Media Packet · Press & Media
761 items
Press & Media
“Lawsuit alleges Roblox tracks children's data without parental consent”
securitymagazine.com
Press & Media
Casey Ellis comments on a lawsuit against Roblox, framing it as a reminder of the "trust tax" companies pay when handling user data, particularly that of children. He notes the complexity of consent in digital environments and the potential for such lawsuits to set new precedents.
Press & Media
“CISA adds the notorious Telemessage flaw to KEV list”
csoonline.com
Press & Media
In response to CISA adding a Telemessage flaw to its KEV list, Casey Ellis analyzes the incident as a "classic case of supply chain risk." He emphasizes that trust in a vendor's security is paramount and that this breach demonstrates the cascading impact of a single vulnerability.
Press & Media
“What the Netflix ‘Zero Day’ series got right about incident response”
scworld.com
Press & Media
Casey Ellis provides commentary on the Netflix series 'Zero Day,' noting that it accurately portrays the intense, high-pressure environment of a major incident response and the complex coordination required between technical teams, leadership, and government agencies.
Press & Media
“Why Vulnerability Exploitation Is Shifting in 2024-25”
darkreading.com
Press & Media
In an article about shifting vulnerability exploitation trends, Casey Ellis argues that the advantage has recently swung back towards defenders, attributing this shift to the rise of bug bounty programs, improved vulnerability disclosure, and more proactive security postures from vendors.
Press & Media
“Bipartisan bill would renew cyber threat info sharing law”
ciodive.com
Press & Media
Commenting on the proposed renewal of the Cybersecurity Information Sharing Act (CISA), Casey Ellis emphasizes that the legislation is crucial for reinforcing the framework of public-private trust essential for national cybersecurity.
Press & Media
“What is Slopsquatting: A New Threat to AI-Generated Code Security”
hackread.com
Press & Media
Casey Ellis explains the concept of "slopsquatting," an attack that exploits the "fuzzy" and sometimes incorrect nature of AI-generated code. He notes that this emerging threat targets the trust developers place in AI tools and highlights the need for rigorous verification.
Press & Media
“Cybersecurity World On Edge As CVE Program Prepares To Go Dark”
forbes.com
Press & Media
In an article about the potential disruption of the Common Vulnerabilities and Exposures (CVE) program, Casey Ellis expresses his concern, describing the program as a "common language" for vulnerabilities that prevents chaos and enables coordinated defense.
Press & Media
“Malicious AI tool Xanthorox claims advanced capabilities for criminals, no jailbreaks required”
scworld.com
Press & Media
Casey Ellis discusses the emergence of Xanthorox, a malicious AI tool, highlighting the dual-use nature of AI. He explains that while AI democratizes technology, it also lowers the barrier for creating sophisticated cyberattacks.
Press & Media
“NSA: Fast-flux DNS evasion technique now a national security threat”
scworld.com
Press & Media
In response to an NSA advisory on "fast flux" DNS techniques, Casey Ellis explains that the method acts like a "shell game" to hide malicious servers and highlights the industrialization of cybercrime.
Press & Media
“Hack OpenAI And Win $100,000? What You Need To Know”
forbes.com
Press & Media
Casey Ellis comments on OpenAI's bug bounty program, framing it as a positive step that signals a commitment to security and transparency, which helps build trust with users and the security research community.
Press & Media
“Massive Surge In Ransomware Attacks, AI And 2FA Bypass To Blame”
forbes.com
Press & Media
Casey Ellis analyzes the surge in ransomware attacks, attributing it to threat actors using AI for more convincing phishing attacks and developing methods to bypass multi-factor authentication, urging for more robust defense strategies.
Press & Media
“Critical Cisco SMB Router Flaw Allows Authentication Bypass, PoC Available Critical Cisco SMB Router Flaw Allows Authent…”
darkreading.com
Press & Media
Details a critical authentication bypass vulnerability in Cisco small-to-medium business routers, for which proof-of-concept exploit code is publicly available.
Press & Media
“A Breach at LastPass Has Password Lessons for Us All”
nytimes.com
Press & Media
An article advising that despite recent breaches like the one at LastPass, using a password manager remains one of the best defenses against hackers.
Press & Media
“Five Guys Data Breach Puts HR Data Under a Heat Lamp”
darkreading.com
Press & Media
Reports on a data breach at the restaurant chain Five Guys, which may have exposed sensitive human resources data.
Press & Media
“The U.S. Still Needs Cybersecurity Pros Despite All the Tech Layoffs”
news.clearancejobs.com
Press & Media
Argues that despite widespread layoffs in the tech sector, the demand for cybersecurity professionals in the U.S. remains high.
Press & Media
“How AI and DAST can mitigate security risks”
scmagazine.com
Press & Media
2023-01-27
Press & Media
“Cisco: No Fixes for Small Business Router Vulnerabilities”
channelfutures.com
Press & Media
Reports that Cisco will not be patching critical vulnerabilities in several end-of-life small business routers, advising customers to migrate to newer hardware.
Press & Media
“Cisco warns of two critical vulnerabilities in end-of-life routers”
teiss.co.uk
Press & Media
Covers Cisco's warning about two critical vulnerabilities in some of its end-of-life routers, for which no patches will be issued.
Press & Media
“Bugcrowd Recognized as Security Numbering Authority for Common Vulnerabilities and Exposures”
itnewsonline.com
Press & Media
A press release announcing that Bugcrowd has been designated as a CVE Numbering Authority (CNA) by the CVE Program.
Press & Media
“Bugcrowd Recognized as Security Numbering Authority for Common Vulnerabilities and Exposures”
finance.yahoo.com
Press & Media
Announces that Bugcrowd has been authorized as a CVE Numbering Authority (CNA), allowing it to assign CVE IDs to newly discovered vulnerabilities.
Press & Media
“15 Recent Consumer-Facing Tech Developments That Truly Excite Experts”
forbes.com
Press & Media
A piece where 15 technology experts, including Casey Ellis, share their excitement about recent consumer tech developments that they find truly innovative.
Press & Media
“SolarWinds data breach lawsuit takeaways for CISOs”
securitymagazine.com
Press & Media
Analyzes a shareholder lawsuit against SolarWinds following its major data breach, offering key lessons for CISOs on disclosure, liability, and supply chain security.
Press & Media
“Microsoft Takes Down Russia’s Strontium Allies Attacking Ukraine”
securityboulevard.com
Press & Media
Details Microsoft's actions to disrupt the Russian state-sponsored hacking group STRONTIUM (APT28) by taking control of domains used in attacks targeting Ukraine.
Press & Media
“The ‘Text4Shell’ vulnerability is not a sequel to Log4Shell”
scmagazine.com
Press & Media
An analysis piece clarifying that the "Text4Shell" vulnerability, while serious, does not have the same widespread impact or severity as the Log4Shell flaw.
Press & Media
“Experts downplay reach of Apache bug ‘Text4Shell’”
therecord.media
Press & Media
Reports on security experts downplaying the potential impact of the "Text4Shell" vulnerability in an Apache Commons library, noting its limited real-world exploitability.
Press & Media
“CRITICAL-SEVERITY FLAW IN APACHE COMMONS TEXT LIBRARY FIXED”
duo.com
Press & Media
Details the patching of a critical severity remote code execution flaw, dubbed "Text4Shell," in the Apache Commons Text library.
Press & Media
“Former Uber Security Chief Convicted of Covering up Two Data Breaches”
cpomagazine.com
Press & Media
Details the conviction of former Uber CSO Joe Sullivan on charges of obstructing justice and concealing data breaches from federal authorities.
Press & Media
“It’s 2022 and netizens are only now getting serious about cybersecurity”
theregister.com
Press & Media
Argues that users often choose security and privacy tools based on hype and marketing rather than on their actual technical merits.
Press & Media
“Twisted Cyber Case Finds Former Uber Security Chief Guilty of Data Breach Coverup”
technewsworld.com
Press & Media
Reports on the guilty verdict for former Uber security chief Joe Sullivan, who was convicted of covering up a 2016 data breach.
Press & Media
“How Marico’s cybersec chief secured the board’s buy-in to amp up its security capabilities”
cio.economictimes.indiatimes.com
Press & Media
A case study on how the cybersecurity chief at the company Marico successfully gained board approval and investment to enhance their security capabilities.
Press & Media
“PSW #757 – EV KONTSEVOY, CASEY ELLIS”
scmagazine.com
Press & Media
An episode of the Paul's Security Weekly podcast featuring interviews with Ev Kontsevoy and Casey Ellis.
Press & Media
“FBI Helping Australian Authorities Investigate Massive Optus Data Breach: Reports”
darkreading.com
Press & Media
Reports that the FBI is assisting Australian authorities in the investigation of a massive data breach at the telecommunications company Optus.
Press & Media
“NSW Gov picks CyRise to operate cyber accelerator”
crn.com.au
Press & Media
Reports that the New South Wales government has selected the accelerator CyRise to operate its new cybersecurity accelerator program.
Press & Media
“Researchers warn of ‘rosy’ security reports in wake of Twitter whistleblower case”
scmagazine.com
Press & Media
Discusses how the Twitter whistleblower case has led researchers to warn about the unreliability of overly positive internal security reports.
Press & Media
“Twitter lacks cybersecurity & data privacy best practices, says ex-security chief”
securitymagazine.com
Press & Media
Covers the explosive whistleblower complaint from former Twitter security chief Peiter "Mudge" Zatko, alleging severe cybersecurity and privacy deficiencies.
Press & Media
“Security Industry Rallies Behind Twitter Whistleblower”
securityboulevard.com
Press & Media
Reports on the cybersecurity industry's widespread support for Peiter "Mudge" Zatko, the Twitter whistleblower who alleged serious security failings at the company.
Press & Media
“Security Flash - Apple Vulnerability (CVE 2022-32893)”
bugcrowd.com
Press & Media
A webinar hosted by Bugcrowd discussing a zero-day vulnerability that was affecting multiple Apple products.
Press & Media
“Mudge Blows Whistle on Alleged Twitter Security Nightmare”
darkreading.com
Press & Media
Details the whistleblower complaint from Peiter "Mudge" Zatko, who described Twitter's security posture as a "nightmare" of mismanagement and negligence.
Press & Media
“Twitter has a security problem”
protocol.com
Press & Media
An article analyzing the security and business implications of the whistleblower complaint filed by Twitter's former head of security.
Press & Media
“ZERO DAY INITIATIVE CHANGES DISCLOSURE POLICY FOR FAULTY PATCHES”
duo.com
Press & Media
Reports on the Zero Day Initiative's change in policy regarding how it handles and discloses vulnerabilities for which vendors have issued faulty or incomplete patches.
Press & Media
“U.S. Doubles Reward for Information on North Korea Cyberattackers”
channelfutures.com
Press & Media
Reports that the U.S. government has doubled the reward, up to $10 million, for information on North Korean state-sponsored cyberattackers.
Press & Media
“Builders and Breakers”
securityboulevard.com
Press & Media
An opinion piece discussing the relationship between software developers ("builders") and security researchers ("breakers") and the need for better collaboration.
Press & Media
“Crypto Firms Make Thieving Hackers an Offer: Keep a Little, Give Back the Rest”
wsj.com
Press & Media
Reports on the growing trend of cryptocurrency firms negotiating with hackers after a theft, offering them a "bounty" to return the majority of the stolen funds.
Press & Media
“Latest Atlassian Confluence vulnerability raises concerns”
computerweekly.com
Press & Media
Discusses the security concerns raised by the discovery of the latest critical vulnerability in Atlassian's Confluence software.
Press & Media
“T-Mobile to Pay $350 Million Settlement in Data Breach Class-Action Lawsuit”
channelfutures.com
Press & Media
Reports that T-Mobile has agreed to pay $350 million to settle a class-action lawsuit related to a major data breach.
Press & Media
“Messaging Apps That Are Secure: Signal vs. WhatsApp”
thestreet.com
Press & Media
An article comparing the security and privacy features of different messaging apps, such as Signal and WhatsApp.
Press & Media
“Why Current Events Can and Will Affect Your Security Posture”
cisoseries.com
Press & Media
A podcast or article discussing how current geopolitical and social events can directly impact an organization's security posture and threat landscape.
Press & Media
“Hardcoded password in Confluence app has been leaked on Twitter”
arstechnica.com
Press & Media
Discusses a critical vulnerability in Atlassian's Confluence software caused by a hardcoded password, warning that it is likely to be actively exploited by attackers.
Press & Media
“Atlassian warns of several new critical vulnerabilities potentially being exploited in wild”
therecord.media
Press & Media
Covers Atlassian's advisory about multiple critical vulnerabilities in its products that were potentially being exploited in the wild, including a hardcoded password flaw.
Press & Media
“Labor Department announces 120-day cybersecurity apprenticeship sprint”
fedscoop.com
Press & Media
Reports on the U.S. Department of Labor's initiative to launch a 120-day "Cybersecurity Apprenticeship Sprint" to address the national shortage of cyber professionals.
Press & Media
“Chaotic LAPSUS$ Group Goes Quiet, but Threat Likely Persists”
darkreading.com
Press & Media
Analyzes the tactics of the LAPSUS$ extortion group, noting that despite their chaotic nature, the threat of their social engineering and data theft methods continues.
Press & Media
“Labor and Commerce departments launch new cybersecurity apprenticeship scheme”
siliconangle.com
Press & Media
Announces the launch of a new cybersecurity apprenticeship program by the U.S. Departments of Labor and Commerce to help fill hundreds of thousands of open positions.
Press & Media
“New cyber apprenticeship initiative to develop & train cybersecurity workforce”
securitymagazine.com
Press & Media
Details the new federal initiative, the "Cybersecurity Apprenticeship Sprint," aimed at developing the U.S. cybersecurity workforce through registered apprenticeships.
Press & Media
“First CSRB Report Tackles on Ongoing Log4j Risk”
securityboulevard.com
Press & Media
Summarizes the first report from the Cyber Safety Review Board (CSRB), which focuses on the Log4j vulnerability and its ongoing, long-term risks to organizations.
Press & Media
“There is a cybersecurity talent gap across the US. Here's what to put on your résumé to a land high-paying job in the in…”
businessinsider.com
Press & Media
Outlines the key skills and qualifications needed for a high-paying career in cybersecurity, responding to the significant workforce shortage in the industry.
Press & Media
“There is a cybersecurity talent gap across the US. Here's what to put on your résumé to a land high-paying job in the in…”
businessinsider.in
Press & Media
Provides career advice on how to land a high-paying job in the U.S. cybersecurity industry by tailoring a résumé to highlight in-demand skills and address the talent gap.
Press & Media
“Log4j incident response within the community shows collaboration & dedication to security”
securitymagazine.com
Press & Media
Highlights the collaborative and dedicated response of the global cybersecurity community to the widespread Log4j vulnerability crisis.
Press & Media
“Crime Watch: Why Are Ransomware Attacks Intensifying?”
bankinfosecurity.com
Press & Media
A security report discussing various timely topics, including the findings from the Cyber Safety Review Board's investigation into the Log4j vulnerability.
Press & Media
“CYBER SAFETY REVIEW BOARD: EXPLOITATION OF ‘ENDEMIC’ LOG4J FLAW WILL EVOLVE”
duo.com
Press & Media
Reports on the findings of the Cyber Safety Review Board's report on Log4j, noting the flaw is an "endemic" risk and that attacker methods will continue to evolve.
Press & Media
“Security chiefs fear ‘CISO scapegoating’ following Uber-Sullivan verdict”
therecord.media
Press & Media
Discusses the alarm in the CISO community following the conviction of Joe Sullivan, with many fearing it will lead to CISOs being scapegoated for security incidents.
Press & Media
“Cybersecurity Demand is Driving Upskilling Among Technologists”
insights.dice.com
Press & Media
Discusses how the high demand for cybersecurity professionals is driving technologists in other fields to upskill and transition into security roles.
Press & Media
“Microsoft Suggests Work-Around For ‘Serious’ Follina Zero-Day”
securityboulevard.com
Press & Media
Details Microsoft's official guidance and mitigation advice for the "Follina" zero-day vulnerability found in the Microsoft Support Diagnostic Tool (MSDT).
Press & Media
“Researchers, NSA cybersecurity director warn of hackers targeting Zyxel vulnerability BriefsCybercrimeGovernmentTechnol…”
therecord.media
Press & Media
Reports on warnings from researchers and the NSA about a critical, remotely exploitable vulnerability in Zyxel firewalls that is being actively targeted by hackers.
Press & Media
“Security Pros Lured to Bug Bounties by Big Pay Days”
technewsworld.com
Press & Media
Discusses the growing appeal of bug bounty hunting as a career for security professionals, driven by the potential for large payouts and flexible work arrangements.
Press & Media
“LockBit 3.0 Ransomware Emerges With Bug Bounty Program”
securityweek.com
Press & Media
Reports on the emergence of the LockBit 3.0 ransomware operation, which took the unusual step of creating its own bug bounty program to find flaws in its own malware.
Press & Media
“There are 24.6 billion pairs of credentials for sale on dark web”
theregister.com
Press & Media
A security news roundup that includes coverage of the LockBit 3.0 ransomware-as-a-service gang and its unique bug bounty program.
Press & Media
“Former Uber security chief found guilty of covering up 2016 cyberattack”
brusselstimes.com
Press & Media
Reports that Uber's former security chief, Joe Sullivan, was found guilty of obstruction and misprision of a felony for his role in covering up a 2016 cyberattack.
Press & Media
“Two-thirds of ethical hackers considering bug bounty hunting as a full-time career”
scmagazine.com
Press & Media
Presents survey data indicating that a large majority of ethical hackers are considering pursuing bug bounty hunting as a full-time career path.
Press & Media
“Microsoft releases guidance for Office zero-day used to target orgs in Russia, India, Tibet”
therecord.media
Press & Media
Reports on Microsoft's guidance for the "Follina" zero-day Office vulnerability, which was actively used in targeted attacks against entities in Tibet, Russia, and India.
Press & Media
“How Wildcard Hacktivists and ‘Robin Hood’ Ransomware Groups Amplify Cyber Risk”
cio.economictimes.indiatimes.com
Press & Media
Discusses the amplified cyber risk from unpredictable hacktivists and "Robin Hood"-style ransomware groups who are motivated by ideology rather than just financial gain.
Press & Media
“What are the security risks of open sourcing the Twitter algorithm?”
venturebeat.com
Press & Media
Analyzes the potential security benefits and risks associated with Twitter's proposal to open-source its algorithm, including new avenues for attack and manipulation.
Press & Media
“OneTrust launches Ethics and Compliance Cloud to foster ethical work culture”
scmagazine.com
Press & Media
Announces the launch of OneTrust's "Ethics & Compliance Cloud," a software platform designed to help companies cultivate a more ethical work culture.
Press & Media
“Businesses Could Lose Money from QR Codes”
thestreet.com
Press & Media
Warns about the financial risks to businesses from malicious QR codes ("quishing") that can be used to defraud customers and damage brand reputation.
Press & Media
“Hackers Use QR Codes to Steal Your Money”
thestreet.com
Press & Media
An article alerting consumers to the growing threat of hackers using malicious QR codes to steal money and personal information through phishing attacks.
Press & Media
“Shopping for malware: $260 gets you a password stealer. $90 for a crypto-miner...”
theregister.com
Press & Media
Details the "Eternity Project," a malware-as-a-service that sells a modular toolkit of malicious software, including ransomware, stealers, and DDoS bots.
Press & Media
“Former Uber security chief convicted of covering up 2016 data breach”
washingtonpost.com
Press & Media
Reports on the conviction of Joe Sullivan, Uber's former security chief, for obstructing a Federal Trade Commission investigation into the company's security practices.
Press & Media
“Former Uber security chief convicted in hack cover-up: reports”
uk.finance.yahoo.com
Press & Media
A syndicated Reuters article reporting on the conviction of former Uber CSO Joe Sullivan for covering up a 2016 data breach.
Press & Media
“Multifactor authentication is not all it’s cracked up to be”
cybersecuritydive.com
Press & Media
Argues that while multifactor authentication is a crucial security control, it is not a "silver bullet" and has weaknesses that can be bypassed by determined attackers.
Press & Media
“DoD launches “Hack U.S." bug bounty opportunity”
securitymagazine.com
Press & Media
Announces the launch of the "Hack U.S." bug bounty program by the Department of Defense, a new opportunity for ethical hackers to help secure government assets.
Press & Media
“US Department of Defense invites hackers to help harden its security systems”
techradar.com
Press & Media
Covers the U.S. Department of Defense's new bug bounty program, "Hack U.S.," which crowdsources security testing to ethical hackers.
Press & Media
“Pentagon: We'll pay you if you can find a way to hack us”
theregister.com
Press & Media
Details the launch of the U.S. Department of Defense's "Hack U.S." bug bounty program, inviting vetted hackers to find flaws in their systems.
Press & Media
“Vast majority of IT leaders say Log4Shell was a ‘wake-up call’ for cloud security”
scmagazine.com
Press & Media
Reports on survey findings indicating that the Log4Shell vulnerability served as a major wake-up call for IT leaders, prompting them to re-evaluate their cloud security postures.
Press & Media
“Crowdsourcing in der Cybersicherheit: Gemeinsam sind wir stärker”
ibusiness.de
Press & Media
A German article discussing the implications of Elon Musk's takeover of Twitter, including potential changes to the platform's content moderation and security policies.
Press & Media
“FBI Director Warns of Chinese Espionage Threats”
securityboulevard.com
Press & Media
Covers a warning from the FBI Director about the pervasive threat of economic espionage and hacking campaigns conducted by the Chinese government against Western interests.
Press & Media
“Musk’s Twitter takeover and its security implications”
securitymagazine.com
Press & Media
Analyzes the potential security implications of Elon Musk's acquisition of Twitter, with experts weighing in on issues like bot accounts, data privacy, and content moderation.
Press & Media
“Musk Masterminds Private Twitter Takeover for $44 Billion”
ecommercetimes.com
Press & Media
Reports on the successful $44 billion deal for Elon Musk to acquire Twitter and take the company private, detailing the events that led to the agreement.
Press & Media
“Experts warn of need to patch critical cryptographic Java bug”
therecord.media
Press & Media
Details warnings from cybersecurity experts about a critical vulnerability in Java's cryptographic signing mechanism that could allow for digital signature forgery.
Press & Media
“GitHub: Stolen OAuth Tokens Used to Breach Private Repositories, Dozens of Organizations Impacted”
cpomagazine.com
Press & Media
Covers a security incident where attackers used stolen OAuth tokens to breach the private code repositories of dozens of organizations hosted on GitHub.
Press & Media
“Microsoft Pays Top Dollar for Bug Bounties”
thestreet.com
Press & Media
Reports on Microsoft rewarding ethical hackers for finding and reporting security vulnerabilities in its products through its bug bounty program.
Press & Media
“Addressing Critical Infrastructure Threats Requires Collaboration”
securityboulevard.com
Press & Media
Discusses the need for public-private collaboration to defend against cyber threats targeting critical infrastructure, referencing a joint advisory from international security agencies.
Press & Media
“Five Eyes countries warn of Russian attacks against critical infrastructure”
siliconangle.com
Press & Media
Details a joint warning from the 'Five Eyes' intelligence alliance about the threat of Russian state-sponsored cyberattacks against critical infrastructure.
Press & Media
“Threat actors that compromised two OAuth integrators could potentially penetrate cloud systems”
scmagazine.com
Press & Media
Covers a security incident where stolen OAuth tokens from Heroku and Travis-CI were used to breach private code repositories hosted on GitHub.
Press & Media
“RaidForum dismantled by joint security operation”
securitymagazine.com
Press & Media
Reports on the seizure of the notorious cybercrime marketplace RaidForums and the arrest of its administrator in a coordinated international law enforcement operation.
Press & Media
“DDoS Attacks Pepper Taiwanese Government Sites Security There are 24.6 billion pairs of credentials for sale on dark web”
infosecurity-magazine.com
Press & Media
Reports on a series of DDoS attacks that targeted Taiwanese government websites coinciding with the visit of U.S. House Speaker Nancy Pelosi.
Press & Media
“The US government called on hackers to identify vulnerabilities”
chip.com.tr
Press & Media
A Turkish article explaining that the U.S. government has begun enlisting the help of white-hat hackers to improve its security, citing the new DoD program.
Press & Media
“DoD announces launch of a new bug bounty program”
venturebeat.com
Press & Media
Reports on the new Department of Defense bug bounty program, emphasizing the government's growing collaboration with the ethical hacking community.
Press & Media
“Pen Testing: Which Skills Can Help Cybersecurity Job Seekers?”
insights.dice.com
Press & Media
An article offering career advice for cybersecurity job seekers, detailing the key penetration testing skills that are most in-demand by employers.
Press & Media
“Upstart crime site woos Raid Forums orphans”
arnnet.com.au
Press & Media
Discusses the emergence of a new cybercrime forum called "Breached," which is attempting to attract displaced members from the recently shut down RaidForums.
Press & Media
“Harnessing Neurodiversity Within Cybersecurity Teams”
securityweek.com
Press & Media
An article that explores the advantages of neurodiversity within cybersecurity teams and discusses how organizations can better recruit and support neurodivergent individuals.
Press & Media
“VMware Horizon platform pummeled by Log4j-fueled attacks”
theregister.com
Press & Media
Covers a report from Sophos about malware campaigns specifically targeting VMware Horizon servers by exploiting the Log4j vulnerability.
Press & Media
“Google Chrome Bug Actively Exploited as Zero-Day”
threatpost.com
Press & Media
Reports on the discovery of a zero-day vulnerability in Google Chrome that was being actively exploited, leading to an emergency security update.
Press & Media
“Automaker Cybersecurity Lagging Behind Tech Adoption, Experts Warn”
threatpost.com
Press & Media
Discusses the growing cybersecurity risks in the automotive industry as vehicles become more connected, suggesting that security measures are not keeping pace with technology adoption.
Press & Media
“Companies Going to Greater Lengths to Hire Cybersecurity Staff”
darkreading.com
Press & Media
Offers advice and strategies for aspiring professionals looking to accelerate their entry into the cybersecurity field and land a job.
Press & Media
“Nation-State Hackers Ramp Up Ukraine War-Themed Attacks”
darkreading.com
Press & Media
Reports on the increase of cyberattacks from nation-state actors that use phishing lures and themes related to the war in Ukraine to target their victims.
Press & Media
“Don’t ignore Spring4Shell. But there’s still no sign it’s widespread”
venturebeat.com
Press & Media
Discusses the critical "Spring4Shell" vulnerability in the popular Java Spring Framework, advising caution while noting that widespread exploitation had not yet been observed.
Press & Media
“New Platform Pushes Data, Dirty Pipe and DNS Tunnel Pollute Linux Plumbing”
linuxinsider.com
Press & Media
Discusses recent security issues impacting the Linux ecosystem, including the "Dirty Pipe" privilege escalation vulnerability and the use of DNS tunneling for malicious C2 communications.
Press & Media
“Google releases emergency security update for Chrome users after second 0-day of 2022”
therecord.media
Press & Media
Details Google's release of an emergency patch for its Chrome browser to address the second actively exploited zero-day vulnerability discovered in 2022.
Press & Media
“Hackers Are Targeting Your March Madness Bracket”
thestreet.com
Press & Media
A consumer-focused article warning about phishing scams and other cyber threats that use the annual March Madness basketball tournament as a lure.
Press & Media
“Devil-may-care Lapsus$ gang is not the aspirational brand infosec needs”
theregister.com
Press & Media
Reports on the activities of the LAPSUS$ extortion group, which targeted and successfully breached several large technology companies including Microsoft, Okta, and Nvidia.
Press & Media
“Sanctions Halt Rewards for Bug Hunters in Belarus, Russia”
bankinfosecurity.com
Press & Media
Explores the impact of international sanctions on Russia and Belarus, which have prevented bug bounty platforms from legally paying security researchers in those countries.
Press & Media
“7 old attack vectors cybercriminals still use”
csoonline.com
Press & Media
An article highlighting several old but still highly effective attack methods that cybercriminals continue to leverage successfully, such as phishing and unpatched software.
Press & Media
“SEC Proposal Would Impose Stricter Timeline for Public Companies Reporting Cyberattacks”
channelfutures.com
Press & Media
Covers a proposed rule change by the U.S. Securities and Exchange Commission (SEC) that would require public companies to report cyberattacks within four days of discovery.
Press & Media
“More on President Biden’s digital assets Executive Order. Reaction to the Strengthening American Cybersecurity Act. Resp…”
thecyberwire.com
Press & Media
A daily podcast briefing which includes a segment on Bugcrowd being designated as a CVE Numbering Authority (CNA).
Press & Media
“Vice Society Publishes LA Public School Student Data, Psych Evals”
darkreading.com
Press & Media
Reports that the ransomware group Vice Society published sensitive data stolen from the Los Angeles public school system, including psychological evaluations of students.
Press & Media
“Palo Alto: More than 100,000 infusion pumps vulnerable to 2 vulnerabilities”
zdnet.com
Press & Media
Reports on research from Palo Alto Networks that found over 100,000 medical infusion pumps were vulnerable to two significant security flaws.
Press & Media
“The internet's autoimmune problem: how ethical hackers face prosecution to this day”
cybernews.com
Press & Media
An article exploring how, despite the growth of bug bounties, ethical hackers still face the risk of legal prosecution for their research activities.
Press & Media
“Taiwan Hit By Multiple DDoS Attacks Following Arrival of Pelosi”
itsecurityguru.org
Press & Media
Covers the wave of DDoS attacks that hit Taiwan as U.S. House Speaker Nancy Pelosi arrived for a high-profile visit.
Press & Media
“Zero-Day Remote Code Execution Vulnerability Found in Microsoft Office; No Patch Yet, But Possible Fix Available”
cpomagazine.com
Press & Media
Reports on the "Follina" zero-day vulnerability in Microsoft Office, explaining the remote code execution risk and the workarounds available before a patch was released.
Press & Media
“Third-Party Risk Could Cost E-Commerce Sites Millions”
ecommercetimes.com
Press & Media
Explores the significant financial risks that third-party software and supply chain vulnerabilities pose to e-commerce businesses.
Press & Media
“Ukraine deserves an IT army. We have to live with the fallout”
venturebeat.com
Press & Media
Analyzes the formation of Ukraine's volunteer "IT Army" in response to the Russian invasion and discusses the potential long-term risks and consequences of state-endorsed hacktivism.
Press & Media
“Supply chain integration issues costing 38% of companies $500,000 or more a year”
scmagazine.com
Press & Media
Reports on research finding that supply chain integration problems are causing significant financial losses, with 38% of companies losing over $500,000 annually.
Press & Media
“Whether Ukraine is in a ‘cyberwar’ or not, it’s getting bad”
venturebeat.com
Press & Media
Discusses the escalating cyber conflict surrounding the Russo-Ukrainian War, including the involvement of hacktivist groups and widespread DDoS attacks.
Press & Media
“Ukraine-Russia Cyber Warzone Splits Cyber Underground”
threatpost.com
Press & Media
Analyzes the geopolitical divisions emerging within the cybercriminal underground as a result of the Russia-Ukraine war, with many ransomware groups and forums taking sides.
Press & Media
“How to Avoid Being Hacked By the Russians”
thestreet.com
Press & Media
Offers general cybersecurity advice and best practices for individuals and businesses to protect themselves from potential Russian-sponsored cyber threats.
Press & Media
“Chipmaker Nvidia Suffers a Major Blow”
thestreet.com
Press & Media
Reports on the significant data breach suffered by the chipmaker Nvidia, where the LAPSUS$ hacking group claimed to have stolen one terabyte of proprietary data.
Press & Media
“What You Can Do to Protect Yourself From a Cyberattack”
nbcbayarea.com
Press & Media
A local news segment providing the general public with practical tips on how to protect their personal information and devices from cyberattacks.
Press & Media
“Cybercriminals Have yet to Exploit Russia-Ukraine Tensions”
securityboulevard.com
Press & Media
An article from late February 2022 observing that, at the time, there had not yet been a widespread wave of cybercriminal activity explicitly exploiting the Russia-Ukraine conflict.
Press & Media
“Skyrocketing cryptocurrency bug bounties expected to lure top hacking talent”
csoonline.com
Press & Media
Discusses the trend of cryptocurrency and Web3 companies offering massive bug bounty rewards, which is effectively attracting top-tier security talent to the space.
Press & Media
“New Zealand government mandates bug reporting process for federal agencies”
portswigger.net
Press & Media
Reports on a new policy in New Zealand that mandates government agencies to establish an official, coordinated process for receiving vulnerability reports from security researchers.
Press & Media
“Microsoft Win32k bug added to CISA's exploited vulnerabilities list”
zdnet.com
Press & Media
Covers CISA's decision to add a privilege escalation vulnerability in Microsoft's Win32k component to its list of known exploited bugs that federal agencies must patch.
Press & Media
“The teenage hackers paid millions to expose corporations’ weak spots”
telegraph.co.uk
Press & Media
A feature article on the growing trend of corporations paying large sums of money, often to young or teenage ethical hackers, through bug bounty programs to find security flaws.
Press & Media
“42 Gears’ SureMDM platform was potentially open to supply chain attack”
scmagazine.com
Press & Media
Covers the discovery of several vulnerabilities in the 42Gears SureMDM platform that, if exploited, could have led to a supply chain attack against its customers.
Press & Media
“Why Ransomware Remains Top Priority for IT and Security Pros”
insights.dice.com
Press & Media
An article explaining why ransomware continues to be a top concern for IT and security professionals, citing its potential for widespread disruption and financial damage.
Press & Media
“Vulnerability Disclosures Rise to Meet Federal Requirements”
securityboulevard.com
Press & Media
Discusses how vulnerability disclosure programs are increasing in response to U.S. federal requirements, such as CISA's directive for agencies to have a clear process for receiving vulnerability reports.
Press & Media
“Moncler discloses data breach. Ransomware in the public and not-for-profit sectors. Vulnerability trends. Pegasus update…”
thecyberwire.com
Press & Media
This privacy news briefing includes a segment on a Bugcrowd report which found a significant rise in serious vulnerabilities targeting the financial sector.
Press & Media
“Bugcrowd reports increase in critical vulnerabilities found in 2021”
zdnet.com
Press & Media
Covers a Bugcrowd report indicating a 185% increase in high-risk vulnerabilities discovered within the financial services industry in 2021.
Press & Media
“Bugcrowd Reports 185% Increase in High-Risk Vulnerabilities within Financial Sector”
prnewswire.com
Press & Media
The official press release from Bugcrowd announcing their report's findings of a 185% increase in high-risk vulnerabilities targeting the financial services industry.
Press & Media
“185% increase in high-risk vulnerabilities within financial sector”
securitymagazine.com
Press & Media
Details the Bugcrowd report that found a 185% increase in critical vulnerabilities in the financial sector, linking it to the sector's rapid digital transformation.
Press & Media
“Bugcrowd: Financial services companies saw 185% increases in serious attacks”
siliconangle.com
Press & Media
This article highlights Bugcrowd's findings that financial services companies saw a 185% increase in high-risk vulnerability submissions, pointing to escalated threats.
Press & Media
“US Search for Vulnerabilities Drives 10x Increase in Bug Reports”
darkreading.com
Press & Media
Reports on data from Bugcrowd showing a tenfold increase in vulnerability submissions from U.S.-based hackers, indicating significant growth in the domestic bug hunting community.
Press & Media
“Bugcrowd Reports 185% Increase in High-Risk Vulnerabilities within Financial Sector”
pressreleases.responsesource.com
Press & Media
A press release announcing Bugcrowd's report on the 185% increase in high-risk vulnerabilities within the financial sector, based on their platform's data.
Press & Media
“Log4Shell Vulnerability Highlights Software Supply Chain Issues”
datacenterknowledge.com
Press & Media
An article explaining how the Log4Shell vulnerability brought mainstream attention to the significant security issues present in the software supply chain.
Press & Media
“How digital bounty hunters search for software bugs—and money”
popsci.com
Press & Media
An explainer article on what bug bounty programs are, how they work, and why they have become an important part of the cybersecurity ecosystem.
Press & Media
“Your Thumbprint or Selfie Can Be Used to Get Into a Football Game Faster”
thestreet.com
Press & Media
An article exploring the future use of biometric technology for ticketing, payments, and personalized experiences at sports and entertainment venues.
Press & Media
“More than 80 CFOs push back on sustainability reporting”
fortune.com
Press & Media
Reports that over 80 Chief Financial Officers have pushed back against new sustainability reporting rules proposed by the SEC.
Press & Media
“Researchers Discover H2 Database Flaw Similar to Log4Shell”
bankinfosecurity.com
Press & Media
Details the discovery of a critical remote code execution vulnerability in the H2 database console, which is architecturally similar to the infamous Log4Shell flaw.
Press & Media
“JFrog researchers find JNDI vulnerability in H2 database consoles similar to Log4Shell”
zdnet.com
Press & Media
Covers the discovery of a critical JNDI vulnerability in H2 database consoles by JFrog researchers, which is comparable in risk to the Log4Shell vulnerability.
Press & Media
“6 'nightmare' cloud security flaws were found in Azure in the last year. Does Microsoft have work to do?”
protocol.com
Press & Media
An analysis of significant security flaws discovered in Microsoft Azure, highlighting the complex challenges of securing large-scale public cloud platforms.
Press & Media
“US export ban on hacking tools tweaked after public consultation”
portswigger.net
Press & Media
Explains how the U.S. Commerce Department revised its rules on the export of hacking tools after receiving significant feedback and criticism from the security community.
Press & Media
“Don't mess with Texas (election results)”
washingtonpost.com
Press & Media
Discusses the results and security of the Texas primary elections, including the state's efforts to audit the results and address concerns about election integrity.
Press & Media
“LA County Metro offers free mobile security app for citizens using public Wi-Fi”
scmagazine.com
Press & Media
Details the initiative by the Los Angeles County Metropolitan Transportation Authority to provide a free mobile security app for riders to use on its public Wi-Fi network.
Press & Media
“Cryptomining campaign launched 125 attacks in the wild in Q3 2021”
scmagazine.com
Press & Media
Details a cryptomining campaign that launched 125 attacks in the third quarter of 2021, aiming to hijack victims' computer resources for mining cryptocurrency.
Press & Media
“Patching Log4j to version 2.17.1 can probably wait”
venturebeat.com
Press & Media
An article from December 2021 advising that patching Log4j to version 2.17.1, which fixed a less severe bug, could likely wait for organizations that had already applied earlier critical patches.
Press & Media
“Microsoft launches new Defender capabilities for fixing Log4j”
venturebeat.com
Press & Media
Announces new features in Microsoft Defender for Endpoint designed to help security teams identify and remediate systems vulnerable to Log4j flaws.
Press & Media
“Log4j, again, needs patching as new bug is found and squashed”
scmagazine.com
Press & Media
Reports on the discovery of another denial-of-service vulnerability in the Log4j library, which necessitated a further round of patching for affected systems.
Press & Media
“Global Cyberattacks from Nation-State Actors Posing Greater Threats”
threatpost.com
Press & Media
Discusses the rising tide of global cyberattacks in 2021 and highlights the ongoing, sophisticated threats posed by nation-state hacking groups.
Press & Media
“Beware of cryptominers when torrenting 'Spider-Man: No Way Home'”
zdnet.com
Press & Media
Warns that illegal torrents of the movie "Spider-Man: No Way Home" were being distributed with hidden cryptomining malware.
Press & Media
“Bug bounty platforms handling thousands of Log4j vulnerability reports”
portswigger.net
Press & Media
Covers how bug bounty platforms were flooded with thousands of submissions from security researchers who had identified systems vulnerable to the Log4j flaw.
Press & Media
“White House convenes open-source security summit amid Log4j risks”
livemint.com
Press & Media
Reports on a White House summit with tech industry leaders to address the security of open-source software, prompted by the Log4j vulnerability crisis.
Press & Media
“Log4j exploit takes down Ministry of Defense email servers in Belgium”
scmagazine.com
Press & Media
Details how an exploit for the Log4j vulnerability was used to successfully compromise and disable the email servers of Belgium's Ministry of Defense.
Press & Media
“With Log4j vulnerability, the full impact has yet to come”
venturebeat.com
Press & Media
Published soon after the Log4j disclosure, this article warns that the full impact of the flaw would likely be felt over a long period as attackers continue to find vulnerable systems.
Press & Media
“Log4Shell: A perfect storm that’s easy to exploit and goes viral in a hurry”
scmagazine.com
Press & Media
An analysis piece describing why the Log4Shell vulnerability created a "perfect storm" due to its ease of exploitation and widespread presence in software.
Press & Media
“Apache’s Fix for Log4Shell Can Lead to DoS Attacks”
threatpost.com
Press & Media
Reports on a patch released by Apache to fix a denial-of-service vulnerability in Log4j, which was discovered after the initial Log4Shell remote code execution flaw.
Press & Media
“DHS Launches Bug Bounty Program”
infosecurity-magazine.com
Press & Media
Announces the first-ever bug bounty program from the Department of Homeland Security, called "Hack DHS," to proactively identify vulnerabilities.
Press & Media
“Bug hunt bounty: Feds to offer up to $5,000 to identify cyber weak spots”
wraltechwire.com
Press & Media
Reports on the launch of the "Hack DHS" bug bounty program by the U.S. federal government, offering rewards for finding security weaknesses.
Press & Media
“Log4Shell Malware Vulnerability Vaccine Helps Protect Users that Could Not Update Yet”
techtimes.com
Press & Media
Discusses efforts by security researchers to develop a "vaccine" that could inoculate systems against the Log4Shell vulnerability before they could be exploited.
Press & Media
“Here We Go Again: Second Log4j Flaw Surfaces”
securityboulevard.com
Press & Media
Details the discovery of a second vulnerability in Log4j (CVE-2021-45046), which emerged shortly after the initial disclosure and required additional patching.
Press & Media
“Chinese Researchers Discover EwDoor Botnet Affecting up to 100,000 AT&T VoIP Servers”
cpomagazine.com
Press & Media
Reports on the discovery of a new botnet named "EwDoor" by Chinese security researchers, which targets AT&T VoIP servers and has potentially infected up to 100,000 devices.
Press & Media
“How Do I Find My Servers With the Log4j Vulnerability?”
darkreading.com
Press & Media
Provides technical advice and methods for system administrators on how to identify which of their servers are vulnerable to the Log4j flaw.
Press & Media
“Bug-Bounty Programs Shift Focus to Most Critical Flaws”
darkreading.com
Press & Media
Analyzes how bug bounty programs are evolving to focus more on, and provide higher payouts for, the most critical and impactful security vulnerabilities.
Press & Media
“With 18,378 vulnerabilities reported in 2021, NIST records fifth straight year of record numbers”
zdnet.com
Press & Media
Highlights a NIST report showing that a record number of vulnerabilities were discovered in 2021, marking the fifth consecutive year of record-breaking numbers.
Press & Media
“Arrest Points to Ubiquiti Breach Being an Inside Job”
bankinfosecurity.com
Press & Media
Reports on the arrest of a former Ubiquiti employee who was charged with orchestrating a data breach and extortion attempt against the company.
Press & Media
“Searching for Bugs in Open Source Code”
securityboulevard.com
Press & Media
An article exploring the challenges and critical importance of proactively searching for and remediating security vulnerabilities in open-source software projects.
Press & Media
“300,000 banking Trojan infections from Google Play in 4 months”
securitymagazine.com
Press & Media
Reports on a wave of banking trojan infections originating from malicious apps on the Google Play Store, resulting in over 300,000 infections in four months.
Press & Media
“CTO Talk: Q&A with Bugcrowd’s Casey Ellis”
verdict.co.uk
Press & Media
An interview with Casey Ellis, founder and CTO of Bugcrowd, where he discusses the evolution of cybersecurity and the role of crowdsourced security.
Press & Media
“Q&A: Casey Ellis”
duo.com
Press & Media
A Q&A session with Casey Ellis on Duo Security's blog, covering topics such as the history of bug bounties and the future of vulnerability disclosure.
Press & Media
“Malicious Golang program attacks e-commerce servers”
scmagazine.com
Press & Media
Reports on a new malware written in the Go programming language that is specifically designed to attack e-commerce servers, likely to steal payment information.
Press & Media
“Digital Bounty Hunters Want To Help Businesses Track Down”
forbes.com
Press & Media
Discusses the emerging field of using bug bounty models to identify and mitigate bias and discrimination in artificial intelligence algorithms.
Press & Media
“U.S. Government Details Federal Agency Incident Response”
duo.com
Press & Media
Covers new directives from the U.S. government that establish clearer playbooks and requirements for how federal civilian agencies must respond to cybersecurity incidents.
Press & Media
“Ethical Hackers Stymie $27bn of Cybercrime”
infosecurity-magazine.com
Press & Media
Reports on research estimating that the work of ethical hackers has prevented over $27 billion in cybercrime damages over a one-year period.
Press & Media
“CISA releases advisory on five Apache HTTP server vulnerabilities affecting Cisco products”
zdnet.com
Press & Media
Covers a CISA advisory that warns about five vulnerabilities in the Apache HTTP Server and urges administrators to apply the necessary patches.
Press & Media
“2021 marks another record year for security vulnerabilities”
techrepublic.com
Press & Media
Discusses the trend of increasing vulnerability disclosures, noting that 2021 set another record for the total number of security flaws reported.
Press & Media
“CISA launches platform to let hackers report security bugs to US federal agencies”
techcrunch.com
Press & Media
Reports on the launch of CISA's vulnerability disclosure platform, developed in partnership with Bugcrowd, to streamline the reporting of bugs in federal systems.
Press & Media
“Uprising in the Valley: When Bug Bounties Went Boom, Part Two”
duo.com
Press & Media
The second part of a feature series detailing the history of bug bounty programs and their rapid growth and adoption in Silicon Valley.
Press & Media
“Delving into the 'how and why' of the latest healthcare data breach”
digitaljournal.com
Press & Media
An analysis of a recent data breach in the healthcare sector, exploring the methods used by the attackers and the reasons behind the security failure.
Press & Media
“Microsoft Power Apps Platform Exposes Millions of Users Across Apps”
solutionsreview.com
Press & Media
Reports on a misconfiguration in Microsoft's Power Apps platform that inadvertently exposed the data of millions of users across various applications.
Press & Media
“15 Often-Overlooked Risks To Digital Assets In The Remote Work Era”
forbes.com
Press & Media
A Forbes Technology Council expert panel, including Casey Ellis, discusses 15 commonly overlooked security risks associated with the shift to remote work.
Press & Media
“Ransomware attack Kaseya”
globalsecuritymag.com
Press & Media
Features expert commentary from Casey Ellis of Bugcrowd, who provides his analysis of the Kaseya supply chain ransomware attack.
Press & Media
“As Australia counts cost of Kaseya attack, should industry be doing more?”
csoonline.com
Press & Media
Discusses the impact of the Kaseya ransomware attack on Australian businesses and raises questions about the security responsibilities of the broader software industry.
Press & Media
“Developments in the Kaseya ransomware attack: recovery and response.”
thecyberwire.com
Press & Media
Provides an update on the recovery and response efforts following the major Kaseya VSA ransomware supply chain attack.
Press & Media
“Supreme Court Decision on Van Buren Case Restricts Excesses of CFAA, Is a Boon for Cybersecurity Research”
cpomagazine.com
Press & Media
Analyzes the U.S. Supreme Court's decision in Van Buren v. United States, which narrowed the scope of the CFAA and was seen as a positive development for security researchers.
Press & Media
“CISA taps Bugcrowd for federal vulnerability disclosure program”
searchsecurity.techtarget.com
Press & Media
Covers the announcement that CISA has selected Bugcrowd to provide the platform for its new vulnerability disclosure program for federal agencies.
Press & Media
“Top 5 Bug Bounty Platforms to Watch in 2021”
thehackernews.com
Press & Media
A feature article highlighting five of the top bug bounty programs for security researchers to watch and participate in for the year.
Press & Media
“Hackers vs. lawyers: Security research stifled in key situations”
searchsecurity.techtarget.com
Press & Media
Discusses how the threat of legal action under laws like the CFAA can stifle important security research and prevent the disclosure of vulnerabilities.
Press & Media
“Combating Ransomware: Lawmaker Wants Spies 'Hacking Back'”
bankinfosecurity.com
Press & Media
An analysis of whether taking offensive cyber actions against ransomware gangs could be an effective strategy to disrupt their operations.
Press & Media
“Healthcare breaches and data exposures. Is compliance with privacy regulations motivated by fear of fines?”
thecyberwire.com
Press & Media
A privacy news briefing from The CyberWire that likely includes a segment on the Kaseya ransomware attack and its implications for data privacy.
Press & Media
“Georgia Fertility Clinic Hit by Ransomware: Expert Commentary”
solutionsreview.com
Press & Media
Reports on a ransomware attack that targeted a Georgia fertility clinic and includes commentary from security experts on the incident.
Press & Media
“Businesses must bank on secure future”
afr.com
Press & Media
An opinion piece arguing that Australian businesses must make cybersecurity a top priority to secure their future in an increasingly hostile digital environment.
Press & Media
“A Q&A with Crowdsourcing Cybersecurity Firm Bugcrowd’s Founder and Chairman, Casey Ellis”
crowdsourcingweek.com
Press & Media
A Q&A interview with Casey Ellis, founder and chairman of Bugcrowd, where he discusses the crowdsourced security model and the bug bounty industry.
Press & Media
“Taking on SOAR: The Challenges and Opportunities”
bankinfosecurity.com
Press & Media
Explores the challenges and opportunities associated with implementing Security Orchestration, Automation and Response (SOAR) technologies in organizations.