22+ hour, 29+ min ago   (1168+ words) RIP, you won't be mourned The term "security through obscurity" describes an old idea that networks and systems will remain secure so long as their architecture, along with any vulnerabilities or other weaknesses, remains secret or hidden. It was never…...

3+ day, 12+ hour ago   (817+ words) Human operator: don't touch CIS orgs. AI agents: look a squirrel! An unknown attacker used hundreds of AI agents to exploit two PaperCut MF/NG bugs and break into at least 395 organizations. The victims were concentrated in the US education…...

3+ day, 18+ hour ago   (579+ words) McKesson's cyberattack last month affected roughly 6.4 million individuals, according to Have I Been Pwned (HIBP). The breach notification service added data leaked by serial extortionists ShinyHunters, revealing the scale of the attack for the first time. ShinyHunters initially claimed to…...

4+ day, 18+ hour ago   (661+ words) Tencent has patched up a zero-click vulnerability that security researchers used to create a worm capable of spreading through calls on WeChat. With more than 1.4 billion monthly active users, WeChat is among the most popular apps in the world. According…...

5+ day, 18+ hour ago   (1018+ words) Claims follow scrutiny over monitors installing adware without user consent LG is once again fending off allegations that its expensive consumer hardware gathers extensive information about users and their surroundings for the benefit of its advertising business. The latest concerns…...

5+ day, 18+ hour ago   (625+ words) A Microsoft 365 phishing operation targeting hundreds of organizations captured thousands of passwords and session cookies, including hundreds of authenticated sessions that could be hijacked to bypass MFA, according to researchers who accessed the crooks' own admin panel. Security researchers at…...

5+ day, 15+ hour ago   (679+ words) Data theft and extortion crews are stealing companies’ proprietary AI data and threatening to leak it if the victim organizations don’t pay a ransom, according to Google’s threat hunters. In one case that Google’s Mandiant incident response team investigated, the…...

6+ day, 20+ hour ago   (483+ words) Natural Resources Wales (NRW) says diversity data belonging to around 2,000 current and former employees who worked at the environmental regulator between April 2013 and March 2018 was exposed in a classic Freedom of Information (FoI) blunder. The Welsh government-sponsored body confirmed on…...

6+ day, 22+ hour ago   (1268+ words) Peers have questioned why the UK's Cyber Security and Resilience Bill does not allow regulators to penalize senior executives when an organization's failure to comply involves their consent, connivance, or deliberate or careless neglect. Echoing arguments heard across the industry…...

1+ week, 2+ day ago   (485+ words) Fraudsters have found a new use for ASCII smuggling, typically used to hide malicious prompts intended for AI models, in an old-school attack method: email phishing. Microsoft uncovered a massive phishing campaign using invisible Unicode tag characters that peaked at…...