Unprecedented computer-chip vulnerabilities exposed this month paint a grim picture of the future of cybersecurity.

When major security vulns go live without warning, competitors suddenly band together.

It was late November and former Intel Corp. engineer Thomas Prescher was enjoying beers and burgers with friends in Dresden, Germany, when the conversation turned, ominously, to semiconductors.

This week, I've been writing up my 5-part guide on "Fixing Data Breaches". On Monday I talked about the value of education; let's try and stop the breach from happening in the first place. Then yesterday it was all about reducing the impact of a breach, namely by

In 2017, bugs banned people from Twitter, secretly recorded them in their homes, and even caused a train crash. Is there anything they can’t do?

Popular drone maker DJI has bungled its bug bounty program — and a very public spat could have repercussions for the growing freelance industry.

A vulnerability was discovered today in Apple's laptops that allows you to log into a root account with no password. I am not 100% sure what Responsible

Vulnerabilities: keep them secret as a weapon against the bad guys or tell the world so we can all get patched?

Cybersecurity start-up claims flaws allow access to people’s video feeds

Bug hunters are educated, young, looking for challenge—and cash to feed security habit.

Actually a pretty good analogy to buffer overflows.

Starting with the 1988 Morris Worm, this flaw has bitten everyone from Linux to Windows.

More and more countries are joining the United States in adopting a policy of weighing the pros and cons of responsible vulnerability disclosure, as the public calls for more clarity regarding intelligence agencies and their supposed hoarding of previously undiscovered software flaws. The U.S. started using its own Vulnerability Equities Process in 2010, according to declassified documents, although it didn’t reveal the VEP publicly until 2014 — to help allay suspicions that the National Security Agency might have secretly known about the massive HeartBleed vulnerability. Now, other democracies are following suit, but it’s not clear if this will put pressure on “bad actor” nations to follow other countries’ lead. Just this month, the Canadian national broadcaster CBC reported for the first time that the country’s equivalent of the NSA, the Communications Security Establishment (CSE), had a comparable process to the VEP — although it is not public and the agency wouldn’t even say what it’s called. “CSE has […]

Patching vulnerabilities often means juggling risk and practicality – which can mean gambling with customer data

Mattis makes first trip to cutting-edge tech shop this week — NIST publishes workforce framework

What’s at stake when we don’t share vulnerability data?

I love programming. It’s like playing with Lego — here are some blocks, see what you can build with them. That sounds a bit less impressive now, but when I was a kid walking uphill both way

Third-party bug disclosure; offense and defense markets for zero-day bugs.