Over 600,000 SOHO routers belonging to a single ISP and infected with the Chalubo trojan were rendered inoperable.

The post Mysterious Threat Actor Used Chalubo Malware to Brick 600,000 Routers appeared first on SecurityWeek.

CISA instructs federal agencies to mitigate CVE-2024-1086, a Linux kernel flaw leading to privilege escalation.

The post CISA Warns of Exploited Linux Kernel Vulnerability appeared first on SecurityWeek.

The ShinyHunters hacking group has claimed the theft of 560 million Ticketmaster users’ data on a fresh BreachForums portal.

The post Hackers Boast Ticketmaster Breach on Relaunched BreachForums appeared first on SecurityWeek.

Malicious campaign exploits high-severity XSS flaws in three WordPress plugins to backdoor websites.

The post Critical WordPress Plugin Flaws Exploited to Inject Malicious Scripts and Backdoors appeared first on SecurityWeek.

The TrickBot botnet and other malware droppers have been targeted by international law enforcement in Operation Endgame.

The post TrickBot and Other Malware Droppers Disrupted by Law Enforcement appeared first on SecurityWeek.

Okta raises the alarm on credential stuffing attacks targeting endpoints used for cross-origin authentication.

The post Okta Warns of Credential Stuffing Attacks Targeting Cross-Origin Authentication appeared first on SecurityWeek.

The Seattle Public Library is scrambling to bring systems online after shutting them down to contain a ransomware attack.

The post Ransomware Attack Disrupts Seattle Public Library Services appeared first on SecurityWeek.

San Francisco data privacy startup Transcend secures 40 million in a Series B funding round that brings the total raised to $90 million.

The post Transcend Raises $40 Million for Data Privacy Platform appeared first on SecurityWeek.

Vulnerabilities in the real-time IoT operating system Eclipse ThreadX before version 6.4 could lead to denial-of-service and code execution.

The post Vulnerabilities in Eclipse ThreadX Could Lead to Code Execution appeared first on SecurityWeek.

Microsoft dives into the tactics, techniques, and procedures of North Korean threat actor Moonstone Sleet.

The post New North Korean Threat Actor Engaging in Espionage, Revenue Generation Attacks appeared first on SecurityWeek.

First American will notify 44,000 individuals that their personal information may have been stolen in a December 2023 ransomware attack.

The post Personal Information of 44,000 Compromised in First American Cyberattack appeared first on SecurityWeek.

While reintegration of formerly incarcerated people into the workforce is important, the government should be cautious about what positions those with a criminal history are put into.

The post Congresswomen Advocate for Cybersecurity Jobs for Formerly Incarcerated appeared first on SecurityWeek.

ABN Amro discloses data breach after third-party services provider AddComm suffers a ransomware attack.

The post ABN Amro Client Data Possibly Stolen in AddComm Ransomware Attack appeared first on SecurityWeek.

A threat actor is asking $50,000 for data allegedly stolen from Australian digital prescription services provider MediSecure.

The post Data Stolen From MediSecure for Sale on Dark Web appeared first on SecurityWeek.

Pharmacy prescription services provider Sav-Rx says the personal information of 2.8 million was stolen in a cyberattack.

The post 2.8 Million Impacted by Data Breach at Prescription Services Firm Sav-Rx appeared first on SecurityWeek.

Backdoored JAVS courtroom recording and management software installer puts thousands at risk of complete takeover.

The post JAVS Courtroom Audio-Visual Software Installer Serves Backdoor appeared first on SecurityWeek.

Averson secures seed funding to build technology that uses AI to identify cloud security weaknesses and counter cyberattacks.

The post Averlon Emerges From Stealth Mode With $8 Million in Funding appeared first on SecurityWeek.

Exploited in the wild, Chrome vulnerability CVE-2024-5274 is a high-severity flaw described as a type confusion in the V8 JavaScript and WebAssembly engine.

The post Google Patches Fourth Chrome Zero-Day in Two Weeks appeared first on SecurityWeek.

Bolster has raised $14 million in Series B funding for technology integrations for its AI-powered phishing protection platform.

The post Bolster Raises $14 Million for AI-Powered Phishing Protection appeared first on SecurityWeek.

Unfading Sea Haze has been targeting military and government entities in South China Sea countries since 2018.

The post Newly Detected Chinese Group Targeting Military, Government Entities appeared first on SecurityWeek.

The personal information of 400,000 individuals was compromised in a data breach at El Centro Del Barrio (CentroMed).

The post 400,000 Impacted by CentroMed Data Breach appeared first on SecurityWeek.

ARPA-H has announced a $50 million investment in tools to help IT teams better secure hospital environments.

The post US to Invest $50 Million in Securing Hospitals Against Cyber Threats appeared first on SecurityWeek.

Veeam Backup Enterprise Manager update resolves multiple vulnerabilities, including a critical authentication bypass.

The post Critical Veeam Vulnerability Leads to Authentication Bypass appeared first on SecurityWeek.

Critical vulnerability in GitHub Enterprise Server allows unauthenticated attackers to obtain administrative privileges.

The post Critical Authentication Bypass Resolved in GitHub Enterprise Server appeared first on SecurityWeek.

Ivanti has released product updates to resolve multiple vulnerabilities, including critical code execution flaws in Endpoint Manager.

The post Ivanti Patches Critical Code Execution Vulnerabilities in Endpoint Manager appeared first on SecurityWeek.

Google released a Chrome 125 update to resolve four high-severity vulnerabilities reported by external researchers.

The post Chrome 125 Update Patches High-Severity Vulnerabilities appeared first on SecurityWeek.

QNAP rolls out patches for multiple vulnerabilities after proof-of-concept exploit published for a remote code execution vulnerability.

The post QNAP Rushes Patch for Code Execution Flaw in NAS Devices appeared first on SecurityWeek.

Semiconductor giant OmniVision Technologies says personal information was stolen in a September 2023 ransomware attack.

The post OmniVision Says Personal Information Stolen in Ransomware Attack appeared first on SecurityWeek.

CyberArk agreed to acquire machine identity management Venafi from Thoma Bravo for $1.54 billion.

The post CyberArk to Acquire Machine Identity Firm Venafi for $1.54 Billion appeared first on SecurityWeek.

Health insurance firm WebTPA says the personal information of 2.4 million individuals was compromised in a data breach.

The post 2.4 Million Impacted by WebTPA Data Breach appeared first on SecurityWeek.

MediSecure says data related to prescriptions distributed until November 2023 was compromised in a ransomware attack.

The post MediSecure Data Breach Impacts Patient and Healthcare Provider Information  appeared first on SecurityWeek.

CISA has added two vulnerabilities in discontinued D-Link products to its KEV catalog, including a decade-old flaw.

The post CISA Warns of Exploited Vulnerabilities in EOL D-Link Products appeared first on SecurityWeek.

The Antidot Android banking trojan snoops on users and steals their credentials, contacts, and SMS messages.

The post New ‘Antidot’ Android Trojan Allows Cybercriminals to Hack Devices, Steal Data appeared first on SecurityWeek.

The Black Basta group abuses remote connection tool Quick Assist in vishing attacks leading to ransomware deployment.

The post Microsoft Quick Assist Tool Abused for Ransomware Delivery appeared first on SecurityWeek.

C/side has emerged from stealth mode with $1.7 million in pre-seed funding from Scribble Ventures and angel investors

The post C/side Emerges From Stealth Mode With $1.7 Million Investment appeared first on SecurityWeek.

Network infrastructure as-a-service Alkira has raised $100 million in a Series C funding round led by Tiger Global Management.

The post Alkira Raises $100 Million for Secure Network Infrastructure Platform appeared first on SecurityWeek.

Google is boosting fraud and malware protections in Android 15 with live threat detection and expanded restricted settings.

The post Android 15 Brings Improved Fraud and Malware Protections appeared first on SecurityWeek.

The City of Wichita says files containing personal information were exfiltrated in a recent ransomware attack.

The post Personal Information Stolen in City of Wichita Ransomware Attack appeared first on SecurityWeek.

Google releases Chrome 125 to the stable channel with patches for nine vulnerabilities, including a zero-day.

The post Third Chrome Zero-Day Patched by Google Within One Week appeared first on SecurityWeek.

Russian-speaking threat actors are caught abusing a GitHub profile to distribute information stealers posing as legitimate software.

The post Threat Actors Abuse GitHub to Distribute Multiple Information Stealers appeared first on SecurityWeek.

The Ebury Linux botnet has ensnared over 400,000 Linux systems in 15 years, with roughly 100,000 still infected.

The post 400,000 Linux Servers Hit by Ebury Botnet  appeared first on SecurityWeek.

Singing River Health System says the personal information of roughly 900,000 individuals was stolen in an August 2023 ransomware attack.

The post 900k Impacted by Data Breach at Mississippi Healthcare Provider appeared first on SecurityWeek.

Apple and Google have rolled out a new mobile feature that warns users of unwanted trackers moving with them.

The post Unwanted Tracking Alerts Rolling Out to iOS, Android appeared first on SecurityWeek.

SAP has released 14 new and three updated security notes on its May 2024 Security Patch Day.

The post SAP Patches Critical Vulnerabilities in CX Commerce, NetWeaver appeared first on SecurityWeek.

Threat actors are using DNS tunneling to track victims’ interaction with spam and to scan network infrastructures.

The post Attackers Use DNS Tunneling to Track Victim Activity, Scan Networks appeared first on SecurityWeek.

The City of Helsinki says usernames, email addresses, and personal information was stolen in a recent cyberattack.

The post Student, Personnel Information Stolen in City of Helsinki Cyberattack appeared first on SecurityWeek.

The FCC has issued a public notice on robocall scammer group ‘Royal Tiger’, the first designated threat actor.

The post FCC Warns of ‘Royal Tiger’ Robocall Scammers appeared first on SecurityWeek.

A critical vulnerability in the Cinterion cellular modems can be exploited for remote code execution via SMS messages.

The post Cinterion Modem Flaws Pose Risk to Millions of Devices in Industrial, Other Sectors appeared first on SecurityWeek.

The US government warns of Black Basta ransomware attacks targeting critical infrastructure organizations.

The post Black Basta Ransomware Hit Over 500 Organizations appeared first on SecurityWeek.