Web Security

UPDATE – Researchers at security consultancy and vulnerability research firm DefenseCode claim to have uncovered a root exploit zero-day affecting the default installation of an unknown number of Cisco’s Linksys routers.

Google is continuing to introduce new security technologies in its Chrome browser, and the latest addition on the horizon is support for unprefixed Content Security Policy, a behind-the-scenes improvement designed to prevent malicious script injections. The technology is included in the beta of Chrome 25, which was released earlier this week, and will soon find its way into the stable channel.

Twitter has been collecting a lot of security talent in the last year or so, but now a major piece of the company’s security team is leaving. Moxie Marlinspike, the creative security and privacy researcher who founded Whisper Systems, which was acquired by Twitter in 2011, said on Friday that he is leaving the company.

Google patched nearly two dozen security vulnerabilities in Chrome on Thursday and a day later attackers have begun circulating fake Google Chrome updates that actually are part of a scam related to the Zeus botnet and is designed to steal online banking credentials, among other things.

Google has patched a huge number of security vulnerabilities in its Chrome browser, fixing 11 high-severity flaws. The release of Chrome 24 also includes patches for a number of other lower-priority vulnerabilities.

A vulnerability exists in the latest build of Foxit Reader, a PDF reader produced by the Foxit Corp., that could allow an attacker to inject malicious code into documents.

Just two days after the disclosure of a string of serious vulnerabilities in Ruby on Rails, researchers have released proof-of-concept exploit code for a couple of the flaws and the team at Metasploit have released a module for the penetration testing framework that exploit one of the bugs, as well.