Web application security

Six trends that will define cyber through to 2030

From Covid-19 to war in Ukraine, SolarWinds Sunburst, Kaseya, Log4j, MOVEit and more, the past five years brought cyber to mainstream attention, but what comes next? The Computer Weekly Security Think Tank looks ahead to the second half of the 2020s Continue Reading

By

• Pierre-Martin Tardif, ISACA

US TikTok ban imminent after appeal fails

TikTok’s appeal against a US government ban has failed, with a judge dismissing its arguments that its First Amendment free speech rights are being restricted Continue Reading

By

• Alex Scroxton, Security Editor

Nordics move to deepen cyber security cooperation

Nordic countries are increasing collaboration on cyber security amid more sophisticated and aggressive attacks Continue Reading

By

• Gerard O'Dwyer

Curing cancer with computers

In this week’s Computer Weekly, we go behind the scenes at the Francis Crick Institute to find out how data science and AI support its groundbreaking medical research. As courts on both sides of the Atlantic target Google, we analyse the legal threats for Big Tech. And our latest buyer’s guide examines cloud and object storage. Read the issue now. Continue Reading

Automated patch management: A proactive way to stay ahead of threats

Timely patch management should be crucial in any organisation, but too often it goes by the wayside. Automating the process may offer a path forward for hard-pressed cyber defenders Continue Reading

By

• Isla Sibanda

In the cloud, effective IAM should align to zero-trust principles

The Security Think Tank considers best practices in identity and access management and how can they be deployed to enable IT departments to combat cyber-attacks, phishing attacks and ransomware Continue Reading

By

• Vladimir Jirasek, Foresight Cyber

Apple addresses two iPhone, Mac zero-days

Two zero-day vulnerabilities uncovered in Apple’s operating systems could have allowed for arbitrary code execution and cross-site scripting attacks Continue Reading

By

• Alex Scroxton, Security Editor

AI readiness stalls in APAC

Despite significant investment in AI, only 15% of organisations in Asia-Pacific are ready to deploy the technology today, according to Cisco’s latest regional AI readiness survey Continue Reading

By

• Stephen Withers

UK consumers losing more than ever to holiday scams

Last Christmas, UK consumers lost over £11m to cyber criminals. This year, to save them from tears, the NCSC and Action Fraud are teaming up to launch an anti-fraud campaign Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft fixes 89 CVEs on penultimate Patch Tuesday of 2024

High-profile vulns in NTLM, Windows Task Scheduler, Active Directory Certificate Services and Microsoft Exchange Server should be prioritised from November’s Patch Tuesday update Continue Reading

By

• Alex Scroxton, Security Editor

Zero-day exploits increasingly sought out by attackers

Threat actors increasingly favour zero-day exploits to attack their victims before patches become available, according to the NCSC and CISA, which have just published a list of the most widely used vulnerabilities of 2023 Continue Reading

By

• Alex Scroxton, Security Editor

What are the security risks of bring your own AI?

The rise of generative AI has led to a plethora of publicly accessible artificial intelligence tools, but what are the risks when external AI tools are used with corporate data? Continue Reading

By

• Peter Ray Allison

Dutch critical infrastructure at risk despite high leadership confidence

Stark paradox in Dutch cyber security landscape has business leaders expressing high confidence in their IT infrastructure as cyber attacks rise Continue Reading

By

• Kim Loohuis

Danish government reboots cyber security council amid AI expansion

Denmark’s government relaunches digital security initiative to protect business sectors and society at large Continue Reading

By

• Gerard O'Dwyer

Reinventing security operations for the modern threat landscape

The growing pace of digital transformation has opened new avenues for attackers, making traditional security measures obsolete. Organisations must modernise their security operations to fortify their defences and navigate the evolving threat landscape Continue Reading

By

• Aaron Tan, TechTarget

Five zero-days to be fixed on October Patch Tuesday

Stand-out vulnerabilities in Microsoft’s latest Patch Tuesday drop include problems in Microsoft Management Console and the Windows MSHTML Platform Continue Reading

By

• Alex Scroxton, Security Editor

Rise of the cyber clones: When seeing isn’t believing

It is frighteningly easy to clone someone else's identity using readily-available artificial intelligence tools Continue Reading

By

• Jake Moore, ESET

The cyber industry needs to accept it can't eliminate risk

The Computer Weekly Security Think Tank panel considers incident response in the wake of the July CrowdStrike incident, sharing their views on what CrowdStrike got wrong, what it did right, and next steps Continue Reading

By

• Paul Lewis, Nominet

UK on high alert over Iranian spear phishing attacks, says NCSC

The NCSC and counterpart agencies in the US have issued a warning over enhanced Iranian spear phishing activity targeting politicians, journalists, activists and others with an interest in Middle Eastern affairs Continue Reading

By

• Alex Scroxton, Security Editor

Printing vulnerability affecting Linux distros raises alarm

Security pros need to get in front of a series of vulnerabilities affecting the Cups Linux printing service after an apparently botched disclosure process saw technical details published in advance of a patch Continue Reading

By

• Alex Scroxton, Security Editor

CrowdStrike apologises to US government for global mega-outage

CrowdStrike executive Adam Meyers appears before a US government committee to explain the series of errors that led directly to one of the biggest IT outages in history Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft shares progress on Secure Future Initiative

Microsoft has published a progress report on its Secure Future Initiative, launched last year in the wake of multiple security incidents, and made a series of commitments to improve its internal cyber culture Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Win back lost trust by working smarter

The Computer Weekly Security Think Tank panel considers incident response in the wake of the July CrowdStrike incident, sharing their views on what CrowdStrike got wrong, what it did right, and next steps Continue Reading

By

• Vladimir Jirasek, Foresight Cyber

First CyberBoost Catalyse startup cohort named

The first group of companies named to a cyber incubator programme run by Plexal and the National University of Singapore includes two growing UK businesses Continue Reading

By

• Alex Scroxton, Security Editor

Cyber workforce must almost double to meet global talent need

Research from ISC2 finds global cyber workforce needs additional 4.8 million people to fully secure businesses Continue Reading

By

• Clare McDonald, Business Editor

How Sonar is elevating code quality in the age of AI

Sonar’s code quality platform helps developers maintain secure, high-quality code amid the rise of artificial intelligence-based coding assistants, now expanding into the Asian market Continue Reading

By

• Aaron Tan, TechTarget

JFrog and GitHub unveil open source security integrations

Secure software specialist JFrog is working with code development service GitHub to integrate the onboard capabilities of its Software Supply Chain Platform service into GitHub’s platform Continue Reading

By

• Alex Scroxton, Security Editor

Multiple Veeam vulns spark concern among defenders

Veeam users are urged to patch a series of vulnerabilities in the firm’s Backup & Replication product to get out ahead of potential exploitation by ransomware gangs Continue Reading

By

• Alex Scroxton, Security Editor

PyPI loophole puts thousands of packages at risk of compromise

Thousands of PyPI packages are at risk of an attack technique dubbed Revival Hijack, which exploits a loophole in the platform’s package naming feature Continue Reading

By

• Alex Scroxton, Security Editor

Global cyber spend to rise 15% in 2025, pushed along by AI

Security spending will increase at pace in 2025, with artificial intelligence, cloud and consultancy services all pushing outlay to new highs, according to Gartner Continue Reading

By

• Alex Scroxton, Security Editor

How Kaspersky is driving growth in APAC

Kaspersky is leveraging its threat intelligence capabilities and local market knowledge to navigate geopolitical tensions and expand its footprint across the Asia-Pacific region Continue Reading

By

• Aaron Tan, TechTarget

Phishing links becoming bigger threat than email attachments

Phishing techniques are evolving away from malicious email attachments, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Popular Microsoft apps for Mac at risk of code injection attacks

Researchers at Cisco Talos turn up evidence suggesting that Microsoft apps running on the Apple macOS operating system are not as secure as they seem Continue Reading

By

• Alex Scroxton, Security Editor

Thousands of NetSuite customers accidentally exposing their data

Misconfigured permissions across live websites are leaving thousands of NetSuite users open to having their valuable customer data stolen, researchers say Continue Reading

By

• Alex Scroxton, Security Editor

August Patch Tuesday proves busy with six zero-days to fix

Microsoft patches six actively exploited zero-days among over 100 issues during its regular monthly update Continue Reading

By

• Alex Scroxton, Security Editor

Deep dive into quantum-resistant cryptography for email security

Quantum computers have the potential to crack many of the encryption methods we currently rely on to keep our digital communications safe. Quantum-resistant cryptography may be the answer Continue Reading

By

• Isla Sibanda

2024 seeing more CVEs than ever before, but few are weaponised

The number of disclosed CVEs soared by 30% in the first seven-and-a-half months of the year, but a tiny fraction of these have been exploited by threat actors, a reminder of the importance of focused security strategies Continue Reading

By

• Alex Scroxton, Security Editor

Chinese cyber attack sparks alert over six-year-old MS vuln

After a proof-of-concept for a six-year-old Microsoft vulnerability emerged in a Chinese APT attack chain, defenders should be on the look-out for exploitation of CVE-2018-0824 Continue Reading

By

• Alex Scroxton, Security Editor

CrowdStrike shareholders sue, alleging false security claims

A US pension fund is lining up a lawsuit against CrowdStrike, claiming the cyber company lied about the integrity of its systems, leading to failings that caused a worldwide IT outage Continue Reading

By

• Alex Scroxton, Security Editor

API attacks surge by 65% in APAC, fuelled by rapid digitisation

Akamai's report reveals a significant rise in cyber attacks on web applications and APIs in the region over the past year, with financial and commerce sectors hardest hit Continue Reading

By

• Aaron Tan, TechTarget

CrowdStrike update chaos explained: What you need to know

A botched software update at cyber security firm CrowdStrike has caused IT chaos around the world. Learn more about the global CrowdStrike update outage as it develops Continue Reading

By

• Alex Scroxton, Security Editor

Scam CrowdStrike domains growing in volume

Hundreds of malicious domains exploiting CrowdStrike’s branding are appearing all over the web in the wake of the 19 July outage. Experts from Akamai share some noteworthy examples, along with guidance on how to avoid getting caught out Continue Reading

By

• Alex Scroxton, Security Editor

CrowdStrike says most Falcon sensors now up and running

The vast majority of CrowdStrike Falcon sensors affected by a coding error have now been recovered, with a final resolution expected this week Continue Reading

By

• Alex Scroxton, Security Editor

CrowdStrike blames outage on content configuration update

CrowdStrike publishes the preliminary findings of what will be a lengthy investigation into the root causes of the failed 19 July update that caused Windows computers to crash all over the world Continue Reading

By

• Alex Scroxton, Security Editor

CrowdStrike reveals Windows weakness

The bug that impacted 8.5m PCs last week was, says, CrowdStrike due to an update it refers to as “Rapid Response Content”, which is delivered as a “template instance”. This is data stored in a ... Continue Reading

By

• Cliff Saran, Managing Editor

Innovations to power secure-by-design development

Secure Code Warrior unveils technology designed to help CISOs and AppSec teams ensure their projects remain safe and free of coding errors and vulnerabilities – a big issue following the CrowdStrike incident Continue Reading

By

• Alex Scroxton, Security Editor

CrowdStrike chaos shows risks of concentrated ‘big IT’

The concentration of so much mission-critical technology in the hands of a few large suppliers makes incidents like the Microsoft-CrowdStrike outage all the more dangerous Continue Reading

By

• Alex Scroxton, Security Editor

Incubator Plexal heads to Singapore for CyberBoost

Cyber startup hub Plexal expands its presence to Singapore through a new initiative, and sets its sights on helping new UK businesses break into the booming Asia-Pacific market Continue Reading

By

• Alex Scroxton, Security Editor

Dutch research firm TNO pictures the SOC of the future

In only a few years, security operations centres will have a different design and layout, and far fewer will remain Continue Reading

By

• Kim Loohius

Hyper-V zero-day stands out on a busy Patch Tuesday

Microsoft has fixed almost 140 vulnerabilities in its latest monthly update, with a Hyper-V zero-day singled out for urgent attention Continue Reading

By

• Alex Scroxton, Security Editor

IT's a vulnerable world out there...

It was a pleasure to catch up t’other day with Rik “rock star” Ferguson, the former Trend Micro legend who is these days hanging out with Forescout as the company’s VP of Security Intelligence, ... Continue Reading

By

• Steve Broadhead, Broadband Testing

How Recorded Future is operationalising threat intelligence

Recorded Future is investing in APIs to enable automated security workflows, among other measures, to help organisations overcome the hurdles of operationalising threat intelligence Continue Reading

By

• Aaron Tan, TechTarget

Black Basta ransomware crew may be exploiting Microsoft zero-day

A Microsoft vulnerability that was addressed without fanfare in March may in fact have been exploited as a zero-day by the notorious Black Basta ransomware gang, threat hunters warn Continue Reading

By

• Alex Scroxton, Security Editor

Data leakage in the cloud – can data truly be safe in the cloud?

This month, the Computer Weekly Security Think Tank considers how CISOs and security practitioners should ensure that the business can make use of public cloud services safely and securely and avoid accidental or deliberate data leakage. Continue Reading

By

• Scott Swalling

Sophos uncovers Chinese state-sponsored campaign in Southeast Asia

Sophos found three distinct clusters of activity targeted at a high-level government organisation that appeared to be tied to Chinese interests in the South China Sea Continue Reading

By

• Aaron Tan, TechTarget

Building a more secure, and sustainable, open source ecosystem

In April 2024, the discovery of an intentionally-placed backdoor in the open source XZ Utils data compression caused concern. Sentry's Chad Whitacre says a more thoughtful approach is needed to balance the individual freedom and creativity of open source, with more rigorous security practice. Continue Reading

By

• Chad Whitacre

Proofpoint exposes AFF scammers’ piano gambit

Ransomware and nation state actors dominate the headlines, but fraud and scams still net career cyber criminals thousands from unsuspecting members of the public. Proofpoint reports on a campaign targeting victims of a musical inclination Continue Reading

By

• Alex Scroxton, Security Editor

How to avoid joining the Dead Java Code Society

Unused or dead Java code is bogging down software engineers and developers, causing weird dependencies and security risks. Eric Costlow of Azul shares some advice on how to avoid becoming a member of a rather unpleasant club Continue Reading

By

• Eric Costlow

ORBs: Hacking groups’ new favourite way of keeping their attacks hidden

Beware the ORB: why attacks on your network could come from a home router down the street Continue Reading

By

• Steve Ranger

Critical SharePoint, Qakbot-linked flaws focus of May Patch Tuesday

A critical SharePoint vulnerability warrants attention this month, but it is another flaw that seems to be linked to the infamous Qakbot malware that is drawing attention Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft beefs up cyber initiative after hard-hitting US report

Microsoft is expanding its recently launched Secure Future Initiative in the wake of a hard-hitting US government report on recent nation state intrusions into its systems Continue Reading

By

• Alex Scroxton, Security Editor

Adobe expands bug bounty programme to account for GenAI

Adobe has expanded the scope of its HackerOne-driven bug bounty scheme to incorporate flaws and risks arising from the development of generative artificial intelligence Continue Reading

By

• Alex Scroxton, Security Editor

How Okta is fending off identity-based attacks

Okta has been bolstering the security of its own infrastructure and building new tools to scan customer environments for vulnerable identities, among other efforts to fend off identity-based attacks Continue Reading

By

• Aaron Tan, TechTarget

Australia’s Qantas apologises for mobile app data breach

Australian flag carrier Qantas has apologised after a glitch in its mobile application temporarily enabled some customers to view the flights and booking details of other frequent fliers on two separate occasions Continue Reading

By

• Alex Scroxton, Security Editor

Secure coding benchmark to increase standards among developers

Developer security advocate Secure Code Warrior has launched what it claims is the industry’s first benchmark designed to quantify the security competence of its customers’ software developer teams Continue Reading

By

• Alex Scroxton, Security Editor

Bad bot traffic in Australia grew 23% in 2023

Traffic from bad bots that perform malicious tasks accounted for 30.2% of Australia’s internet traffic in 2023 Continue Reading

By

• Aaron Tan, TechTarget

Zero trust is a strategy, not a technology

Zero-trust security should be seen as a strategy to protect high-value assets and is not tied to a specific technology or product, says the model’s creator John Kindervag Continue Reading

By

• Aaron Tan, TechTarget

Mandatory MFA pays off for GitHub and OSS community

Mandating multifactor authentication for select developers has been a huge success for GitHub, the platform reports, and now it wants to go further Continue Reading

By

• Alex Scroxton, Security Editor

Cyber training leader KnowBe4 to buy email security firm Egress

Security awareness training and phishing simulation specialist KnowBe4 is to buy email security expert Egress Continue Reading

By

• Alex Scroxton, Security Editor

TikTok ban sails through US Senate

A law that will ban TikTok in the US unless its owner sells up pronto passed the US Senate by a landslide majority after being included in a package of military aid Continue Reading

By

• Alex Scroxton, Security Editor

CW Innovation Awards: Balancing security and user experience

The National University of Singapore’s Safe initiative has strengthened the security of IT systems and end-user devices while prioritising user experience through passwordless access Continue Reading

By

• Edwin Yapp

More social engineering attacks on open source projects observed

In the wake of the recent XZ Utils scare, maintainers of another open source project have come forward to say they may have experienced similar social engineering attacks Continue Reading

By

• Alex Scroxton, Security Editor

Apple iPhone security alert renews spyware concerns

An Apple security alert received by users in 92 countries raises fresh fears over ongoing campaigns by users of mercenary spyware products Continue Reading

By

• Alex Scroxton, Security Editor

Cyber crooks poison GitHub search to fool developers

Researchers share data on new technique whereby malicious actors are manipulating GitHub’s search function and using cleverly crafted repositories to distribute malware Continue Reading

By

• Alex Scroxton, Security Editor

Salesforce helps customers establish bug bounty programmes

Salesforce has added new learning content to its Trailhead platform designed to help customers develop their own bug bounty programmes Continue Reading

By

• Alex Scroxton, Security Editor

What Cisco’s Splunk acquisition means for APAC customers

APAC organisations can expect better visibility and insights into their networks and applications along with automation and response capabilities to improve their digital resilience Continue Reading

By

• Aaron Tan, TechTarget

Open source alert over intentionally placed backdoor

A backdoor in the open source XZ Utils data compression library could have led to widespread compromise across the Linux ecosystem - and the community is on the trail of a developer who seems to be behind it Continue Reading

By

• Alex Scroxton, Security Editor

Organisations getting better at spotting identity fraud

As the barriers to committing identity fraud continue to drop, organisations should consider more sophisticated technical measures to successfully up their game, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

UK plc going backwards on cyber maturity, Cisco report claims

Fewer UK organisations believe their cyber security postures have reached a mature level than did so 12 months ago, as they struggle to keep up with new challenges and a fast-evolving threat landscape Continue Reading

By

• Alex Scroxton, Security Editor

Cyber spies, not cyber criminals, behind most zero-day exploitation

Analysis from Google has found that zero-day vulnerabilities are much more heavily exploited for espionage purposes than for financially motivated cyber crime Continue Reading

By

• Alex Scroxton, Security Editor

US sues Apple, alleging smartphone monopoly

A major legal action against Apple over its dominance of the smartphone market has kicked off in the US, alleging anticompetitive practices on Apple’s part that have damaged the sector and restricted consumer choice Continue Reading

By

• Alex Scroxton, Security Editor

Australia’s cyber security spending to grow 11.5% this year

Highly publicised cyber attacks and growing regulatory obligations are keeping security and risk top of mind for Australian organisations this year, says Gartner Continue Reading

By

• Aaron Tan, TechTarget

US authorities move a step closer to banning TikTok

Lawmakers in Washington DC have moved a step closer to enacting a broad national ban on controversial video app TikTok in the US, with global ramifications Continue Reading

By

• Alex Scroxton, Security Editor

March Patch Tuesday throws up two critical Hyper-V flaws

Two critical vulnerabilities in Windows Hyper-V stand out on an otherwise unremarkable Patch Tuesday Continue Reading

By

• Alex Scroxton, Security Editor

OSS leaders detail commitments to bolster software security

CISA has announced a number of actions to help secure the global open source ecosystem, as leading package repositories including the Python and Rust foundations advance their own initiatives Continue Reading

By

• Alex Scroxton, Security Editor

Apple patches zero-days amid ‘foundational’ post-quantum update

Apple’s iOS 17.4 update not only fixes zero-day flaws that are being actively exploited, but includes important new security protocols to safeguard users against future attacks Continue Reading

By

• Alex Scroxton, Security Editor

Rapid7 hits out over botched vulnerability disclosure

Software development firm JetBrains and security specialist Rapid7 fall out over the handling of a critical vulnerability disclosure, while customers are left rushing to patch Continue Reading

By

• Alex Scroxton, Security Editor

Black Basta and Bl00dy ransomware gangs exploiting ConnectWise vulns

More ransomware gangs have been observed exploiting two dangerous vulnerabilities in ConnectWise ScreenConnect software, prompting new warnings for users to get patching Continue Reading

By

• Alex Scroxton, Security Editor

VulnCheck bug listing to help track new threats quicker

Exploit intelligence firm VulnCheck launches a proprietary Known Exploited Vulnerabilities catalogue in hopes of improving end-user access to intel on emerging threats and reaching those that the likes of CISA do not Continue Reading

By

• Alex Scroxton, Security Editor

Cyber experts alarmed by ‘trivial’ ConnectWise vulns

The disclosure of two dangerous vulnerabilities in the popular ConnectWise ScreenConnect product is drawing comparisons with major cyber incidents, including the 2021 Kaseya attack Continue Reading

By

• Alex Scroxton, Security Editor

CVE volumes set to increase 25% this year

The number of reported Common Vulnerabilities and Exposures is likely to grow significantly in 2024, hitting a new high of almost 35,000, according to Coalition, a cyber insurance specialist Continue Reading

By

• Alex Scroxton, Security Editor

Security-by-design push prompts new ISC2 accreditations

Security-by-design has become a hot-button regulatory issue. ISC2 has decided now is the time to upskill cyber pros around these vital software and hardware development principles Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft: Nation-state hackers are exploiting ChatGPT

Threat actors from China, Iran, North Korea and Russia have all been probing use cases for generative AI service ChatGPT, but have yet to use such tools in a full-blown cyber attack Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft patches two zero-days for Valentine’s Day

Two security feature bypasses impacting Microsoft SmartScreen are on the February Patch Tuesday docket, among more than 70 issues Continue Reading

By

• Alex Scroxton, Security Editor

New variants of Qakbot malware under development

Despite its infrastructure having been taken down by the FBI last year, someone appears to be actively working on a new and improved version of the infamous Qakbot malware Continue Reading

By

• Alex Scroxton, Security Editor

Hunter-killer malware volumes seen surging

Latest Picus Security report on malware tactics, techniques and procedures reveals an increasing focus on disabling security defences Continue Reading

By

• Alex Scroxton, Security Editor

MoD ethical hacking programme expands after initial success

The Ministry of Defence has expanded the scope of its defensive security partnership with HackerOne Continue Reading

By

• Alex Scroxton, Security Editor

clinical decision support system (CDSS)

A clinical decision support system (CDSS) is an application that analyzes data to help healthcare providers make decisions and improve patient care. Continue Reading

By

• Rahul Awati
• Megan Charles
• Alex DelVecchio, Content Development Strategist

personal health record (PHR)

A personal health record (PHR) is an electronic summary of health information that a patient maintains control of themselves, as opposed to their healthcare provider. Continue Reading

By

• Katie Terrell Hanna
• Kristen Lee, News Writer

Bugcrowd sees surge in vulnerability submissions, led by public sector

Crowdsourced vulnerability disclosure and bug bounty platform Bugcrowd says it saw a 151% uptick in submissions related to government and public sector organisations in 2023 Continue Reading

By

• Alex Scroxton, Security Editor