Google, Microsoft and Oracle amassed the most cybersecurity vulnerabilities in the first half of 2021

A string of recent cyberattacks have hamstrung critical aspects of U.S. infrastructure such as domestic meat and petroleum production, bringing conversations surrounding security front and center for companies around the globe. A recent AtlasVPN report highlights the companies that have amassed the most security vulnerabilities through the first half of 2021.

SEE: Security incident response policy (TechRepublic Premium)

Most security vulnerabilities in 2021

In the first six months of 2021, Google and Microsoft have “accumulated the most vulnerabilities,” according to Atlas VPN findings based on a recent Telefonica Tech report. Among companies with the most accumulated security vulnerabilities to start 2021, Google claimed the top spot with 547; followed by Microsoft with 432, per AtlasVPN.

In a post, author of the report and cybersecurity researcher William S. said “exploiting Google products like Chrome is popular among cybercriminals,” making note of the large user base, “meaning that more internet users can become victims of the exploits.” As for runner-up Microsoft, William S. said that “state-sponsored threat actors from China abused Microsoft Exchange Server vulnerabilities to carry out ransomware attacks,” adding that “other attackers would drop cryptocurrency miners from the post-exploit web shells.”

SEE: How to manage passwords: Best practices and security tips (free PDF) (TechRepublic)

In the third spot, Oracle amassed 316 vulnerabilities with Cisco (200) and SAP (118) rounding out the top five. When discussing No. 3 Oracle, William S. said that these exploits are “usually” discovered in “Oracle WebLogic Server, which functions as a platform for developing, deploying and running enterprise Java-based applications,” adding that these “exploited flaws could give access to the affected system for remote attackers.”

Outside of AtlasVPN’s top five companies, there’s a marked drop-off in vulnerabilities for the rest of the field: IBM (69), Jenkins (68), Apple (67), Linux (65) and Aruba (56).

Microsoft vulnerabilities

Last month, Microsoft sent warnings to “thousands” of the company’s cloud computing customers, explaining that “intruders could have the ability to read, change or even delete their main databases,” according to a Reuters report citing a cybersecurity researcher and a copy of the warning email. Via email, a Microsoft spokesperson told TechRepublic that the company “fixed this issue immediately to keep our customers safe and protected” and thanked “the security researchers for working under Coordinated Vulnerability Disclosure.”

2021 ransomware payouts

In the first six months of 2021, ransomware payments surged 82% to $570,000 on average, according to Unit 42’s Ransomware Threat Report. In the aftermath of the Colonial Pipeline attack, the company paid DarkSide hackers more than $4 million, according to a Wall Street Journal interview with the CEO. Following the JBS attack, the company paid the REvil group $11 million.

Cybersecurity Insider Newsletter

Strengthen your organization’s IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices.
Delivered Tuesdays and Thursdays

Sign up today

Also see