Bleeping Computer
Constant training is key to staying current on the changing world of cybersecurity. This instant cybersecurity training library lets you fit in the training you need for $24.97, $95 off the $120 MSRP now through the end of May 22th.
The Cyber Express
During a recent Senate committee hearing, Director of National Intelligence Avril Haines emphasized state hackers' continued prominence as a threat,
Infosecurity News
UK organizations are less likely than their European peers to have known exploited bugs but take longer to fix them
Bleeping Computer
Financially motivated cybercriminals abuse the Windows Quick Assist feature in social engineering attacks to deploy Black Basta ransomware payloads on victims' networks.
SecurityWeek
Several ICS vendors have released advisories on Tuesday to inform customers about vulnerabilities found in their products.
The Cyber Express
CISA, in collaboration with DHS, FBI, and international cybersecurity entities, has revealed a comprehensive guide aimed at bolstering cybersecurity for
The Hacker News
Microsoft has patched 61 new security flaws, including two zero-days actively exploited in the wild.
CSO
CISA advisory includes indicators of compromise and TTPs that can be used for threat hunting.
The Record
“We've got to do a better job of making sure Americans of all political stripes understand what is very probably coming their way over the next less than six months,” Senate Intelligence Chair Mark Warner told leaders from ODNI, CISA and the FBI.
Infosecurity News
The guide is designed to provide high-risk communities with actionable steps to bolster their cybersecurity defenses
Infosecurity News
Several software security experts have told Infosecurity that no new vulnerabilities have been added to the US NVD since May 9
Infosecurity News
GCHQ chief warns China's cyber actions threaten global internet security, while Russia and Iran pose immediate risks
CyberSecurity Dive
Overall, the nonprofit K12 Security Information Exchange backed the requirement for schools, but it asked for clarification on how the sector should report cyber incidents students initiate.
The Record
State-linked hackers from Russia, China, Iran and North Korea are setting their sights set their sights on NGOs, think tanks, human rights activists and journalists, the advisory warned.
The Record
Rep. Zach Nunn arrived in Congress with arguably more cyber experience than any other new member in history. Can he fill the shoes of Rep. Mike Gallagher, the party's longtime House leader on cybersecurity issues?
Bleeping Computer
A new package mimicked the popular 'requests' library on the Python Package Index (PyPI) to target macOS devices with the Sliver C2 adversary framework, used for gaining initial access to corporate networks.
DarkReading
Ransomware groups have always created problems for their victims that only they could solve. Black Basta is taking that core idea in a creative, new direction.
SecurityWeek
Weakening liberal democracies and weakening the NATO alliance are conjoined in the hybrid war that Russia is conducting against Ukraine.
Infosecurity News
A ransomware attack on US private healthcare provider Ascension has disrupted patient care, with several hospitals currently on diversion
SecurityWeek
A critical vulnerability in the Cinterion cellular modems can be exploited for remote code execution via SMS messages.
CyberSecurity Dive
The threat group has impacted more than 500 targets worldwide and the vast majority of critical infrastructure sectors. Numerous attacks have exploited vulnerabilities in ConnectWise ScreenConnect.
SecurityWeek
The US government warns of Black Basta ransomware attacks targeting critical infrastructure organizations.
Infosecurity News
Affiliates of prolific Black Basta ransomware group have breached over 500 global organizations
The Hacker News
Black Basta ransomware-as-a-service (RaaS) operation has targeted over 500 private industry and critical infrastructure entities in North America, Eur
Cyber Security News
Black Basta ransomware is used by threat actors because of its powerful abilities and inconspicuous moves.
.webp)
Cyber Security News
Ascension is one of the most extensive charity healthcare systems in the US. It has been hit hard by a ransomware attack.
SC Magazine
Black Basta, the gang reportedly responsible for the attack against the large health system, is described as prolific and sophisticated by federal agencies.
Bleeping Computer
Ethical hacking helps you find issues and repair them before they become a threat. This 12-course cybersecurity training bundle shows you how for $45.99, $326 off the $372 MSRP.
.png)
Cyber Security News
Staying informed is the key in this dynamic battle of cybersecurity, and due to this, the weekly news recap provides you with the newest trends, weaknesses, infringements found, and some possible defense mechanisms.
Security Affairs
Black Basta ransomware affiliates have breached over 500 organizations between April 2022 and May 2024, FBI and CISA reported.
Bleeping Computer
CISA and the FBI said today that Black Basta ransomware affiliates breached over 500 organizations between April 2022 and May 2024.
CSO
CISA’s pledge drew some big names, but the impact on software security could be limited. Meanwhile the org has extended its comment period on the CIRCIA cyberattack reporting law.
DarkReading
CISA's agreement is voluntary and, frankly, basic. Signatories say that's a good thing.
CyberSecurity Dive
Federal officials are taking steps toward a long-stated goal of shifting the security burden from technology users to the companies that build it.
Cyber Security News
Security researchers have uncovered a new technique called "TunnelVision" that exposes a fundamental flaw in routing-based Virtual Private Networks (VPNs),
CyberSecurity Dive
CISA Director Jen Easterly pointed to Microsoft’s decision to link security to executive compensation as a meaningful signal of its priorities.
The Cyber Express
Lenovo takes a bold step towards fortifying cybersecurity by joining the Secure by Design pledge, initiated by the US Cybersecurity
DarkReading
New regulations require companies to turn over incident data to CISA within 3 days or face enforcement. Here's how the agency spins this as a good thing.
The Record
The FBI, CISA and Department of Health and Human Services (HHS) alerted healthcare organizations to the group's activities. A separate report said Black Basta was behind the attack on Ascension healthcare system.
The Record
Okta Chief Security Officer David Bradbury discusses lessons from the incident, how nation-state threats are evolving, and how AI is already influencing identity-based attacks.
Bleeping Computer
Citrix notified customers this week to manually mitigate a PuTTY SSH client vulnerability that could allow attackers to steal a XenCenter admin's private SSH key.
Cyber Security News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has announced a new initiative called "Vulnrichment" aimed at enriching Common Vulnerabilities and Exposures (CVE) records with additional metadata to help organizations better prioritize vulnerability remediation efforts.
The Cyber Express
Boeing confirmed that the LockBit ransomware gang attack in October 2023, which impacted certain parts and distribution operations of the
SecurityWeek
CISA’s Vulnrichment project is adding important information to CVE records to help improve vulnerability management processes.
CyberSecurity Dive
CISA said companies ranging from Microsoft to Palo Alto Networks signed the voluntary pledge in an effort to boost resiliency and increase transparency around CVEs and cyberattacks.
.webp)
Cyber Security News
The FBI has issued a warning about a sophisticated phishing and smishing campaign orchestrated by a cybercriminal group known as STORM-0539,.
CyberSecurity Dive
Federal officials rarely criticize tech companies when their mistakes result in attacks. The stinging conclusions CSRB levied at Microsoft are an exception, not the norm.
The Record
CISA Director Jen Easterly said the voluntary pledge by software companies is important because of widespread nation-state hacking campaigns, including the Volt Typhoon operation attributed to China.
The Record
The wide-ranging hacking campaign by the state-backed group Volt Typhoon is seen as a prelude of what's to come.
Bleeping Computer
The University System of Georgia (USG) is sending data breach notifications to 800,000 individuals whose data was exposed in the 2023 Clop MOVEit attacks.
Infosecurity News
Experts at the RSA Conference discussed how governments, the open-source community and end users can work together to drastically improve the security of open-source software
Bleeping Computer
F5 has fixed two high-severity BIG-IP Next Central Manager vulnerabilities, which can be exploited to gain admin control and create rogue accounts on any managed assets.
Infosecurity News
CISA launched a new software vulnerability enrichment program to fill the gap left by NIST’s National Vulnerability Database backlog
Security Affairs
TunnelVision is a new VPN bypass technique that enables threat actors to spy on users’ traffic bypassing the VPN encapsulation.
SecurityWeek
A new technique named TunnelVision allows attackers to bypass the VPN and redirect traffic through the local network.
The Cyber Express
A new UPS management vulnerability in CyberPower Uninterrupted Power Supply (UPS) management software has been uncovered, revealing multiple flaws that have
SecurityWeek
University System of Georgia says Social Security numbers and bank account numbers were compromised in the May 2023 MOVEit hack.
CyberNews
The Federal Bureau of Investigation (FBI) has warned of heightened cybercriminal activity against employees at US retail corporate offices.
CyberNews
The University System of Georgia, a US government agency, has suffered a data incident via the infamous MOVEit Transfer hack.
CSO
The attack compromised some healthcare data with no material or financial losses, the company said.
The Record
Industry asked for an extension of the comment period for a key rule on cybersecurity incident reporting, and "in the interest of supporting the community out there, we decided to give them an extra 30 days,” said Brandon Wales, CISA’s executive director, at the 2024 RSA Conference.
The Record
The campaign by Chinese hackers to target U.S. critical infrastructure is intended to “cause disruption and sow societal panic,” a senior cybersecurity official said Tuesday.
SC Magazine
AI and “secure by design” will be crucial to defend against ransomware, CI attacks and AI threats in the coming years.
Infosecurity News
US government officials discussed plans on how to incentivize security by design principles in the software manufacturing process during RSA
DarkReading
Vulnerabilities added to the CISA known exploited vulnerability (KEV) list do indeed get patched faster, but not fast enough.
Bleeping Computer
A new attack dubbed "TunnelVision" can route traffic outside a VPN's encryption tunnel, allowing attackers to snoop on unencrypted traffic while maintaining the appearance of a secure VPN connection.
CyberSecurity Dive
Espionage groups linked to China are heavily exploiting zero days, focusing on devices that lack endpoint detection and response capabilities, one expert said.
SecurityWeek
As cyber threats grow more sophisticated, America can't afford complacency. The time for decisive action and enhanced cyber resilience is now.
CyberSecurity Dive
The software defects are linked to recent exploitation campaigns against critical infrastructure providers, including healthcare and schools.
SecurityWeek
MITRE has shared more details on the recent hack, including the new malware and a timeline of the attacker’s activities.
DarkReading
The flaw was nearly identical to last year's CitrixBleed flaw, but not as severe.
SecurityWeek
CyberNut has emerged from stealth mode with a K-12-focused security awareness training solution and $800k in pre-seed funding.
The Cyber Express
The RSA conference 2024 , the world's largest cybersecurity gathering, commenced in San Francisco from May 6 to 9, 2024.
SC Magazine
RSA Conference will tackle everything AI, but will also go deep on government policy, innovative new security solutions and explore "The Art of Possible."
.png)
Cyber Security News
The weekly news summary keeps you up to date with what’s happening in cybersecurity, including developments, vulnerabilities, breaches, threats, and defensive strategies. Knowing about new cyber risks and attack vectors helps you put up safeguards and preventive measures as soon as possible to protect your systems. Remaining constantly aware gives you a holistic view of […]
DarkReading
Patch now: Cyberattackers are exploiting CVE-2023-7028 (CVSS 10) to take over and lock users out of GitLab accounts, steal source code, and more.
SecurityWeek
CISA and the FBI warn of threat actors abusing path traversal software vulnerabilities in attacks targeting critical infrastructure.
SecurityWeek
The White House has published a national security memorandum focusing on critical infrastructure security and resilience.
Cyber Security News
The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have issued a joint Secure by Design Alert, calling on software developers and industry executives to intensify their efforts in eliminating directory traversal vulnerabilities within their products. This move comes in response to a series of high-profile cyber-attacks that have exploited […]
CSO
The advisory highlights how developers can follow best practices to fix these vulnerabilities during production.
CSO
The company has appointed new product security chiefs as well as a customer-facing CISO as it continues to respond to high-profile attacks on its products and own network.
Security Affairs
Government agencies from the US, Canada and the UK warn of Russian threat actors targeting critical infrastructure in North America and Europe
Bleeping Computer
CISA and the FBI urged software companies today to review their products and eliminate path traversal security vulnerabilities before shipping.
Ars Technica
The threat is potentially grave because it could be used in supply chain attacks.
Cyber Security News
Washington, D.C., May 1, 2024 – The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert concerning a newly
Security Affairs
Threat actors breached the Dropbox Sign production environment and accessed customer email addresses and hashed passwords
CyberNews
Independent and ideologically motivated pro-Russian hacktivists can physically threaten insecure and misconfigured operational technology devices.
SecurityWeek
CISA says a critical GitLab password reset flaw is being exploited in attacks and roughly 1,400 servers have not been patched.
SecurityWeek
Government agencies are sharing recommendations following attacks claimed by pro-Russian hacktivists on ICS/OT systems.
Security Affairs
CISA adds GitLab Community and Enterprise Editions improper access control vulnerability to its Known Exploited Vulnerabilities catalog.
Infosecurity News
The US and its allies claim Russian hacktivists are disruptive operations in water, energy, food and agriculture sectors
The Cyber Express
The CL0P ransomware group has listed 3 additional victims on its leak site. The mentioned victims include: McKinley Packing, Pilot
The Hacker News
A critical flaw (CVE-2023-7028) is being actively exploited, allowing account takeover by sending password reset emails to unverified addresses.
The Record
Researchers at Bitsight asked whether organizations remediate software and hardware vulnerabilities faster if they're on the federal government's list. The resulting data added up to a resounding "yes."
SC Magazine
Government agencies warn industry to improve their operational technology security following breaches of North American and European systems.
The Record
Researchers at Fortinet are calling the botnet Goldoon. D-Link released a patch in 2015 for the bug that it exploits, but some device owners didn't install it.
The Record
Anne Neuberger, deputy national security adviser for cyber, talks with the Click Here podcast team about the big picture for mitigating cybersecurity risk in the U.S., the growing cyberthreat from China, the government's relationship with Microsoft and the White House’s latest cyber initiatives.
SC Magazine
More than 2,100 servers may still be vulnerable to GitLab password reset exploits.
Bleeping Computer
The US government is warning that pro-Russian hacktivists are seeking out and hacking into unsecured operational technology (OT) systems used to disrupt critical infrastructure operations.
CSO
Tools, platforms, and services that the CSO team recommends 2024 RSA Conference attendees check out.
Loading more articles....