Apple is being called to task for neglecting to patch two “actively exploited” zero-day vulnerabilities on older versions of its flagship macOS platform.
Apple Leaves Big Sur, Catalina Exposed to Critical Flaws: Intego
CashApp Says Ex-Employee Stole Customer Stock Trading Data
Financial services and stock trading platform CashApp on Tuesday fessed up to a data breach being blamed on a former employee who stole brokerage data, including portfolio values, from an unknown number of U.S. accounts.
Experts Warn Defenders: Don’t Relax on Log4j
It’s been four months since the Log4j issue exploded onto the internet. All the major software vendors affected by it have by now released patches – but even where companies have patched, it would be wrong to relax.
PCI Data Security Standard v4.0 Released to Address Emerging Threats
The PCI Security Standards Council (SSC), the organization that oversees the Payment Card Industry Data Security Standard (PCI DSS), this week announced the release of PCI DSS v4.0.
Skiff Banks $10.5M for E2E Encrypted Workplace Collaboration
Sequoia Capital has doubled down on its early-stage investment in Skiff, a startup building a security-themed, end-to-end encrypted workspace collaboration platform.
Investors Bet on Cyberpion in Attack Surface Management Space
Attack surface management specialists Cyberpion has secured $27 million in early-stage funding to build technology that helps organizations manage exposure to risk.
Checkmarx Finds Threat Actor ‘Fully Automating’ NPM Supply Chain Attacks
Threat hunters at Checkmarx on Monday raised an alarm after discovering a threat actor fully automating the creation and delivery of “hundreds of malicious packages” into the NPM ecosystem.
Critical Remote Code Execution Vulnerability in Sophos Firewall
Sophos on Friday announced the rollout of urgent patches for a critical authentication bypass vulnerability in the web portal of its Sophos Firewall product.
Reported by an external researcher via the Sophos bug bounty program, the vulnerability is tracked as CVE-2022-1040 and impacts Sophos Firewall v18.5 MR3 (18.5.3) and older releases.
MixMode Banks $45 Million in Series B Funding
Cyberattacks detection technology provider MixMode has announced the closing of a $45 million Series B funding round led by PSG, with participation from Entrada Ventures.
‘Secrets Sprawl’ Haunts Software Supply Chain Security
A cybersecurity startup is warning of a major, unattended weak link in the software supply chain: the vexing problem of valuable corporate secrets — API keys, usernames and passwords, and security certificates — publicly exposed in corporate repositories.
