Week in review: JetBrains GitHub plugin vulnerability, 20k FortiGate appliances compromised
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:
Users of JetBrains IDEs at risk of GitHub access token compromise (CVE-2024-37051)
JetBrains has fixed a critical vulnerability (CVE-2024-37051) that could expose users of its integrated development environments (IDEs) to GitHub access token compromise.
20,000 FortiGate appliances compromised by Chinese hackers
Coathanger – a piece of malware specifically built to persist on Fortinet’s FortiGate appliances – may still be lurking on too many devices deployed worldwide.
How businesses can integrate token technology into existing payment systems
In this Help Net Security interview, Mark Nelsen, SVP and Global Head of Consumer Product at Visa, discusses the integration of token technology into existing payment systems.
Security and privacy strategies for CISOs in a mobile-first world
In this Help Net Security interview, Jim Dolce, CEO at Lookout, discusses securing mobile devices to mitigate escalating cloud threats.
Radare: Open-source reverse engineering framework
Radare is an open-source UNIX-like reverse engineering framework and command-line toolset. It can be scripted, modified, and used for batch analysis.
Cybersecurity jobs available right now: June 12, 2024
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.
Microsoft delays Windows Recall rollout, more security testing needed
Microsoft is delaying the release of Recall, a controversial Windows 11 feature that will allow users to search their computer for specific content that has previously been viewed by them.
YetiHunter: Open-source threat hunting tool for Snowflake environments
Cloud identity protection company Permiso has created YetiHunter, a threat detection and hunting tool companies can use to query their Snowflake environments for evidence of compromise.
PHP command injection flaw exploited to deliver ransomware (CVE-2024-4577)
An OS command injection vulnerability in Windows-based PHP (CVE-2024-4577) in CGI mode is being exploited by the TellYouThePass ransomware gang.
AWS unveils new and improved security features
At its annual re:Inforce conference, Amazon Web Services (AWS) has announced new and enhanced security features and tools.
Microsoft fixes RCE vulnerabilities in MSMQ, Outlook (CVE-2024-30080, CVE-2024-30103)
June 2024 Patch Tuesday is here and Microsoft has delivered fixes for a critical MSMQ flaw (CVE-2024-30080) and a RCE vulnerability in Microsoft Outlook (CVE-2024-30103).
The number of known Snowflake customer data breaches is rising
LendingTree subsidiary QuoteWizard and automotive parts provider Advance Auto Parts have been revealed as victims of attackers who are trying to sell data stolen from Snowflake-hosted cloud databases.
Modern fraud detection need not rely on PII
Trends in online fraud detection often act as the canary in the coal mine when it comes to understanding and combating the next generation of online scams, fraud and cybersecurity threats.
Solving the systemic problem of recurring vulnerabilities
In this Help Net Security video, Dr. Pedram Hayati, CEO at SecDim, and Fil Filiposki, founder of AttackForge, discuss how the two companies have formed a strategic collaboration to tackle the major challenge of resurfacing vulnerabilities.
Preparing for a career in cybersecurity? Check out these statistics
This article includes excerpts from various reports that provide statistics and insights on cybersecurity jobs, skills shortages, and workforce dynamics.
Urgently needed: AI governance in cyber warfare
Despite government efforts to regulate technologies like AI, there will always be gaps between policy, regulation, and the rapid pace of innovation.
Maximizing productivity with Copilot for Microsoft 365: A security perspective
In this Help Net Security video, Brian Vecci, Field CTO at Varonis, talks about maximizing the potential of Microsoft Copilot for 365.
Cybersecurity pros change strategies to combat AI-powered threats
75% of security professionals had to change their cybersecurity strategy in the last year due to the rise in AI-powered cyber threats, with 73% expressing a greater focus on prevention capabilities, according to Deep Instinct.
Open-source security in AI
New AI products are coming onto the market faster than we have seen in any previous technology revolution.
Six months of SEC’s cyber disclosure rules
In this Help Net Security video, Mark Millender, Senior Advisor of Global Executive Engagement at Tanium, discusses the overall sentiment from CISOs of large, public companies on the effectiveness and understanding of SEC’s cyber disclosure rules and common misconceptions and gray areas to watch for.
Major cybersecurity upgrades announced to safeguard American healthcare
Recognizing that effective cybersecurity is critical to Americans accessing the care they need, the Biden-Harris Administration is working relentlessly to improve the resilience of the healthcare sector to cyberattacks.
Cloud migration expands the CISO role yet again
The CISO role used to be focused primarily on information security — creating and implementing policies to safeguard an organization’s data and IT infrastructure from cybersecurity threats.
GDPR turns six: Expert discusses AI impact
In this Help Net Security video, Chris Denbigh-White, CSO at Next DLP, discusses how emerging technologies, such as AI, have presented new data protection challenges and how organizations must balance deployment and legality.
AI’s role in accelerating vulnerability management
With its capability to analyze, predict, and automate, AI stands to reshape many corners of business, most notably cybersecurity.
New infosec products of the week: June 14, 2024
Here’s a look at the most interesting products from the past week, featuring releases from Acronis, Diligent, Entrust, KELA, Plainsea, and SentinelOne.