A team of researchers has described seven new variants of the notorious Meltdown and Spectre attacks, and they claim some of these methods are not mitigated by existing patches, but Intel disagrees.
http://feedproxy.google.com/~r/Securityweek/~3/uIyApYbGXmM/researchers-disclose-7-new-meltdown-spectre-attacks
The Zero Day Initiative’s Pwn2Own Tokyo hacking competition has come to an end, with participants earning over $300,000 for disclosing vulnerabilities affecting iPhone X, Xiaomi Mi 6 and Samsung Galaxy S9 smartphones.
http://feedproxy.google.com/~r/Securityweek/~3/ZhE0XNhf1ig/iphone-x-exploits-earn-hackers-over-100000
Siemens on Tuesday released 7 new advisories to inform customers of potentially serious vulnerabilities affecting various SIMATIC and SCALANCE products. Patches and/or mitigations are available for all impacted products.
http://feedproxy.google.com/~r/Securityweek/~3/e9aEWsaT2mM/siemens-releases-7-advisories-simatic-scalance-vulnerabilities
Microsoft’s Patch Tuesday updates for November 2018 address more than 60 vulnerabilities, including zero-days and publicly disclosed flaws.
http://feedproxy.google.com/~r/Securityweek/~3/3uNYUq_N5vo/microsoft-patches-actively-exploited-windows-vulnerability
Adobe has released Patch Tuesday updates for Flash Player, Acrobat and Reader, and Photoshop CC to address three vulnerabilities – one in each product.
http://feedproxy.google.com/~r/Securityweek/~3/5eL1geZjDso/adobe-patches-disclosed-acrobat-vulnerability
SAP this week published its November 2018 set of security patches, which include 11 new Security Patch Day Notes, along with 3 updates for previously released notes.
http://feedproxy.google.com/~r/Securityweek/~3/ubv8Qe87ukI/sap-patches-critical-vulnerability-hana-streaming-analytics
A security researcher from Tenable, Inc. recently discovered that it is possible to bypass Windows’ User Account Control (UAC) by spoofing the execution path of a file in a trusted directory.
http://feedproxy.google.com/~r/Securityweek/~3/xwK42jzeEAw/researcher-bypasses-windows-uac-spoofing-trusted-directory
A critical security flaw affecting a GDPR compliance plugin for WordPress has been exploited in the wild to take control of vulnerable websites, users have been warned.
http://feedproxy.google.com/~r/Securityweek/~3/ZwVu_esgjkM/hackers-exploit-flaw-gdpr-compliance-plugin-wordpress
A malicious group known as the “Inception” attackers has been using a year-old Office exploit and a new backdoor in recent attacks, Palo Alto Networks security researchers warn.
http://feedproxy.google.com/~r/Securityweek/~3/60OdUrHRO8w/inception-attackers-combine-old-exploit-and-new-backdoor
VMware informed customers on Friday that patches are available for a critical virtual machine (VM) escape vulnerability disclosed recently by a researcher at the GeekPwn2018 hacking competition.
http://feedproxy.google.com/~r/Securityweek/~3/qorDHPCXe_c/vmware-patches-vm-escape-flaw-disclosed-chinese-hacking-contest