Airbus to Buy German Cybersecurity Firm Infodas appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read…
Startup says simple awareness training is not sufficient – users need to practice ‘good’ behavior beyond simply acknowledging poor behavior and bad intent. The post UK Firm Think Cyber Raises $3.8 Million for Staff Security Nudging appeared first on SecurityWeek.…
Silicon Valley startup deposits $10 million in seed-stage funding to help organizations manage risk from cloud and gen-AI technologies. The post Greylock Makes $10M Bet on Bedrock Security appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS…
A new Rowhammer attack named ZenHammer has been demonstrated against DRAM on systems with AMD CPUs, including DDR5. The post ZenHammer Attack Targets DRAM on Systems With AMD CPUs appeared first on SecurityWeek. This article has been indexed from SecurityWeek…
A suspicious NuGet package likely targets developers working with technology from Chinese firm Bozhon. The post Suspicious NuGet Package Harvesting Information From Industrial Systems appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed Read the original…
Apple has released iOS 17.4.1 and macOS Sonoma 14.4.1 with patches for an arbitrary code execution vulnerability. The post Apple Patches Code Execution Vulnerability in iOS, macOS appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed…
CISA and the FBI issue a secure-by-design alert on eliminating SQL injection vulnerabilities from software. The post US Government Urges Software Makers to Eliminate SQL Injection Vulnerabilities appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed…
Australia and New Zealand support the UK in condemning Chinese hackers for targeting UK institutions and parliamentarians. The post UK, New Zealand Accuse China of Cyberattacks on Government Entities appeared first on SecurityWeek. This article has been indexed from SecurityWeek…
CVE-2023-48788, a critical SQL injection vulnerability in Fortinet’s FortiClient EMS product, is being exploited in the wild. The post Recent Fortinet FortiClient EMS Vulnerability Exploited in Attacks appeared first on SecurityWeek. This article has been indexed from SecurityWeek RSS Feed…
The OODA Loop can be used both by defenders and incident responders for a variety of use cases such as threat assessment, threat monitoring, and threat hunting. The post The OODA Loop: The Military Model That Speeds Up Cybersecurity Response…
Leen Security, a new startup building technology to help reduce chaos in the data security space, has banked a $2.8 million pre-seed funding. The post Leen Banks Early Stage Funding for Data Security Technology appeared first on SecurityWeek. This article…