PHP.net compromised to serve malware

Friday, October 25th, 2013

On Thursday, Google's Safe Browsing service began warning visitors to php.net that the website was discovered serving malware. Initially, most people and PHP maintainers thought that it was a false positive, but subsequent investigation confirmed that some of the project's servers did get compromised. The hackers succeeded in injecting malicious JavaScript code (userprefs.js) ...

Critical Internet Explorer exploit code released in the wild

Tuesday, October 1st, 2013

Attack code that exploits a critical vulnerability in all supported versions of Microsoft's Internet Explorer browser has been publicly released. Monday's release of a module for the Metasploit exploit framework used by security professionals and hackers could broaden the base of attackers who are capable of targeting the flaw. Until now, the bug ...

Hackers Target Java 6 With Security Exploits

Tuesday, August 27th, 2013

Warning to anyone still using Java 6: Upgrade now to Java 7 to avoid being compromised by active attacks. That alert came via F-Secure anti-malware analyst Timo Hirvonen, who reported finding an in-the-wild exploit actively targeting an unpatched vulnerability in Java 6 following the recent publication of related proof-of-concept (POC) attack ...

Microsoft: Upgrade from Windows XP or risk infinite “zero-days”

Monday, August 19th, 2013

Microsoft is intensifying its efforts asking users to scrap Windows XP, the 12-year-old operating system for which the software giant is ending support next April. Tim Rains, director of Microsoft Trustworthy Computing, authored a blog post last week reminding customers of the perils that could await them should they continue running XP, which ...

TOR Project: Stop using Windows, disable JavaScript

Tuesday, August 6th, 2013

The TOR Project is advising that people stop using Windows after the discovery of a startling vulnerability in Firefox that undermined the main advantages of the privacy-centered network. The zero-day vulnerability allowed as-yet-unknown interlopers to use a malicious piece of JavaScript to collect crucial identifying information on computers visiting some websites ...