What's happening in security
Breaches, credential dumps, actively exploited bugs and AI incidents — pulled from 5,635 items across public feeds, Have I Been Pwned and CISA KEV.
Biggest this week
- Westcon-Comstor posts record US$3.37B first-half sales as APAC demand for AI, cloud and cyber accelerates — Reseller News (NZ), 2d ago
- GitHub Octoverse 2026 — Simon Willison (AI), 4d ago
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News, 2d ago
- Upwind Security Raises $400 Million at $3.8 Billion Valuation — SecurityWeek, 4d ago
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds — The Record, 2d ago
-
GM settles with 36 states for selling driver data, agrees to $220 million fine and reforms
General Motors agreed to pay $220 million to settle a lawsuit filed by a coalition of 36 state attorneys general who alleged the company unlawfully sold information about driver behavior to outside parties.
-
CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild. [...]
-
Lawsuit against Ex-Overstock CEO tied to 2020 election film falls apart over question of ‘actual malice’
The lawsuit, brought by a former executive at Dominion Voting Systems, concerns comments made in a 2020 film financed by Byrne titled “The Deep Rig.” The post Lawsuit against Ex-Overstock CEO tied to 2020 election film falls apart…
-
US sanctions Russians, North Koreans for laundering IT worker earnings
The U.S. Treasury Department sanctioned Russian and North Korean nationals for allegedly laundering the earnings of illicit IT workers on behalf of Pyongyang.
-
💾 Fighting DOGE's Data Grab | EFFector 38.19
When we give our private information to the government to pay taxes, apply for a job, or vote, we should be able to trust that our data won't later be used against us. But in a betrayal of that trust, the federal government has be…
-
CISA lays out plan to push cyber adversaries out of US critical infrastructure
The Cybersecurity and Infrastructure Security Agency (CISA) has released CISA 2030: Defend, Harden, Prevail, a strategy to strengthen national security and the resilience of critical infrastructure. It addresses intersecting cyber…
-
Cyberattack on University of Copenhagen exposes data of 525,000 people
The University of Copenhagen (UCPH) has ruled out a second cyberattack, saying the activity that led it to shut down several administrative systems on Monday is tied to the breach it disclosed last week, which exposed personal dat…
-
This is Fine: What NetScaler Zero-Days Tell Us about the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon. The post This is Fine: What NetScaler Zero-Days Tell Us about the New Normal appeared first on SecurityWeek .
-
CISA promises proactive defense in new strategic plan
The beleaguered agency, still recovering from major workforce cuts, promised to deepen partnerships and stay ahead of evolving threats.
-
CISA publishes strategy with eye on the next four years
It includes a review of whether its existing capabilities will meet its three pillars: “defend, harden, prevail.” The post CISA publishes strategy with eye on the next four years appeared first on CyberScoop .
-
UK proposes 14-year prison terms for undersea cable sabotage
In an era of hybrid threats, the British government wants to update the Submarine Telegraph Act 1885, which carries a maximum fine of £1,000 and five years’ imprisonment in cases of deliberate damage.
-
Drone program compliance: What a CTO says most agencies get wrong
In this interview with Help Net Security, Nick Donarski, CTO at RotorLab, explains what councils, records clerks, insurers, and auditors expect from a public safety drone program, and where most programs fall short. He covers chai…
-
Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations
Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company's Cambridge Analytica data scandal, which came to light in 2018. …
-
Meta Ordered to Pay New Mexico $25 Billion for Deceiving Users About Privacy on Facebook
The $25 billion award far exceeds a $5 billion fine the Federal Trade Commission levied against Facebook in 2019. The post Meta Ordered to Pay New Mexico $25 Billion for Deceiving Users About Privacy on Facebook appeared first on …
-
Delinea gives AI assistants read-only access to governance data
Delinea has announced Delinea Fastpath MCP Server, a new capability that connects access governance data to the AI assistants teams already use. Using the Model Context Protocol (MCP), finance, IT, audit, and compliance teams can …
-
EFF to Brazil’s ANPD: Data Privacy and Free Expression Must Underpin Platform Regulations
The Brazilian National Data Protection Agency (ANPD) plays a pivotal role in the regulation of digital platforms according to new legislation approved in Brazil. Throughout this year, EFF has presented comments, filed submissions,…
-
High number of data centres makes Ireland a hacking target – cybersecurity expert
Our CEO, Brian Honan, spoke to RTÉ’s Morning Ireland after a Google data centre outage disrupted Revolut and other financial services. He explained why Ireland’s many data centres put it “in the crosshairs” for nation-state attack…
-
Victory! Court Rules OPM's Disclosure of Personal Records to DOGE is Unlawful
In a victory for data privacy, a federal court in New York definitively ruled that the Office of Personnel Management (OPM) violated the law when it disclosed millions of federal employee records to DOGE agents. In a summary judgm…
-
CJIS v6.1 Compliance: 5 Practical Priorities for Agencies
CJIS v6.1 requires agencies to maintain strong authentication, account security, and audit controls while demonstrating ongoing compliance. Specops outlines five practical priorities covering MFA, account management, passwords, lo…
-
AppGate gives OT supervisors live monitoring and session termination controls
AppGate has expanded its zero trust offering for operational technology (OT) with Session Governance capabilities that help critical infrastructure operators reduce third-party access risk, simplify compliance audits and protect o…
-
Mastercard helps banks assess stablecoin risks before funds move
Mastercard has announced Stablecoin Security, a new risk intelligence solution, with Borderless.xyz and Keyrails as initial partners. As stablecoins play a growing role in cross-border and business-to-business payments, financial …
-
Training AIs to Solve CAPTCHAs
Interesting research : Abstract : Vision-language models (VLMs) can solve visual CAPTCHAs without task-specific training, but the agents built on them approach every challenge from scratch. For such an agent, the hundredth instanc…
-
The cyber talent shortage? Job postings just hit a four-year low
US employers posted 235,786 cybersecurity jobs from January through September 2026. That is the lowest total for those months in the four years that staffing and workforce intelligence firm CyberSN has tracked. They pulled the lis…
-
Our Lawsuit Against the Trump Administration’s Social Media Surveillance Moves Forward. Here’s What the Court Said.
No one should have to choose between speaking freely and protecting their immigration status. Yet that’s precisely the choice the Trump administration’s mass surveillance of online speech forces on noncitizens living in the U.S. L…
-
How Multi-Campus Universities can Build a more Connected Security Program
Parts 1 and 2 of this series looked at two pressures facing higher education security teams. First, the threat landscape : universities are dealing with more frequent attacks across complex, distributed environments, while campus-…
-
Additional highlights from the Citizen lab report include: Discover-Tech...also leveraged the European General…
Additional highlights from the Citizen lab report include: Discover-Tech...also leveraged the European General Data Protection Regulation (GDPR) consent frameworks to target users within the European Union. https:// citizenlab.ca/…
-
U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud
The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S…
-
🗣 A Victory for Freedom of Speech Online | EFFector 38.18
No one should have to think twice before criticizing the government online. But a mass surveillance program known as "Catch and Revoke" was created to make millions do just that. EFF and other defenders of free speech are fighting…
-
FBI raids 40+ laptop farms helping North Korea pocket US tech salaries
North Korean IT workers used stolen and fabricated identities to land remote jobs at more than 70 US companies, with help from Americans who allegedly kept company-issued laptops running from their homes, according to the US Depar…
-
Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise
Mozilla has introduced Firefox Enterprise for organizations with strict compliance, governance, and security requirements. The post Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise appeared first on Se…
-
FTC says ‘sextortion’ protection companies deceived customers about services
A federal lawsuit claims that Dmitry Belkin and his companies routinely failed to deliver on services to protect customers, generated fake evidence and denied refunds to victims. The post FTC says ‘sextortion’ protection companies…
-
Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation
The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Grindr users' sensitive data to advertisers. The administrative penalty is…
-
Norway fines Microsoft ad firm $9.6 million over Grindr data sharing
Norway's Data Protection Authority (Datatilsynet) has fined Microsoft-owned advertising company Xandr NOK 92 million ($9.6M) for unlawfully processing and sharing sensitive data belonging to Grindr users in the country. [...]
-
DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub
The seizures of the tools, allegedly operated by the Chinese firm Integrity Tech, accompanied a warning from the FBI, CISA and NSA. The post DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub appeared first on Cyb…
-
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails
Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 other countries said …
-
Four Compliance Frameworks, One Security Team. How Universities Can Stop Drowning in Regulatory Risk
Most industries manage one major compliance framework. Universities might manage four simultaneously, each bringing with it unique requirements, enforcement mechanisms, and consequences for failure. Here's what that actually looks…
-
Cyber experts call on CISA to create mandatory federal OT rules
The Operational Technology Cybersecurity Coalition (OTCC) released a white paper on Tuesday urging the Cybersecurity and Infrastructure Security Agency (CISA) to create a new directive centered around operational technology, which…
-
Here’s how experts think CISA should tell agencies to protect OT
Government auditors say federal agencies haven’t met mandated security steps for operational technology, which hackers targeted in water sector attacks this summer. The post Here’s how experts think CISA should tell agencies to pr…
-
NIS2 compliance: 7 low-cost steps to secure credentials
Security budgets rarely stretch to cover a full NIS2 programme in one pass. Credential controls are where a constrained team can start, because they make access visible, revocable, and reviewable without new infrastructure. NIS2 c…
-
Fake brand discounts on social media prey on shoppers’ fear of missing out
Cybercriminals are using fake discounts posted on Facebook and TikTok to lure shoppers to phishing sites that steal their payment card details and one-time passwords, Group-IB has warned. The phishing kit called Milk Dragon (also …
-
Victory! Court Rejects Government Effort to Dismiss Social Media Surveillance Lawsuit
Judge Allows Social Media Surveillance Lawsuit Against Trump Administration to Move Forward NEW YORK — A lawsuit filed by three labor unions against the Departments of State and Homeland Security for their viewpoint-based surveill…
-
US sanctions Tren de Aragua gang members in ATM hacks crackdown
The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in the theft of millions of dollars in ATM jackpotting attacks across the United States. [...]
-
In Rare Move, Alleged Iranian State Hacker Extradited to US
Amir Barati, an alleged member of the Mabna Institute, was indicted for targeting universities, private organizations, and government entities in the US and abroad. The post In Rare Move, Alleged Iranian State Hacker Extradited to…
-
The Fine Art of Frustrating the Adversary
What really frustrates an adversary? Eight Cisco Talos researchers share practical ways to make their next move slower and riskier. From deception and behavioral detection to breaking attack dependencies and resisting manufactured…
-
Victory! California Appeals Court Refuses to Revive Surveillance Tech CEO’s Meritless Lawsuit Against Journalist
When the rich and powerful try to use the court to silence negative reporting about themselves, it’s worth calling out that behavior for what it is: an attack on free speech. This is why EFF is happy to stand up for reporters who …
-
US sanctions 10 over ATM malware scheme tied to Tren de Aragua
Treasury’s Office of Foreign Assets Control (OFAC) targeted multiple Venezuelan nationals and several companies they control that are part of the effort to launder the money stolen from dozens of ATMs.
-
I want healthcare Good news your TV actually tracks your heartbeat now and it says you're fine, take some prop…
I want healthcare Good news your TV actually tracks your heartbeat now and it says you're fine, take some propranolol
-
Former US Air Force members behind million-dollar BEC scheme head to prison
Two men who ran BEC and phishing campaigns against US businesses while serving in the Air Force have been sentenced to a combined 189 months in federal prison. According to public documents and evidence presented at sentencing, Ch…
-
EU Cyber Resilience Act requirements for containers and Kubernetes
Starting in full force on Dec. 10, 2024, the EU Cyber Resilience Act (CRA) is a regulation (EU 2024/2847) that defines mandatory cybersecurity requirements for all products with digital elements sold in EU markets. Reporting oblig…
-
In this new SME cybersecurity service, the AI assists and the consultants decide
BH Consulting, the Irish cybersecurity and data protection consultancy, has launched BH Haven, an ongoing service that gives Irish small and medium-sized enterprises (SMEs) access to its specialist consultants, supported by a prop…
Last fetch 14m ago · 0 new · 1 source error(s)