> TODAY'S SUMMARY (47 articles)
Today's cybersecurity landscape highlights a growing concern over AI-driven threats. The UK's National Cyber Security Centre (NCSC) warns that AI-powered attacks, particularly in ransomware, could target critical infrastructure by 2028, as legacy systems remain vulnerable. Meanwhile, a significant breach at Revolve has compromised the card details of up to 1.5 million customers, and a data breach at Harvard University has exposed 851,000 accounts. On the botnet front, Google has dismantled the XCPE botnet, which leveraged over 1.3 million devices for malicious activities. Additionally, ongoing exploitation of critical vulnerabilities, such as those in Siemens IoT devices and CryptoPayment Gateway plugins, underscores the urgent need for robust cybersecurity measures. The prevalence of AI in both attacks and defenses continues to shape the threat landscape, necessitating immediate action from organizations.
|
// AI-powered summary generated at 12:00
This essay was written with Nathan E. Sanders, and originally appeared in The Guardian.
OpenAI, and then Anthropic, were each formed by AI developers who feared unrestrained corporate AI development—specifically, that companies like Google and Meta would steer the technology towards deleterious, may...
Google Cloud outlines its roadmap to full post-quantum cryptography readiness, with key milestones targeted for 2027 and 2028.
The post Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal appeared first on SecurityWeek.
Cybersecurity researchers have uncovered a large-scale, global recruitment-themed phishing campaign that uses fake interview scheduling pages and Browser-in-the-Browser (BitB) windows to steal Google and Facebook credentials and, in more advanced cases, relay multi-factor authentication (MFA) prompt...
OpenAI’s GPT-5.6 Sol on Ultrafast mode is available in limited preview to a select group of customers, launching first through the OpenAI API. The company says the service runs up to 14 times faster than Standard processing and generates up to 750 output tokens per second. Ultrafast is powered by Ce...
The ShinyHunters extortion group stole personal information from 1.6 million RingCentral accounts after hacking the company in July, according to the data breach notification service Have I Been Pwned. [...]
AmnesiaStealer contains novel functions, including the attackers gaining remote control over the victim’s browser to steal cookie data
Apple on Thursday sent a fresh batch of notifications to customers whom it suspects may have been targeted by mercenary spyware attacks.
In a statement shared with TechCrunch, the iPhone maker said it alerted an unspecified number of users targeted in 110 countries and that it has notified customer...
Even if your hardware is secure, quantum-ready, encrypted, and future-proof, no one is immune to a supplier letting the side down
The hackers published the allegedly stolen information, including names, addresses, email addresses, and phone numbers.
The post 1.6 Million Likely Impacted by RingCentral Data Breach appeared first on SecurityWeek.
Une nouvelle base attribuée à un professionnel des jeux VR expose clients et plusieurs catégories de données sensibles.
A new White House memo signed by U.S. President Donald Trump has instructed the National Coordination Center (NCC) to establish a program that would allow private sector companies to take advantage of their "innovative capabilities" to break into foreign Transnational Criminal Organizations (TCOs) a...
The Gmail “Send as” feature is disappearing. See what's changing, who will be affected, and where you can find a more private alternative.
The root cause of the incident is believed to be a compromised AWS access key that was exposed in publicly available JavaScript build artifacts.
The post Over 1,000 Charities Hit by Beacon CRM Data Breach appeared first on SecurityWeek.
Akira ransomware affiliates were seen using a new technique to evade endpoint detection and response (EDR), where they rebooted a compromised Windows system into Safe Mode with Networking enabled.
According to Huntress, the technique successfully took both its agent and Mic...
Cybersecurity teams should be responsible for risk oversight, rather than for executing every corrective action. Assigning security teams the tasks of finding, prioritizing, assigning, implementing, tracking and validating every remediation does not foster accountability. Inst...
A vulnerability in the unzip program could allow arbitrary code execution from specially crafted files. Debian recommends upgrading to version 6.0-29+deb13u1 to fix this issue.
Unnamed third party spotted suspicious activity, with names, roles, and email addresses potentially affected
AmnesiaStealer targets macOS users through fake GitHub pages, stealing passwords, cookies and data while giving attackers live control of the browser. Jamf Threat Labs researchers disclosed AmnesiaStealer, a new multi-stage Rust-based macOS infostealer that spread through a counterfeit GitHub downlo...
A former data analyst contractor for Brightly Software has been sentenced to two years in prison for targeting his employer in a $2.5 million extortion scheme. [...]
AWS Certificate Manager (ACM) will phase out email validation for public certificates throughout 2027, ahead of the Certification Authority/Browser (CA/B) Forum’s March 15, 2028 deadline for ending email-based domain validation. The CA/B Forum sets standards that browsers and certificate authorities...