News

Application security and coding requirements

• May 13, 2022 13 May'22

  Open source community sets out path to secure software

  A 10-point plan to improve the security and resilience of open source software was presented this week at a summit in the US

• May 11, 2022 11 May'22

  Emotet has commanding lead on Check Point monthly threat chart

  Emotet remains by some margin the most prevalent malware, according to Check Point’s latest monthly statistics

• May 11, 2022 11 May'22

  Microsoft fixes three zero-days on May Patch Tuesday

  It’s the second-to-last Patch Tuesday as we know it, and Microsoft has fixed a total of 75 bugs, including three zero-days

• May 04, 2022 04 May'22

  UK government puts pressure on IT sector to clean up app security

  Apps can be exploited to carry malicious payloads that steal personal information and cause financial loss – and not enough is being done to secure them

• May 03, 2022 03 May'22

  Five TLS comms vulnerabilities hit Aruba, Avaya switching kit

  Five new vulnerabilities in the implementation of transport layer security communications leave several popular switches vulnerable to remote code execution

• April 28, 2022 28 Apr'22

  Manufacturer sues JPMorgan after cyber criminals stole $272m

  Manufacturer files lawsuit alleging that US bank failed to inform it of suspicious transaction activity

• April 27, 2022 27 Apr'22

  Log4Shell, ProxyLogon, ProxyShell among most exploited bugs of 2021

  These 15 CVEs were the most commonly exploited last year, and if you haven’t mitigated against them, now is the time

• April 26, 2022 26 Apr'22

  Emotet tests new tricks to thwart enhanced security

  The operators of the Emotet botnet seem to be trying to find a way to get around recent changes made by Microsoft to better protect its users

• April 25, 2022 25 Apr'22

  Mimecast makes deeper push into ASEAN

  Mimecast opens regional office in Singapore and is looking at setting up a datacentre in Southeast Asia as it makes a deeper push into the region

• April 22, 2022 22 Apr'22

  How Adnovum is leveraging its Swiss roots

  Software company Adnovum is leveraging its strengths in identity and access management and its Swiss heritage as it expands into new markets and areas such as zero-trust security

• April 22, 2022 22 Apr'22

  UAE bolsters cyber security

  The United Arab Emirates has successfully improved its security posture amid mounting cyber threats

• April 21, 2022 21 Apr'22

  Zoom adds new round of cyber security enhancements

  Videoconferencing platform Zoom adds multiple third-party security certifications and service enhancements

• April 20, 2022 20 Apr'22

  AWS fixes vulnerabilities in Log4Shell hot patch

  AWS issues fixes for a series of Log4Shell hot patches after they turned out to leave its services vulnerable to further exploitation

• April 20, 2022 20 Apr'22

  NSO Group faces court action after Pegasus spyware used against targets in UK

  Three human rights activists whose phones were targeted by spyware traced to Saudi Arabia and the United Arab Emirates have begun legal action against both countries and Israel’s NSO Group Technologies

• April 13, 2022 13 Apr'22

  Microsoft patches two zero-days, 10 critical bugs

  Patch Tuesday is here once again. This month, security teams must fix two privilege escalation zero-days in the Windows Common Log File System Driver and the Windows User Profile Service

• April 11, 2022 11 Apr'22

  Singapore to start licensing cyber security service providers

  Those providing penetration testing and SOC services will need to apply for a licence under a new licensing regime that is expected to safeguard consumer interests and improve service standards

• April 11, 2022 11 Apr'22

  Open source CMS platform Directus patches XSS bug

  A stored cross-site scripting vulnerability in the Directus platform could have enabled malicious actors to gain access to valuable data

• April 08, 2022 08 Apr'22

  Was Spring4Shell a lot of hot air? No, but...

  Find out why Spring4Shell was apparently not as impactful a security problem as many had at first feared, and why it’s on the cyber community as a whole to do better

• April 06, 2022 06 Apr'22

  Apple criticised over unpatched CVEs in Catalina, Big Sur

  Apple patched two zero-days in macOS Monterey last week, but did not address the same issue in Catalina or Big Sur, raising questions

• April 06, 2022 06 Apr'22

  Denonia malware may be first to target AWS Lambda

  The newly discovered Denonia malware appears to be custom designed to target AWS Lambda environments, and may be the first of its kind

• April 01, 2022 01 Apr'22

  Apple drops emergency patches for two zero-days

  Apple has fixed two zero-day vulnerabilities that appear to have been actively exploited in the wild

• March 31, 2022 31 Mar'22

  Spring4Shell zero-day sprung on security teams

  Some are describing a newly disclosed Spring Java framework vulnerability as the next Log4Shell, but what is Spring4Shell, and what can we do about it?

• March 28, 2022 28 Mar'22

  IT professionals wary of government campaign to limit end-to-end encryption

  Members of the Chartered Institute of IT, the professional body for technology professionals in the UK, warn against limiting end-to-end encryption

• March 24, 2022 24 Mar'22

  How India organisations can mitigate cyber threats

  Organisations in India will need to invest more in cloud security, gain more visibility into their systems and improve security awareness among employees to fend off cyber attacks

• March 17, 2022 17 Mar'22

  Kaspersky CEO: Ukraine war must end through diplomacy

  Eugene Kaspersky speaks out on the war in Ukraine, and rebuffs Germany’s BSI, branding its warnings over his company’s trustworthiness as insulting

• March 17, 2022 17 Mar'22

  FCSA takes steps to help umbrella company members protect themselves better from cyber attacks

  After a spate of suspected ransomware attacks on its members, the Freelance and Contractor Services Association is partnering with a cyber security firm that can coach its umbrella firms on how to protect themselves better

• March 16, 2022 16 Mar'22

  Kubernetes vulnerability underscores repeated security warnings

  The disclosure of a new vulnerability in an important container runtime engine that underpins Kubernetes has drawn fresh warnings to pay attention to securing Kubernetes environments

• March 10, 2022 10 Mar'22

  Tech brands sign on to HackerOne responsible security drive

  Tech companies sign HackerOne’s new corporate security responsibility pledge to bring cyber out of the shadows and promote effective, secure development practices

• March 09, 2022 09 Mar'22

  Microsoft serves up three zero-days on March Patch Tuesday

  Three zero-days pop up in Microsoft’s March update, along with a number of other noteworthy concerns for defenders

• March 03, 2022 03 Mar'22

  Nato Cyber Security unit tests post-quantum VPN

  Nato’s Cyber Security Centre has successfully tested secure communication flows in a post-quantum world using a UK-designed VPN

• February 23, 2022 23 Feb'22

  Salesforce pays out over £2m in bug bounties

  Salesforce says it received more than 4,000 vulnerability reports in 2021 alone as it delivers a rare public update on its bug bounty programme

• February 23, 2022 23 Feb'22

  IBM opens cyber security hub in India

  Big Blue’s new cyber security hub, comprising a cyber range, software development facilities and a security operations centre, will serve enterprises across the Asia-Pacific region

• February 16, 2022 16 Feb'22

  2021 another record year for UK cyber investment

  Total revenue generated by the UK’s cyber sector was up 14% last year, and UK-registered security firms raised over £1bn in investment

• February 11, 2022 11 Feb'22

  Lack of knowledge disastrous for effective security strategy within Dutch companies

  Most Dutch companies still haven’t realised that security is an integral part of their IT and company strategy

• February 09, 2022 09 Feb'22

  Microsoft stomps on 48 bugs in February Patch Tuesday update

  It’s a light Patch Tuesday for February 2022, as Microsoft issues fixes for just 48 CVEs, including a solitary zero-day

• February 08, 2022 08 Feb'22

  DPD delivers swift fix for serious API flaw

  API vulnerability potentially left PII on DPD Group’s customers dangerously exposed, but was rapidly fixed on disclosure

• February 08, 2022 08 Feb'22

  Microsoft to start blocking macros to thwart malware

  Microsoft is making changes to web macro permissions across multiple Office apps to help improve user security

• February 08, 2022 08 Feb'22

  The Security Interviews: Building the UK’s future cyber ecosystem

  As the government lays out the next iteration of its Cyber Security Strategy, we speak to Plexal and Lorca’s Saj Huq about his work building a cyber ecosystem to support the UK’s future ambitions

• February 01, 2022 01 Feb'22

  Check Point buys Spectral to safeguard cloud development

  Check Point’s latest acquisition of Israel-based startup Spectral expands its developer-centric security toolset

• January 27, 2022 27 Jan'22

  Nightmare Log4Shell scenario averted by prompt, professional action

  Prompt and professional community response to the Log4Shell disclosure means the dangerous and widespread vulnerability has not been exploited to the extent many had feared

• January 26, 2022 26 Jan'22

  PwnKit bug endangers Linux distributions worldwide

  Qualys researchers share intel on a memory corruption vulnerability in a program installed by default on every major Linux distribution

• January 20, 2022 20 Jan'22

  MoonBounce firmware bootkit shows advances in malicious implants

  MoonBounce firmware bootkit shows evident technical improvements over others, making it a more dangerous threat to organisations. It is being used by Chinese state-backed actors

• January 19, 2022 19 Jan'22

  Investigators find Beijing 2022 app riddled with security flaws

  Security flaws in Olympic app may put personal health data at risk of compromise in a man-in-the-middle attack

• January 17, 2022 17 Jan'22

  Top three questions about the Log4j vulnerability

  Singapore’s Ensign Infosecurity answers the top three questions about the impact of the Log4j vulnerability

• January 12, 2022 12 Jan'22

  Microsoft fixes six zero-days in January Patch Tuesday update

  A larger than of late Patch Tuesday update from Microsoft comes as defenders continue to grapple with Log4Shell

• January 11, 2022 11 Jan'22

  Almost half of Log4j downloads still dangerously exposed

  Whether by error or design is unclear, but a great many IT teams are still exposing themselves by downloading outdated, insecure versions of Apache Log4j

• January 11, 2022 11 Jan'22

  Banks accused of neglecting customer security measures

  Which? singles out Metro Bank, Virgin Money and TSB over insecure online banking processes

• December 23, 2021 23 Dec'21

  Top 10 cyber security stories of 2021

  Cyber security dominated the headlines in 2021, making it hard to gain a clear picture of what to pay attention to. What is an IT buyer to do?

• December 15, 2021 15 Dec'21

  After Log4j, December Patch Tuesday piles on the pressure

  December’s Patch Tuesday update from Microsoft contains several critical CVEs, but this month all attention is focused on the fall-out from Log4Shell, and burn-out is becoming a real issue

• December 14, 2021 14 Dec'21

  Almost half of networks probed for Log4Shell weaknesses

  Close to half of corporate networks have already been actively targeted by individuals seeking to exploit the critical Log4Shell Apache bug