Dark Reading - Host security - Social Engineering, the USB Way - Security
I like the idea of the trojan USB keys that the pen testing firm came up with.
given the level of success they had with this, I'd guess it won't be too long before someone who's not one of the good guys tries this as a technique...
This is another good reason to lock down USB ports on corporate machines!

Looks like there is a alpha release of SecuBat available here .
if (like me) your Austrian's not so hot, there's some more information in english here
It'll be interesting to line this up with Oedipus and see what their vulnerability finding strengths and weaknesses are...

SecuBat: A Web Vulnerability Scanner
Interesting looking paper which is being presented at the www2006 conference on automated web application testing.
It'll be interesting to see if they release the secubat tool they've developed as part of the work.

Five common Web application vulnerabilities
Article on security focus on common web app vulnerabilities. Nice to see an article that doesn't just repeat the obvious but acually goes into some detail about how the attacks are carried out...

<a title="CERIAS Weblogs

Security-Protocols :: The Bug Hunters Blog - Latest on OS X research..
Post about some serious security flaws in OSX, found by a security researcher.
I must say, I'm not surprised.
There's not been a lot of focus on security of Apple products in the past, but it seems that when it comes, with the increasing popularity of the platform, there will be a decent quantity of problems.
Whilst the UNIX-like underpinnings of OSX provide certain security advantages, there's nothing that I'm aware of which makes their security inherently better, at an application-level. And if they're typical of most tech companies, they won't be paying a huge amount of attention to secure development practices, until they start getting problems with published flaws/virii/worms...

How The Anti-Virus Industry Is Turning A White Hat Black, or (at least) Gray
Some interesting information about some work done to create an encrypted rootkit for winodws.. The worrying bit is that three months after it was put out, the main anti-virus still can't find it...
more information here.
Adventures of the White Rabbit

SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System
Another new 0-day for Internet explorer.. This has the potential to be quite nasty as there's Proof-Of-Concept code in the wild and there's no patch available as yet..

Ethical Hacking and Computer Forensics: Fuzzers - The ultimate list
Link to a cool list of fuzzers which could be very useful for doing application security reviews.

TaoSecurity
Some interesting comment on BP's new deperimeterisation moves (more information here )
I'd agree with the sentiments expressed in TaoSecurity, I agree with the Jericho Forums position that every device should be able to stand on its own from a security perspective, however the idea of deliberately weakening the security afforded to laptops by connecting them directly to the Internet when they're on the Corporate LAN seems like a very bad plan, as it reduces the numbers of layers of protection afforded to them needlessly.
Also it renders the security of the laptops very brittle, so if for example there is a problem with a change deployed to these devices which leaves them vulnerable to an attack, they won't have the safety net of being behind a corporate firewall to allow the IT team time to fix the problem before it has an impact...
I've also been thinking, how is this going to work in practice? If the laptops are on the Internet, surely they'll need to connect to Corporate IT assets, so they'll need a VPN tunnel into the company. Also surely BP will still want to take advantage of centralised web site monitoring, Email Anti-Virus etc... So all the traffic from these laptops sitting in corporate offices will go through a VPN tunnel back into the corporate LAN then potentially back out onto the internet.... Surely that's not a great plan from a cost perspective..