CISA and the FBI have released an alert on XSS vulnerabilities, urging organizations to adopt a secure by design approach and eliminate them.
The post CISA, FBI Urge Organizations to Eliminate XSS Vulnerabilities appeared first on SecurityWeek.
Chrome 129 Patches High-Severity Vulnerability in V8 Engine
Google has released Chrome 129 with patches for nine vulnerabilities, including a high-severity bug in the V8 engine.
The post Chrome 129 Patches High-Severity Vulnerability in V8 Engine appeared first on SecurityWeek.
Why Pay A Pentester?
The evolution of software always catches us by surprise. I remember betting against the IBM computer Deep Blue during its chess match against the grandmaster Garry Kasparov in 1997, only to be stunned when the machine claimed victory. Fast forward to today, would we have imagined just three years ago that a chatbot could write essays, handle customer support calls, and even craft commercial
AT&T to Pay $13 Million in Settlement Over 2023 Data Breach
AT&T has agreed to pay $13 million in a settlement with the FCC over a 2023 data breach at a third-party vendor’s cloud environment.
The post AT&T to Pay $13 Million in Settlement Over 2023 Data Breach appeared first on SecurityWeek.
North Korean Hackers Target Energy and Aerospace Industries with New MISTPEN Malware
A North Korea-linked cyber-espionage group has been observed leveraging job-themed phishing lures to target prospective victims in energy and aerospace verticals and infect them with a previously undocumented backdoor dubbed MISTPEN.
The activity cluster is being tracked by Google-owned Mandiant under the moniker UNC2970, which it said overlaps with a threat group known as TEMP.Hermit, which is
The activity cluster is being tracked by Google-owned Mandiant under the moniker UNC2970, which it said overlaps with a threat group known as TEMP.Hermit, which is
Chrome Introduces One-Time Permissions and Enhanced Safety Check for Safer Browsing
Google has announced that it’s rolling out a new set of features to its Chrome browser that gives users more control over their data when surfing the internet and protects against online threats.
“With the newest version of Chrome, you can take advantage of our upgraded Safety Check, opt out of unwanted website notifications more easily and grant select permissions to a site for one time only,”
“With the newest version of Chrome, you can take advantage of our upgraded Safety Check, opt out of unwanted website notifications more easily and grant select permissions to a site for one time only,”
Russian Security Firm Doctor Web Hacked
Antimalware company Doctor Web was recently targeted in a cyberattack that prompted it to disconnect all resources from its networks.
The post Russian Security Firm Doctor Web Hacked appeared first on SecurityWeek.
GSMA Plans End-to-End Encryption for Cross-Platform RCS Messaging
The GSM Association, the governing body that oversees the development of the Rich Communications Services (RCS) protocol, on Tuesday, said it’s working towards implementing end-to-end encryption (E2EE) to secure messages sent between the Android and iOS ecosystems.
“The next major milestone is for the RCS Universal Profile to add important user protections such as interoperable end-to-end
“The next major milestone is for the RCS Universal Profile to add important user protections such as interoperable end-to-end
Patch Issued for Critical VMware vCenter Flaw Allowing Remote Code Execution
Broadcom on Tuesday released updates to address a critical security flaw impacting VMware vCenter Server that could pave the way for remote code execution.
The vulnerability, tracked as CVE-2024-38812 (CVSS score: 9.8), has been described as a heap-overflow vulnerability in the DCE/RPC protocol.
“A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a
The vulnerability, tracked as CVE-2024-38812 (CVSS score: 9.8), has been described as a heap-overflow vulnerability in the DCE/RPC protocol.
“A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a
Temu denies breach after hacker claims theft of 87 million data records
Temu denies it was hacked or suffered a data breach after a threat actor claimed to be selling a stolen database containing 87 million records of customer information. […]