SAP on Tuesday released its security updates for August 2018. The latest round of updates includes over two dozen patches, but none of them are for critical (hot news) vulnerabilities.
http://feedproxy.google.com/~r/Securityweek/~3/hCr7GFhy6fU/sap-releases-august-2018-security-updates
The details of three new speculative execution vulnerabilities affecting Intel Xeon and Core processors were disclosed on Tuesday. The flaws have been dubbed Foreshadow and L1 Terminal Fault (L1TF), and patches and mitigations are already available.
http://feedproxy.google.com/~r/Securityweek/~3/WmLbSbDCOSU/foreshadowl1tf-what-you-need-know
Microsoft’s Patch Tuesday updates for August 2018 address 60 vulnerabilities, including two zero-day flaws affecting Windows and Internet Explorer.
http://feedproxy.google.com/~r/Securityweek/~3/979NF5TcrSM/microsoft-patches-zero-day-flaws-windows-internet-explorer
Researchers and several major tech companies on Tuesday disclosed the details of three new speculative execution side-channel vulnerabilities affecting Intel processors.
http://feedproxy.google.com/~r/Securityweek/~3/MhaZ4FjuRiA/foreshadow-new-speculative-execution-flaws-found-intel-cpus
Vulnerability Allows a Second Factor for One Account to be Used for All Accounts in an Organization
http://feedproxy.google.com/~r/Securityweek/~3/lPClaAiSdEw/vulnerability-could-allow-insider-bypass-ceos-multi-factor-authentication
The Patch Tuesday updates released by Adobe for August 2018 address nearly a dozen vulnerabilities in Flash Player, the Creative Cloud Desktop Application, Experience Manager, and Acrobat and Reader.
http://feedproxy.google.com/~r/Securityweek/~3/89iVIWeptEg/adobe-patches-11-flaws-across-four-products
A team of researchers has disclosed the details of a new attack method that can be used to crack encrypted communications. The products of several vendors, including Cisco, Huawei, ZyXEL and Clavister, are impacted.
http://feedproxy.google.com/~r/Securityweek/~3/hoQfl-_pJdY/crypto-flaw-affects-products-cisco-huawei-zyxel
The U.S. Department of Defense on Monday announced the launch of “Hack the Marine Corps,” the Military’s sixth bug bounty program.
Similar to previous programs run by the Pentagon, Hack the Marine Corps is hosted by bug bounty platform HackerOne.
http://feedproxy.google.com/~r/Securityweek/~3/clV5MyzX1mk/dod-launches-hack-marine-corps-bug-bounty-program
An industrial router made by Australian telecommunications equipment company NetComm Wireless is affected by several serious vulnerabilities that can be exploited remotely to take control of affected devices.
http://feedproxy.google.com/~r/Securityweek/~3/PQPBJS6zXOk/critical-flaws-found-netcomm-industrial-routers
Patch management has always been an evergreen topic for security practitioners. Each time poor patching is identified as the root cause of a breach, it triggers a new flood of opinions on the countless dos and don’ts of triaging common vulnerabilities and exposures (CVEs), understanding criticality scores, and deploying patches. Often left out of the conversation, however, is an especially crucial variable: risk.
http://feedproxy.google.com/~r/Securityweek/~3/NEaOdCIWe2o/effective-patch-management-don%E2%80%99t-overlook-risk