Contest seeks the most diminutive XSS worm
83482
Let the hacking begin Think you have a gift for writing compact code that replicates using one of the web's most vexing classes of security vulnerabilities? Then Security researcher RSnake (aka Robert Hansen) would like to hear from you. He has set up a contest to see who can write a self-propagating cross-site scripting (XSS) worm using the fewest number of characters.â¦
372530
A new worm targeting a flaw in Sun Microsystems Inc.'s Solaris 10 OS delivers crude artsy payloads, including a drawing of a turkey in ASCII text.
233929
Ziff Davis - Anti-Santy-Worm V4 attempts to patch vulnerable Web forum software but might cause denial-of-service attacks.
334880
A new family of worms which uses an unpatched vulnerability in Internet Explorer is spreading widely across the net.
442863
More and more, web forms are having to distinguish between real users entering inforamtion and bots/scripts going out and using the form to harass. Thankfully, there's a solution that is simple and easy for just about anyone to implement - a security image - and this new DevShed article seeks to help you create one of your own.
563255
Harry Fuecks is back today on the SitePoint PHP Blog with part two of his "joy of regular expressions" series, continuing on from this previous entry.   He jumps right in, summarizing the first part in a small section before getting back into the examples:  Hunting for .jp(e)gs Escaping Meta-Characters Search and Replace preg_quote() preg_replace() Word Boundaries, Word Characters...and everything else Sub patterns Spot the XSS Hole eval() is evil! preg_replace_callback()  As you can see, it's crammed with just as much infromation as the first part and covers a wide range of topics to help you get more in tune with your inner regular expression guru.
342444
A new worm has been discovered in the wild that&#39;s not just settling for invading users&#39; PCs - it wants to invade their homes, too.
635724
In a new post on his blog, Christian Wenz mentions the latest results of the SANS Institute's Top 20 Internet Security Attack Targets list which both includes a new entry ("Users") and several mentions of PHP and PHP-related applications.   Of course you can debate how such a Top list came together and what the real value behind that is, but there are two specific points in this year's list that I found quite interesting.   There's two targets for the PHP community to worry about - sysadmin/hosting and things developers need to keep in mind. Items on these lists include:  Always test and deploy patches and new versions of PHP as they are released Use Intrusion Prevention/Detection Systems to block/alert on malicious HTTP requests. Consider using Apache's mod_security to block known PHP attacks If you use PHP, migrate your application to PHP 5.2 as a matter of urgency. Encode all output using htmlentities() or a similar mechanism to avoid XSS attacks  You can check out the full information over on the SANS Institute website.
517091
Fixes made for "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite.
477504
Funner worm, which spreads via IM, is rated as a low threat.
34787
A new variant of the so-called Zafi worm surfaced Tuesday, disguised to appear as a Christmas greeting. Multiple antivirus researchers reported the emergence of the latest iteration of Zafi, classified as
633181
Gareth Heyes has a new post today talking about one of the vulnerable values in the $_SERVER superglobal - PHP_SELF.   I thought it might be a good idea to gather a few test cases demonstrating the problem. Why PHP allows these URL's is beyond me and it wouldn't take much work to filter out these malicious URL's in the PHP code.   He provides four test cases to show how simple it is to abuse - one using a HTTP header, another pushing XSS through, the third mentions search pages and the fourth a direct code injection.   You can download the code here.
87931
Latest worm poses a risk to many Web sites using the PHP scripting language.
451719
typically e-mailed as enticements to bogus sites that endanger users&#39; systems and expose their personal information -- is limited in scope
594361
A new version of the Download.ject worm has begun spreading on the Internet, according to security firm PivX.
791
A new computer worm emerged on Tuesday which broke the speed record from the announcement of a security vulnerability in Microsoft&#39;s Internet Explorer to a full-blown virus that spreads in the wild.
403071
Here's a screen shot of the HTML source.  Looks like it's trying to serve some kind of ActiveX control. Happy to be using a Mac.  PS: Scoble just showed up and TM works on his cell phone so there's something weird going on.