What's happening in security
Breaches, credential dumps, actively exploited bugs and AI incidents — pulled from 5,635 items across public feeds, Have I Been Pwned and CISA KEV.
Biggest this week
- Westcon-Comstor posts record US$3.37B first-half sales as APAC demand for AI, cloud and cyber accelerates — Reseller News (NZ), 2d ago
- GitHub Octoverse 2026 — Simon Willison (AI), 4d ago
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News, 2d ago
- Upwind Security Raises $400 Million at $3.8 Billion Valuation — SecurityWeek, 4d ago
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds — The Record, 2d ago
-
PTaaS vs. Traditional Penetration Testing: What CISOs Need to Know
Vendors pitch Penetration Testing as a Service (PTaaS) and traditional penetration testing as competing options, but the two solve different cybersecurity problems. PTaaS pairs human-led testing with a subscription platform — a da…
-
Labcorp to overhaul data security practices, pay $2.3 million fine for cybersecurity failings
Security changes include creating an incident response plan for vendor security failings, limiting how much data Labcorp shares with vendors and building an expansive risk management team charged with tracking vendors’ compliance …
-
CISA Election Security Plan Flags Patching Barriers, Voter Database Attacks
Homeland Security Secretary Markwayne Mullin tasked CISA with developing the plan in July. The post CISA Election Security Plan Flags Patching Barriers, Voter Database Attacks appeared first on SecurityWeek .
-
House and Senate members propose legislation for CISA to step up cyber defenses for biotech
Biotechnology doesn’t have its own critical infrastructure designation, so the bipartisan group of lawmakers wants to make sure it’s protected like it. The post House and Senate members propose legislation for CISA to step up cybe…
-
OT Security Guidance: NIST Drafts Updated Guide, CISA/FBI Advise on ICS Integrators
Revision 4 of NIST’s operational technology security guide is open for public comments until November 30. The post OT Security Guidance: NIST Drafts Updated Guide, CISA/FBI Advise on ICS Integrators appeared first on SecurityWeek …
-
Ubuntu kernel CVE fixes are moving to a weekly release schedule
Ubuntu kernels will ship every week under a new release schedule from Canonical, which is merging its four-week cycle for regular Stable Release Updates (SRUs) and its two-week cycle for security fixes into a single two-week cycle…
-
Watchdog finds most agencies failed to meet CISA cloud security orders, heightening risk of attack
The DHS inspector general said CISA lacks the power to compel agencies to implement its Binding Operational Directives. The post Watchdog finds most agencies failed to meet CISA cloud security orders, heightening risk of attack ap…
-
Peak Karavshin.
A new day dawned in the Karavshin valley in Kyrgyzstan. By morning the weather had once again turned so fine that the joy of being alive was boundless – and infinitely so! The only thing taking the edge off was that, yet again, we…
-
Sweden fines Miljödata $183,000 over breach affecting 2.2 million
Sweden's data privacy regulator, IMY, has imposed a $183,000 (SEK 1.8 million) fine on IT systems provider Miljödata for inadequate security measures leading to a breach in August 2025 affecting 2.2 million people. [...]
-
Deception by Design: CISA's Guide to Tricking Cybercriminals
The Cybersecurity and Infrastructure Security Agency (CISA) is going old-school to help organizations with limited resources set traps for hackers.
-
Wow, this is the first time I’ve seen LinkedIn break this badly. After my keynote at Mind The Sec, I came back…
Wow, this is the first time I’ve seen LinkedIn break this badly. After my keynote at Mind The Sec, I came back to 41 connection requests, and a week later, LI is STILL sending me dribs and drabs of notifications for those, even th…
-
Passwork NIS2 efficiency guide: Save your team hours before the 2026 audit
By the second half of 2026, national competent authorities across the EU are actively reviewing NIS2 compliance documentation. Under Article 20(1) of the directive, senior management at essential and important entities can be held…
-
EU data regulator fines Google more than $460 million for location data violations
Ireland’s Data Protection Commission will fine Google more than €403 million ($462 million) over the tech giant’s processing of location data, concluding an inquiry into the company that began in early 2020.
-
Google Hit With $463 Million Fine for EU Location Data Rule Breach
Google has been fined 403 million euros ($463 million) for breaching the European Union’s strict privacy rules because it mishandled users’ location data. The post Google Hit With $463 Million Fine for EU Location Data Rule Breach…
-
Google Fined €403 Million Over GDPR Violations Tied to Location Data
Google has been fined €403 million for breaking the EU's data protection law, the GDPR, in the way three of its features handled people's location data from May 2018 to February 2020. Ireland's Data Protection Commission (DPC), Go…
-
Dems seek top-to-bottom assessment of CISA workforce
After the exit of around 1,000 CISA workers, legislation from three top House Democrats orders a force structure assessment like that more common to military branches. The post Dems seek top-to-bottom assessment of CISA workforce …
-
Google fined €403 million over location data privacy violations
Ireland's Data Protection Commission (DPC) has fined Google €403 million ($463M) for multiple GDPR violations related to processing users' location data. [...]
-
Google hit with €403 million GDPR fine over location tracking
Ireland’s Data Protection Commission (DPC) has fined Google €403 million (about $463 million) over its processing of users’ location data and ordered the company to bring that processing into compliance within six months. The inqu…
-
Securecom bolsters leadership team
New Zealand managed services provider (MSP) Securecom has expanded its senior leadership team, hiring Paul Grapendaal as its new head of cyber security and promoting Larrisa Kolver to head of product marketing and commercialisatio…
-
Your Minimum Viable Business Has a Maximum Load. Do You Know It?
Over the years I ve sat through a lot of crisis simulations. Different sectors, different scenarios, different rooms, mostly run by people who know exactly what they re doing which is the part that matters for what follows. I ve l…
-
Buyers of pervert glasses join the war on pervert glasses: https://www. latimes.com/business/story/202 6-09-18…
Buyers of pervert glasses join the war on pervert glasses: https://www. latimes.com/business/story/202 6-09-18/meta-glasses-captured-shared-intimate-images-without-users-consent-lawsuit-claims
-
CISA wants critical infrastructure orgs and smaller security teams to start using cyber decoys
Cyber deception has long been the domain of well-resourced security teams, but CISA s latest guidance, titled Using Cyber Decoys to Strengthen Detection and Response , is an attempt to try and change that. Why decoys, and why now …
-
CISA Releases Guidance on Deploying Cyber Decoys
Complementing Zero Trust models, decoys enable organizations to detect, observe, and block malicious activity in their environments. The post CISA Releases Guidance on Deploying Cyber Decoys appeared first on SecurityWeek .
-
CISA promotes a fresh way to deter cyberattackers: Lie to them
It’s the first guidance from the Cybersecurity and Infrastructure Security Agency on deploying decoys, like honeypots, to detect and distract adversaries. The post CISA promotes a fresh way to deter cyberattackers: Lie to them app…
-
Data Broker Radaris Loses Domains in Privacy Fight
The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up with the company recently in a la…
-
How the Meta Settlement Silences Youth Activism
Since its integration into our digital world, social media has played a pivotal role in youth organizing and social mobilization. Yet, people’s access to these platforms is increasingly coming under threat from courts and legislat…
-
CISA looks to recruit general infrastructure security experts rather than sector-focused advisers
I need people that can pivot from day to day, the agency s acting chief told reporters.
-
NIST and CISA finalize playbook to stop token theft and forgery
NIST and CISA have finalized guidelines to help federal agencies and cloud service providers (CSPs) protect identity and access tokens from forgery, theft, and misuse. The guidance, Protecting Tokens and Assertions from Forgery, T…
-
MSPs say nearly half their customers rely on them for CISO services
MSPs estimate that 46% of their customers, on average, look to them to act as CISOs, according to Sophos. Most of those providers do that job without the full set of compliance services, and many spread the work across several too…
-
Norway announces investigations into telecom Telenor’s work with Myanmar junta
Oslo-based Telenor potentially enabled crimes against humanity and violated sanctions in its dealings with the military regime that took over Myanmar in 2021, Norwegian authorities said.
-
What’s next for CISA’s CDM program that gives cybersecurity tools to federal agencies
Three feds spoke about future plans for the Continuous Diagnostics and Mitigation program, and lessons they’ve learned. The post What’s next for CISA s CDM program that gives cybersecurity tools to federal agencies appeared first …
-
Members of ‘Black Axe’ cybercriminal group extradited from South Africa
Prosecutors unsealed a 2021 indictment accusing the five men of conducting lucrative romance scams that stole thousands of dollars from more than 100 people.
-
Hey due to upcoming EU regulation I just wanna clarify that when I talk about catgirls I am specifically talki…
Hey due to upcoming EU regulation I just wanna clarify that when I talk about catgirls I am specifically talking about Cat Women who are 21+ in human years
-
Karavshin – (an overcast) day two: clambering up to Jalgychy – and “surfing” back.
Salam elim! On the Karavshin trek across the Pamir-Alay mountain system, summer weather is normally glorious. Mornings bring guaranteed blue skies, by midday a few insignificant little clouds might swell up (or possibly rather mor…
-
CISA is on the verge of filling hundreds of critical vacancies
Meanwhile, the agency is finalizing an incident-reporting regulation and setting up a new industry coordination structure.
-
Democratic Senators Ron Wyden and Sheldon Whitehouse as well as GOP congressman Pat Harrigan of North Carolina…
Democratic Senators Ron Wyden and Sheldon Whitehouse as well as GOP congressman Pat Harrigan of North Carolina sent a letter to U.S. Secretary of Commerce Howard Lutnick, urging him to add three Indian companies to the department’…
-
Grindr to Pay £26 Million to Settle U.K. Claims Over HIV Status Data Sharing
Online dating app Grindr has opted to pay £26 million ($35.1 million) to settle a lawsuit in the U.K. over allegations that it shared users' personal information, including their HIV status, with third-parties. Grindr, which is th…
-
NIS2 compliance: Fixing IAM and access control before the 2026 audit
The NIS2 Directive places direct obligations on organizations across supply chain risk management, incident reporting, and board-level accountability. October brings a new wave of legally binding deadlines across the EU, as member…
-
ShinyHunters claims it stole 284 million patient records from McKesson
Healthcare company McKesson disclosed a cybersecurity incident in which hackers got into third-party applications and stole data. McKesson is a major U.S. healthcare company that distributes pharmaceuticals, medical supplies and o…
-
CISA identifies security hurdles that led to very different results in two red-team engagements
The agency said its recent simulated cyberattacks offered several key lessons for many organizations.
-
Trump Order Aims to Block Foreign Backdoors in US Power Grid Gear
The White House’s new executive order 14420 widens scrutiny of industrial control systems over cyber sabotage concerns. The post Trump Order Aims to Block Foreign Backdoors in US Power Grid Gear appeared first on SecurityWeek .
-
Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure
The order says any foreign-produced equipment deemed to pose national security risks can’t be purchased or installed. The post Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure ap…
-
Medical device firm Boston Scientific says cyberattack has disrupted shipment processes
The company released a statement and filed documents with the Securities and Exchange Commission (SEC) saying a cybersecurity incident was discovered on Tuesday.
-
CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published the results of two red team assessments it conducted simultaneously against two critical infrastructure organizations, using what it described as simil…
-
CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks
The agency has released guidance on reducing internet exposure in the wake of the recent Iran-linked hacker attacks. The post CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks appeared first on SecurityWe…
-
U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches
The U.S. Department of the Treasury has announced fresh sanctions on Iranian cyber actors as part of what it called an "unprecedented, whole-of-government, economic campaign" against the nation and its enablers. "We are launching …
-
Water sector passes, government sector fails attempts to spot and halt simulated CISA attack
Agency red-teamers got initial access to both organizations they tested, but one quickly isolated and shut down the attempts from going further. The post Water sector passes, government sector fails attempts to spot and halt simul…
-
Cybersecurity jobs available right now: August 25, 2026
Specialist Compliance Security AT T USA On-site View job details As a Specialist Compliance Security, you will serve as AT T s liaison for law enforcement, first responders, and emergency personnel nationwide. Respond 24 7 to emer…
-
US sanctions Iranian cyber actors as UK discloses power plant attack
The U.S. sanctioned several Iranian nationals for cyberattacks on critical infrastructure just days after reports emerged of a cyber intrusion on a small power plant in the United Kingdom.
-
SCOTUS tosses one of two injunctions against Trump USPS mail-in ballot rules
The 6-3 decision dismisses one lawsuit brought by states, saying they have no standing to sue because the disputed sections “neither requires nor forbids anything of anyone outside the executive branch.” The post SCOTUS tosses one…
Last fetch 3m ago · 0 new · 1 source error(s)