> TODAY'S SUMMARY (2 articles)
Today's cybersecurity landscape highlights a significant threat from a malicious Claude Code-branded browser extension, which has been identified to deploy a persistent SSH backdoor. Microsoft has released analysis and remediation guidance for affected users. Additionally, organizations are advised to carefully evaluate Web Application and API Protection (WAAP) solutions as they approach renewal decisions, considering integration of various tools for comprehensive security against multiple threats. Overall, the focus remains on enhancing defenses against sophisticated attacks while navigating complex security tool ecosystems.
|
// AI-powered summary generated at 04:00
The social engineering campaign spiked last month and has targeted dozens of organizations since May 2025, according to ReliaQuest.
The post Black Basta’s playbook lives on as former affiliates launch fast-scale intrusion campaign appeared first on CyberScoop.
L'Agence espagnole de protection des données (AEPD) a publié une décision de sanction à l'encontre de ARES CAPITAL, S.A. (comprenant le prononcé d'une amende de 280 000 €) pour des manquements en lien avec le traitement des données personnelles de ses employés conducteurs via des applications mobile...
Le Comité Européen de la Protection des Données (CEPD) a adopté un modèle d'Analyse d'Impact relative à la Protection des Données (AIPD) visant à faciliter la conformité et à renforcer la cohérence au sein de l'Europe.Cette initiative, qui s'inscrit dans la lignée de la Déclaration d'Helsinki, a pou...
There is an almost reflexive habit in data engineering: whenever you instrument an event, you attach a user ID. It feels natural. User IDs are how you join tables, track behavior, and measure engagement. The problem is that most teams attach them without ever asking whether they actually need them....
L'autorité finlandaise de protection des données a publié une décision de sanction à l'encontre de Lepus Asset Management Oy pour des manquements en lien avec la prospection commerciale par appels automatisés sans le consentement des personnes concernées. Cette affaire débute par plusieurs plaintes...
L'Agence espagnole de protection des données (AEPD) a publié une décision à l'encontre du Service aragonais de la santé (SALUD) pour des manquements en lien avec la gestion des accès aux dossiers médicaux de ses patients. Cette affaire débute par une plainte déposée le 14 juillet 2023, après que la...
In September 2024, Amandla Thomas-Johnson was a Ph.D. candidate studying in the U.S. on a student visa when he briefly attended a pro-Palestinian protest. In April 2025, Immigration and Customs Enforcement (ICE) sent Google an administrative subpoena requesting his data. The next month, Google gave...
This is a current list of where and when I am scheduled to speak:
I’m speaking at DemocracyXChange 2026 in Toronto, Ontario, Canada, on April 18, 2026.
I’m speaking at the SANS AI Cybersecurity Summit 2026 in Arlington, Virginia, USA, at 9:40 AM ET on April 20, 2026.
I’m speaking at the Nemertes [N...
Google's Failure to Warn Users About Law Enforcement Demands for Data Is DeceptiveSAN FRANCISCO – The Electronic Frontier Foundation sent complaints today to the attorneys general of California and New York urging them to investigate Google for deceptive trade practices, related to the company's bro...
Two high-severity security vulnerabilities have been disclosed in Composer, a package manager for PHP, that, if successfully exploited, could result in arbitrary command execution.
The vulnerabilities have been described as command injection flaws affecting the Perforce VCS (version control software...
After the U.S. Treasury last year sanctioned the Funnull CDN it used, the Triad Nexus scam network changed up its operations and began using major cloud services providers, creating front companies, and shifting away from targeting U.S. victims, instead is focusing on those in Asia, according to Si...
Microsoft has rolled out a fast-track process to help developers regain access to accounts recently suspended from its Windows Hardware Program, following widespread complaints that they were locked out without warning. [...]
OpenSSL 4.0.0 removes several long-deprecated features, adds support for Encrypted Client Hello, and introduces API-level changes that will require code updates for applications built against older versions. SSLv3, SSLv2 client hello, and engines are gone SSLv3 support has been removed. The protocol...
AttackIQ has released a new attack graph that emulates the behaviors of NightSpire Ransomware, a financially motivated ransomware and data extortion group that emerged in early 2025 and quickly evolved into a full double-extortion operation.
The post Emulating the Persuasive NightSpire Ransomware ap...
New libexif packages are available for Slackware 15.0 and -current to fix security issues.
New xorg-server packages are available for Slackware 15.0 and -current to fix security issues.
Internal emails obtained by WIRED reveal how a conservative legal group with a direct line into FCC chairman Brendan Carr’s office built the case against Jimmy Kimmel and his employees.
Zero-trust and micro-segmentation have become the default direction for enterprise network security, and for good reason. But the shift has introduced an operational problem that few organizations were ready for: an explosion of fragmented rules, overlapping policies and billions of complex access...
The RSAC Innovation Sandbox has long been one of the most watched competitions in cybersecurity, and this year’s winner caught much of the industry off guard. Alan Shimel sits down with Henry Comfort, CEO of Geordie AI, to talk about how a startup that was buying laptops just a year ago ended up ta...
Could Claude Mythos Preview, Anthropic’s latest large language model, be leveraged for fully automated cyber attacks? The UK government’s AI Security Institute (AISI) tested its capability to successfully engage in capture-the-flag (CTF) challenges and multi-step attack scenarios, and found that tha...