IE 7 Code Execution Exploit; Yahoo IM Patch

Aviv Raff has posted a proof-of-concept exploit for a DLL-load hijacking vulnerability in IE 7 that could result in code execution attacks.

Conde Nast's Reddit meme-digger has fessed up to a data theft episode that may have exposed e-mail addresses, usernames and passwords of its users.

Bruce Schneier analyzes 34,000 actual usernames and passwords stolen in a MySpace phishing attack and makes a surprising discovery.

A Russian malware author has released a prototype of SMS-forwarding spyware that hides from the user, loads on startup, copies the text of the last SMS received, and forwards that text in a new SMS to the author.

Yahoo has shipped an ActiveX update to plug a gaping security hole in its Yahoo Messenger client software.

Image files can be easily backdoored to write destructive worms for bulletin boards, blogs, wikis and other types of Web systems.

Enterprise Strategy Group analyst Jon Oltsik makes a convincing argument that BitLocker full disk encryption in Windows Vista makes the new operating system ready for enterprise deployment.

In 2006, Microsoft patched 133 critical and important vulnerabilities, surpassing the total for 2004 and 2005 combined.

Michael Howard reports that two of the most commonly used browser plug-ins--Adobe Acrobat/Reader and Adobe Flash Player--now work properly when DEP is enabled in IE 7.

Multiple HTTP response splitting vulnerabilities in Google AdWords may be exploited by remote attackers to inject arbitrary HTTP headers.