WordPress 2.6 disables remote access, swats 194 bugs   15 Jul 2008 10:55 GMT
WordPress, one of the fastest growing blog software providers, has shipped a new update with fixes for nearly 200 bugs and a major security-related change to disable remote publishing protocols by default. With WordPress 2.6, the open-source software promises to be more secure out-of-the-box with full SSL...
Source: ZDNet

Symantec says Microsoft Access ActiveX attacks to increase   15 Jul 2008 04:49 GMT
Symantec has reported that the Neosploit toolkit has been updated to include attack vectors for the recent Microsoft Access ActiveX vulnerability.  Neosploit is a toolkit for sale on the market (price estimates fall between $1500-$3000) that seeks to automate and extend the capability of browser exploits. Symantec...
Source: ZDNet

Remote code execution through Intel CPU bugs   15 Jul 2008 04:32 GMT
Kris Kaspersky, author of numerous books on reverse engineering and software engineering, will be presenting his research on remote code execution through Intel CPU bugs at the upcoming Hack in the Box Security Conference in Malaysia. If his proof of concept code consisting of JavaScript or TCP/IP packet attacks on...
Source: ZDNet

Amanda Chapel, aka "Strumpette," needs some tough love   15 Jul 2008 03:37 GMT
I had a strange Twitter back-and-forth with "Amanda Chapel," the pseudonymous authors of a PR blog called "Strumpette," about the nature of the hacker ethic. I personally don't think the hacker ethic is very effective as a counterpoint to the system of intellectual property it decries, because hackers seem intent...
Source: ZDNet

XSS worm at Justin.tv infects 2,525 profiles   14 Jul 2008 19:58 GMT
A XSS worm was crawling across Justin.tv, the popular lifecasting platform at the end of June, details of the incident emerged in the middle of last week. Basically, the group that found the XSS vulnerability abused it for the purpose of generating the following graph as a proof of concept,...
Source: ZDNet

On deck from Oracle: 45 critical database, server patches   14 Jul 2008 16:40 GMT
Database server giant Oracle plans to ship patches for a total of 45 security vulnerabilities on Thursday (July 17), bringing the vulnerability count for 2008 to a whopping 112. Since January 2006 this CPU included, Oracle has shipped fixes for a total of  572 vulnerabilities. ...
Source: ZDNet

Unpatched Windows PCs fall to hackers in under 5 minutes, says ISC   14 Jul 2008 13:00 GMT
Hackers can find and compromise an unpatched Windows PC in less than five minutes after it's connected to the Internet, the SANS Institute's Internet Storm Center said today.

Source: Computerworld

Berlin subway ticket machines go down   14 Jul 2008 11:48 GMT
Another travel related failure... Ticket dispensers in the Berlin subway system stopped working on July 1 after a faulty update from central HQ. From Berliner Morgenpost (German translation by Debora Weber-Wulff in Risks Digest): More than 600 of the 700 ticket machines...
Source: ZDNet

DNS Hole Doesn't Go Unnoticed   14 Jul 2008 04:28 GMT
A security flaw in the DNS protocol didn't get Microsoft's top severity rating when the company and other vendors issued patches for it. But that belies the amount of attention being paid to the cache-poisoning vulnerability.

Source: Computerworld

Fix DNS Now   14 Jul 2008 04:28 GMT
Frankly Speaking: A major flaw in the Internet's infrastructure has been found, and a fix is ready. Make that fix now. Don't wait one second, warns Frank Hayes.

Source: Computerworld