Notable headlines: Ryan Naraine: Researchers borrow from Google PageRank for network defense service Attack code published for DNS flaw Nate McFeters: |)ruid and HD Moore...

My PhD thesis “Covert channel vulnerabilities in anonymity systems” has been awarded this year’s best thesis prize by the ERCIM security and trust...

Several days after blogging about a research conduced by n.runs AG that managed to discover approximately 800 vulnerabilities in antivirus products, McAfee issued a...

This just in from 0x000000 # The Hacker Webzine via Ben Forta's blog: an article that is both called and about Attacking ColdFusion. I find this to be very significant...

I just came across this post on Guya.net (which linked to this)and figured I’d help get the word out. Apparently the Windows XP SP3 update downgrades your Flash...

Delightful to see Sony CEO Sir Howard Stringer getting called on the carpet by Walt Mossberg for Sony's status as the industry leader in craplets.  I bought one of...

So, in a threaded comment-ango on Friendfeed today, I noticed an odd comment by a Friendfeedster that seemed out of place.� So out of place, it almost smelled …...

In this article, you'll learn about Ajax security tools, which you'll be using to scan for SQL injection and cross-site scripting vulnerabilities; to set a master...

This is Tami Gallupe, MSRC Release Manager, and I want to let you know that we just posted our May 2008 Bulletins. We released four bulletins today, which include three...

The most widely used open source software packages for the enterprise are exposing users to significant and unnecessary business risks, according to an open source...

As I� said in the previous post, the students from Ruhr Universitat who are claiming discovery of� security vulnerabilities in CardSpace did NOT “crack”...

A recent ZDnet blog discusses a large number of vulnerabilities German research team N.Runs says it found in antimalware products from nearly every vendor. The ZDNet...

It's time once again for monthly updates from Microsoft.Microsoft Office Word and Publisher reportedly have Remote Code Execution vulnerabilities which could be exploited...

More details coming out on the Oracle patches that were released last week, see Ryan Naraine's write up here.� David Litchfield, noted security researcher from...

ratproxy. “A semi-automated, largely passive web application security audit tool”—watches you browse and highlights potential XSS, CSRF and other vulnerabilities in...

Hi there this is Bill Sisk. There have been conflicting public reports describing a recent rash of web server attacks. I want to bring some clarification about the...

How did two vulnerabilities in the widely used Spring Framework remain hidden for so long? And what are the security implications for single-vendor-driven open source...

Skinny: upcoming Flash Player update may break sites that use Flash to talk cross-domain, via sockets, or to the hosting html, especially via javascript:. Also affected...

Mark Cox, security guru and star of our recent video series, posts his yearly, official risk report, a comprehensive evaluation of the metrics, vulnerabilities, and best...

Let's say that you want to phish for PayPal accounts. One might attempt to register something such as paypol-sevice.com. But that's too obvious and is likely to be...