This paper investigates the secure state estimation problem for cyber-physical systems (CPSs) under sparse actuator and sensor attacks. By introducing the notion of orthogonal complement matrix, a necessary and sufficient condition for the state observability is provided. Then, based on the least square technique, a new projection operator is proposed to reconstruct the state from a set of successive measurements. Besides, by constructing an augmented system where the attacks are seen as part of the augmented state vector, a novel secure Luenberger-like observer is proposed, and sufficient conditions for the existence of the desired observer are proposed in terms of linear matrix inequalities (LMIs). It is shown that the proposed observability condition can be reduced to the sparse observability. A distinguishing point is that the attacks may be still unavailable even if the state is observable, and besides estimating the state, the attacks are also reconstructed by the proposed algorithm and observer according to their observability automatically. (C) 2018 Elsevier Ltd. All rights reserved.