Don’t miss

2,000 Palo Alto Networks devices compromised in latest attacks

CVE, Don't miss, enterprise, firewall, Hot stuff, India, News, Palo Alto Networks, Shadowserver, USA /

2,000 Palo Alto Networks devices compromised in latest attacks 2024-11-21 at 13:27 By Zeljka Zorz Attackers have compromised around 2,000 Palo Alto Networks firewalls by leveraging the two recently patched zero-days (CVE-2024-0012 and CVE-2024-9474), Shadowserver Foundation’s internet-wide scanning has revealed. Compromised devices are predominantly located in the US and India, the nonprofit says. Manual and […]

2,000 Palo Alto Networks devices compromised in latest attacks Read More »

Researchers unearth two previously unknown Linux backdoors

APT, backdoor, cybersecurity, Don't miss, ESET, Hot stuff, Linux, Malware, News, threat, VirusTotal /

Researchers unearth two previously unknown Linux backdoors 2024-11-21 at 12:12 By Help Net Security ESET researchers have identified multiple samples of two previously unknown Linux backdoors: WolfsBane and FireWood. The goal of the backdoors and tools discovered is cyberespionage that targets sensitive data such as system information, user credentials, and specific files and directories. These […]

Researchers unearth two previously unknown Linux backdoors Read More »

AxoSyslog: Open-source scalable security data processor

cybersecurity, Don't miss, GitHub, News, open source, software /

AxoSyslog: Open-source scalable security data processor 2024-11-21 at 08:52 By Mirko Zorz AxoSyslog is a syslog-ng fork, created and maintained by the original creator of syslog-ng, Balazs Scheidler, and his team. “We first started by making syslog-ng more cloud-ready: we packaged syslog-ng in a container, added helm charts, and made it more suitable for use […]

AxoSyslog: Open-source scalable security data processor Read More »

Product showcase: Augmenting penetration testing with Plainsea

cybersecurity, Don't miss, Hot stuff, News, penetration testing, Plainsea, Product showcase /

Product showcase: Augmenting penetration testing with Plainsea 2024-11-21 at 08:03 By Help Net Security Human-led penetration testing is an essential practice for any organization seeking to proactively address potential attack vectors. However, this indispensable pentesting method is often limited by several factors: high resource demands, project time constraints, dispersed communication, and lack of continuous visibility […]

Product showcase: Augmenting penetration testing with Plainsea Read More »

CWE top 25 most dangerous software weaknesses

CVE, cybersecurity, Don't miss, Hot stuff, News, vulnerability /

CWE top 25 most dangerous software weaknesses 2024-11-21 at 07:33 By Help Net Security The CWE list of the 25 most dangerous software weaknesses demonstrates the currently most common and impactful software flaws. Identifying the root causes of these vulnerabilities provides insights to shape investments, policies, and practices that proactively prevent their occurrence. The CWE […]

CWE top 25 most dangerous software weaknesses Read More »

Enhancing visibility for better security in multi-cloud and hybrid environments

cloud security, Compliance, cybersecurity, data loss prevention, Don't miss, Features, Hot stuff, News, opinion, RAD Security, standards, strategy, threats /

Enhancing visibility for better security in multi-cloud and hybrid environments 2024-11-21 at 07:03 By Mirko Zorz In this Help Net Security interview, Brooke Motta, CEO of RAD Security, talks about how cloud-specific threats have evolved and what companies should be watching out for. She discusses the growing complexity of cloud environments and the importance of […]

Enhancing visibility for better security in multi-cloud and hybrid environments Read More »

Preventing credential theft in the age of AI

Artificial Intelligence, authentication, Badge, biometrics, cybersecurity, Don't miss, Hot stuff, Privacy, Video /

Preventing credential theft in the age of AI 2024-11-21 at 06:34 By Help Net Security In this Help Net Security video, Tina Srivastava, MIT Lecturer and CEO of Badge, discusses a 20-year cryptography problem – using biometrics for authentication without storing a face/finger/voice print. This has massive implications for corporate and personal security/privacy because there […]

Preventing credential theft in the age of AI Read More »

GitHub Secure Open Source Fund: Project maintainers, apply now!

Don't miss, education, GitHub, Hot stuff, News, open source, software development /

GitHub Secure Open Source Fund: Project maintainers, apply now! 2024-11-20 at 15:42 By Zeljka Zorz GitHub is calling on maintainers of open source projects to apply for the newly opened Secure Open Source Fund, to get funding and knowledge to improve the security and sustainability of their software. The program is funded by companies (AmEx […]

GitHub Secure Open Source Fund: Project maintainers, apply now! Read More »

Apple fixes 2 zero-days exploited to breach macOS systems (CVE-2024-44309, CVE-2024-44308)

0-day, apple, Don't miss, Google, Hot stuff, iOS, iPad, macOS, News /

Apple fixes 2 zero-days exploited to breach macOS systems (CVE-2024-44309, CVE-2024-44308) 2024-11-20 at 12:50 By Zeljka Zorz Apple has released emergency security updates for macOS Sequoia that fix two zero-day vulnerabilities (CVE-2024-44309, CVE-2024-44308) that “may have been actively exploited on Intel-based Mac systems”. About CVE-2024-44309 and CVE-2024-44308 CVE-2024-44309 affects WebKit, the browser engine used in […]

Apple fixes 2 zero-days exploited to breach macOS systems (CVE-2024-44309, CVE-2024-44308) Read More »

Five backup lessons learned from the UnitedHealth ransomware attack

backup, Continuity, cybersecurity, Don't miss, Expert analysis, Expert corner, Hot stuff, News, opinion, strategy, tips /

Five backup lessons learned from the UnitedHealth ransomware attack 2024-11-20 at 08:19 By Help Net Security The ransomware attack on UnitedHealth earlier this year is quickly becoming the healthcare industry’s version of Colonial Pipeline, prompting congressional testimony, lawmaker scrutiny and potential legislation.  Over the past few months, there have been two congressional hearings on the attack […]

Five backup lessons learned from the UnitedHealth ransomware attack Read More »

Debunking myths about open-source security

Artificial Intelligence, Canonical, CISO, cybersecurity, Don't miss, Features, Hot stuff, News, open source, opinion /

Debunking myths about open-source security 2024-11-20 at 07:31 By Mirko Zorz In this Help Net Security interview, Stephanie Domas, CISO at Canonical, discusses common misconceptions about open-source security and how the community can work to dispel them. She explains how open-source solutions, contrary to myths, offer enterprise-grade maturity, reliability, and transparency. Domas also shares key […]

Debunking myths about open-source security Read More »

Safeguarding the DNS through registries

cybersecurity, DNS, Don't miss, Hot stuff, Identity Digital, Video /

Safeguarding the DNS through registries 2024-11-20 at 07:16 By Help Net Security The integrity of our online ecosystem heavily relies on domain registries, which serve as the foundation for secure and trusted digital experiences. However, threats like Domain Name System (DNS) abuse– manifesting as phishing, malware, and botnets – jeopardize this security. Such abuses harm […]

Safeguarding the DNS through registries Read More »

Microsoft announces Zero Day Quest hacking event with big rewards

bug bounty, bug hunting, Don't miss, Microsoft, News /

Microsoft announces Zero Day Quest hacking event with big rewards 2024-11-19 at 21:19 By Mirko Zorz Microsoft is enhancing its bug bounty initiatives with the launch of the Zero Day Quest hacking event. With $4 million in potential rewards, it focuses on driving research in critical areas such as cloud computing and AI. Event focus […]

Microsoft announces Zero Day Quest hacking event with big rewards Read More »

Microsoft announces new and improved Windows 11 security features

Application Security, Data Protection, Don't miss, Hot stuff, Microsoft, News, privileged accounts, Windows /

Microsoft announces new and improved Windows 11 security features 2024-11-19 at 21:04 By Zeljka Zorz Microsoft has implemented some and is working on delivering several other security-related features and improvements for Windows 11. Administrator protection will allow users to make system changes on their PCs without having administrator rights (that can be abused by attackers […]

Microsoft announces new and improved Windows 11 security features Read More »

Microsoft plans to boot security vendors out of the Windows kernel

antivirus, cyber resilience, Don't miss, Hot stuff, News, security testing, Windows /

Microsoft plans to boot security vendors out of the Windows kernel 2024-11-19 at 20:48 By Zeljka Zorz Microsoft has announced the Windows Resiliency Initiative, aimed at avoiding a repeat of the prolonged worldwide IT outage caused by a buggy CrowdStrike update that took down millions of Windows machines and rendered them remotely unfixable. As part […]

Microsoft plans to boot security vendors out of the Windows kernel Read More »

Cross-IdP impersonation bypasses SSO protections

Don't miss, identity, News, Push Security, SaaS, SSO /

Cross-IdP impersonation bypasses SSO protections 2024-11-19 at 18:22 By Help Net Security Cross-IdP impersonation – a technique that enables attackers to hijack the single sign-on (SSO) process to gain unauthorized access to downstream software-as-a-service (SaaS) applications without compromising a company’s primary identity provider (IdP) – is expected to gain popularity with attackers, according to Push […]

Cross-IdP impersonation bypasses SSO protections Read More »

Oracle patches exploited Agile PLM vulnerability (CVE-2024-21287)

CrowdStrike, Don't miss, enterprise, Hot stuff, News, Oracle, product development, Tenable /

Oracle patches exploited Agile PLM vulnerability (CVE-2024-21287) 2024-11-19 at 12:48 By Zeljka Zorz Oracle has released a security patch for CVE-2024-21287, a remotely exploitable vulnerability in the Oracle Agile PLM Framework that is, according to Tenable researchers, being actively exploited by attackers. About CVE-2024-21287 Oracle Agile PLM Framework is an enterprise product lifecycle management solution […]

Oracle patches exploited Agile PLM vulnerability (CVE-2024-21287) Read More »

Dev + Sec: A collaborative approach to cybersecurity

collaboration, cybersecurity, Don't miss, Expert analysis, Expert corner, Hot stuff, News, opinion, YL Ventures /

Dev + Sec: A collaborative approach to cybersecurity 2024-11-19 at 07:31 By Help Net Security The age-old tension between development and security teams has long been a source of friction in organizations. Developers prioritize speed and efficiency, aiming to deliver features and products quickly with a fast-paced, iterative development cycle and move on efficiently. On […]

Dev + Sec: A collaborative approach to cybersecurity Read More »

Why AI alone can’t protect you from sophisticated email threats

Artificial Intelligence, Barracuda Networks, CISO, cybersecurity, Don't miss, email security, Features, Hot stuff, News, opinion, social engineering /

Why AI alone can’t protect you from sophisticated email threats 2024-11-19 at 07:03 By Mirko Zorz In this Help Net Security interview, Riaz Lakhani, CISO at Barracuda Networks, discusses the effectiveness of AI-based behavioural analysis in combating sophisticated email threats like BEC and VEC. Lakhani also explains how AI tools help detect malicious email activity […]

Why AI alone can’t protect you from sophisticated email threats Read More »

Open-source and free Android password managers that prioritize your privacy

authentication, cybersecurity, Don't miss, GitHub, News, open source, password manager, passwords, software /

Open-source and free Android password managers that prioritize your privacy 2024-11-19 at 06:47 By Anamarija Pogorelec We’re often told to use strong, unique passwords, especially for important accounts like email, banking, and social media. However, managing different passwords for numerous accounts can be challenging. Password managers simplify this by securely storing all your passwords so […]

Open-source and free Android password managers that prioritize your privacy Read More »

Scroll to Top