Top 10 Stories

OS X El Capitan 10.11.6 fixes a total of 60 security bugs affecting components such as audio, CFNetwork, CoreGraphics, FaceTime, graphics drivers, ImageIO, the kernel, the login window, OpenSSL, QuickTime, sandbox profiles, and the libxml2 and libxslt libraries. The CFNetwork vulnerability, tracked as CVE-2016-4645, was reported to Apple by Abhinav Bansal of Zscaler. The security firm published a blog post on Monday to describe the flawthat allows unprivileged applications to access cookies stored in the...

Wikileaks has claimed its servers were hit prior to releasing hundreds of thousands of documents on Tuesday purporting to reveal Turkey's "political power structure". The site said it would release the documents in the wake of the failed attempt to overthrow President Recep Tayyip Erdogan last week. The whistleblowing site said it had come "under sustained attack" on Tuesday and was "unsure" of the origin of the attack, though it suggested the Turkish state might...

The company that builds Ubuntu, a popular Linux distribution, has said its forums were hacked Thursday. Canonical, which develops the operating system, said in a statement on Friday that two million usernames, email addresses, and IP addresses associated with the Ubuntu Forums were taken by an unnamed attacker. View full story ORIGINAL SOURCE: ZDNet

Malware hyped as aimed at the head of power plants is nothing of the sort according to security outfit Damballa, which has put its name to analysis claiming the "SFG" malware is run-of-the-mill code without sufficient smarts to target SCADA systems. The so-called SFG malware is the spawn of Furtim, and hit headlines as targeting industrial control systems when all it does is creates backdoors for regular data exfiltration and payload dropping. Security outfit SentinelOne...

Fake versions of the augmented reality game Pokémon Go are locking users' phones and connecting to porn sites online, security firms have warned. The popularity of fake versions of the game has been hard to check because it hasn't been officially released in many countries. More than 215 versions of the popular app have already been found in app stores, according to cyber security company RiskIQ. View full story ORIGINAL SOURCE: The Independent

The Philippines government websites have been hacked by suspected Chinese cyber attackers. The breach comes just days after the Permanent Court of Arbitration at The Hague ruled in favour of the Philippines over the South China Sea dispute. Two websites, Loon and Panglao, were breached on 16 July, while one other — the website for the Commission on Audit (COA) — was hacked early on 18 July, the Inquirer reported. At the time of writing,...

Wondering why you couldn't “catch ‘em all” Sunday? The hacking collective OurMine has claimed credit for attacking the "Pokemon Go" servers. Hackers reportedly hit "Pokemon Go" login servers with a distributed denial of service (DDoS) attack on Sunday that left players frustrated and unable to log in to the game. The group, whose IP address has reportedly been tracked to Saudi Arabia, posted a statement on their website saying, “No one will be able to play this game till 'Pokemon Go' contact...

The head of a U.S. banking regulator on Thursday said he was unaware of any efforts by his staff to cover up hacking of the agency's computers by a foreign government in 2010 and 2011, as outlined by a congressional report. Federal Deposit Insurance Corporation Chairman Martin Gruenberg told a hearing of the committee that published the report that he first learned of the security breach in 2011 when he was the FDIC's acting chairman....

In March 2016, newer variants of the Android.Fakebank.B family arrived with call-barring functionality. The feature aims to stop customers of Russian and South Korean banks from cancelling payment cards that the malware stole. The latest version of the threat shows how Android banking malware continues to evolve. Once installed, the new Android.Fakebank.B variants register a BroadcastReceiver component that gets triggered every time the user tries to make an outgoing call. If the dialed number belongs to any of...

Cisco has patched two vulnerabilities, including a remote denial of service bug in its Network Convergence System routers. Attackers can send packets to TCP listening ports running SSH, secure copy protocol, and secure FTP that can overwhelm NCS 6000 routers and cause processors to reload. The Borg rates the vulnerability (CVE-2016-1426) as highly critical on account of it offering a method to remotely disrupt routers in certain configurations. View full story ORIGINAL SOURCE: The Register