No rush, according to Gartner chap who says: ‘Nobody has ever out-patched threat actors at scale’ Patch Tuesday has rolled around again, but if you don’t rush to implement the feast of fixes it delivered, your security won’t be any…
Category: The Register – Security
Everyone’s deploying AI, but no one’s securing it – what could go wrong?
Crickets as senior security folk asked about risks at NCSC conference CYBERUK Peter Garraghan – CEO of Mindgard and professor of distributed systems at Lancaster University – asked the CYBERUK audience for a show of hands: how many had banned…
Ransomware scum have put a target on the no man’s land between IT and operations
Defenses are weaker, and victims are more likely to pay, SANS warns Criminals who attempt to damage critical infrastructure are increasingly targeting the systems that sit between IT and operational tech.… This article has been indexed from The Register –…
Apple patched one first, but Microsoft’s blasted five exploited flaws this Pa-Tu
Plus: All the fun and frolic of fixes from Adobe, SAP, Ivanti Patch Tuesday It’s that time of the month again, and Microsoft has made it extra spicy by revealing five flaws it says are under active exploitation – but…
Intel’s data-leaking Spectre defenses scared off yet again
ETH Zurich boffins exploit branch prediction race condition to steal info from memory, fixes have mild perf hit Researchers at ETH Zurich in Switzerland have found a way around Intel’s defenses against Spectre, a family of data-leaking flaws in the…
Qatar’s $400M jet for Trump is a gold-plated security nightmare
Air Force Dumb The Trump administration is set to accept a $400 million luxury 747-8 from the royal family of Qatar – a lavish “palace in the sky” meant as a temporary Air Force One. But getting it up to…
Commvault fixes critical Command Center issue after flaw finder alert
Pay-to-play security on CVSS 10 issue is now fixed An update that fixed a critical flaw in data protection biz Commvault’s Command Center was initially not available to a significant user subset – those testing out a free trial version…
‘We still have embeds in CISA’: CTO of Brit cyber agency talks post-Trump relationship with US counterpart
Both agencies seem unbothered despite tech world’s clear concerns for US infoseccers CYBERUK The top brass from the UK’s cyber agency say everything is business as usual when it comes to the GCHQ arm’s relationship with CISA, amid growing unease…
Marks & Spencer admits cybercrooks made off with customer info
Market cap down by more than £1BN since April 22 Marks & Spencer has confirmed that customer data was stolen as part of its cyberattack, fueling conjecture that ransomware was involved.… This article has been indexed from The Register –…
As US vuln-tracking falters, EU enters with its own security bug database
EUVD comes into play not a moment too soon The European Vulnerability Database (EUVD) is now fully operational, offering a streamlined platform to monitor critical and actively exploited security flaws amid the US struggles with budget cuts, delayed disclosures, and…
Türkiye-linked spy crew exploited a messaging app zero-day to snoop on Kurdish army in Iraq
‘MarbledDust’ gang has honed the skills it uses to assist Ankara Turkish spies exploited a zero-day bug in a messaging app to collect info on the Kurdish army in Iraq, according to Microsoft, which says the attacks began more than…
M365 apps on Windows 10 to get security fixes into 2028
Support for the underlying OS is another story Microsoft has pledged to support and issue security fixes for M365 apps on Windows 10 into late 2028. That’s well past a cut-off point of October 14 this year, when Redmond’s support…
CISA mutes own website, shifts routine cyber alerts to Musk’s X, RSS, email
Cripes, we were only joking when we called Elon’s social network the new state media The US government’s Cybersecurity and Infrastructure Security Agency (CISA) announced Monday that going forward, only urgent alerts tied to emerging threats or major cyber activity…
Why aggregating your asset inventory leads to better security
Today’s complex IT environments demand a new approach Partner content For many organizations, managing IT assets is like trying to complete a jigsaw puzzle without all the pieces. Despite massive investments in security tools and controls, many companies still have…
Attackers pwn charter airline helping Trump’s deportation campaign
Intruders claim they stole GlobalX’s flight records and manifests GlobalX, a charter airline used for deportations by the US government, has admitted someone broke into its network infrastructure.… This article has been indexed from The Register – Security Read the…
Britain’s cyber agents and industry clash over how to tackle shoddy software
Providers argue that if end users prioritized security, they’d get it CYBERUK Intervention is required to ensure the security market holds vendors to account for shipping insecure wares – imposing costs on those whose failures lead to cyberattacks and having…
Unending ransomware attacks are a symptom, not the sickness
We need to make taking IT systems ‘off the books’ a problem for corporate types Opinion It’s been a devastating few weeks for UK retail giants. Marks and Spencer, the Co-Op, and now uber-posh Harrods have had massive disruptions due…
DOGE worker’s old creds found exposed in infostealer malware dumps
PLUS: Celsius scammer sent to slammer; Death-by-hacking victim warns you’re never safe; and more Infosec in brief Good cybersecurity habits don’t appear to qualify anyone to work at DOGE, as one Musk minion seemingly fell victim to infostealer malware.… This…
You think ransomware is bad now? Wait until it infects CPUs
Rapid7 threat hunter told The Reg wrote a PoC. No he’s not releasing it RSAC If Rapid7’s Christiaan Beek decided to change careers and become a ransomware criminal, he knows exactly how he’d innovate: CPU ransomware.… This article has been…
Feds disrupt proxy-for-hire botnet, indict four alleged net miscreants
The FBI also issued a list of end-of-life routers you need to replace Earlier this week, the FBI urged folks to bin aging routers vulnerable to hijacking, citing ongoing attacks linked to TheMoon malware. In a related move, the US…
UK Ministry of Defence is spending less with US biz, and more with Europeans
France’s share of MOD cash is growing while the US’s shrinks The UK’s Ministry of Defence (MOD) is gradually shifting its spending from the US to Europe, according to research from Tussell.… This article has been indexed from The Register…
VC behemoth Insight Partners fears top-secret financial info swiped by cyber-miscreants
Weapons-grade fuel for fraud Insight Partners, a mega venture capital firm with more than $90 billion in funds under management, fears network intruders got their hands on internal sensitive data about employees, portfolio companies, investors, and more.… This article has…
openSUSE deep sixes Deepin desktop over security stink
Linux giant finds Chinese environment to be perilous beneath pretty exterior SUSE has kicked the Deepin Desktop Environment (DDE) out of its community-driven Linux distro, openSUSE, and the reasons it gives for doing so are revealing.… This article has been…
Sudo-rs make me a sandwich, hold the buffer overflows
Ubuntu 25.10 fitted with Rust-written admin tool by default for memory safety’s sake Canonical’s Ubuntu 25.10 is set to make sudo-rs, a Rust-based rework of the classic sudo utility, the default – part of a push to cut memory-related security…
PowerSchool paid thieves to delete stolen student, teacher data. Crooks may have lied
Now individual school districts extorted by fiends An education tech provider that paid a ransom to prevent the leak of stolen student and teacher data is now watching its school district customers get individually extorted by either the same ransomware…
After that 2024 Windows fiasco, CrowdStrike has a plan – jobs cuts, leaning on AI
CEO: Neural net tech ‘flattens our hiring curve, helps us innovate’ CrowdStrike – the Texas antivirus slinger famous for crashing millions of Windows machines last year – plans to cut five percent of its staff, or about 500 workers, in…
Delta Air Lines class action cleared for takeoff over CrowdStrike chaos
Judge allows aspects of passenger lawsuit to proceed A federal judge has cleared the runway for a class action from disgruntled passengers against Delta Air Lines as turbulence from last year’s CrowdStrike debacle continues to buffet the carrier.… This article…
You’ll never guess which mobile browser is the worst for data collection
We were shocked – SHOCKED – by the answer Mirror, mirror on the wall, who is the slurpiest mobile browser of them all? The answer, according to VPN vendor Surfshark, is Chrome.… This article has been indexed from The Register…
Curl project founder snaps over deluge of time-sucking AI slop bug reports
Lead dev likens flood to ‘effectively being DDoSed’ Curl project founder Daniel Stenberg is fed up with of the deluge of AI-generated “slop” bug reports and recently introduced a checkbox to screen low-effort submissions that are draining maintainers’ time.… This…
New Zealand kind-of moves to ban social media for under-16s, require age checks for new accounts
Prime Minister bemoans bullying, addiction, and inappropriate content – but isn’t planning a rapid vote New Zealand’s government has signaled its support for a bill to ban social media for children under 16, but without explicitly making it a government…
Super spyware maker NSO must pay Meta $168M in WhatsApp court battle
Don’t f&#k with Zuck A California jury has awarded Meta more than $167 million in damages from Israeli surveillanceware slinger NSO Group, after the latter exploited a flaw in WhatsApp to allow its government customers to spy on supposedly secure…
Super spyware maker NSO must pay Meta $168M in WhatsApp snoop drama
Don’t f&#k with Zuck A California jury has awarded Meta more than $167 million in damages from Israeli surveillanceware slinger NSO Group, after the latter exploited a flaw in WhatsApp to allow its government customers to spy on supposedly secure…
Computacenter IT guy let girlfriend into Deutsche Bank server rooms, says fired whistleblower
What was the plan, showing her his big iron? A now-former manager at Computacenter claims he was unfairly fired after alerting management that a colleague was repeatedly giving his girlfriend unauthorized access to Deutsche Bank’s server rooms.… This article has…
Pentagon declares war on ‘outdated’ software buying, opens fire on open source
(If only that would keep folks off unsanctioned chat app side quests) The US Department of Defense (DoD) is overhauling its “outdated” software procurement systems, and insists it’s putting security at the forefront of decision-making processes.… This article has been…
Pentagon declares war on ‘outdated’ software buying
(If only that would keep folks off unsanctioned chat app side quests) The US Department of Defense (DoD) is overhauling its “outdated” software procurement systems, and insists it’s putting security at the forefront of decision-making processes.… This article has been…
CISA slammed for role in ‘censorship industrial complex’ as budget faces possible $500M cut
Because who needs cybersecurity when there’s culture wars to win President Trump’s dream 2026 budget would gut the US govt’s Cybersecurity and Infrastructure Security Agency, aka CISA, by $491 million – about 17 percent – and accuses the organization of…
Signal chat app clone used by Signalgate’s Waltz was apparently an insecure mess
No, really? That’s a shocking surprise An unidentified miscreant is said to have obtained US government communications from TeleMessage, a messaging and archiving app based on the open-source Signal app and used by ousted national security advisor Michael Waltz.… This…
Trump promises protection for TikTok, for which he has a ‘warm spot in my heart’
Hails DOGE operatives for computer skills during interview in which he also flubbed some tech investment figures US President Donald Trump has said TikTok will be “very strongly protected” as the made-in-China social network has “a warm spot in my…
India’s chipmaking ambitions hurt by Zoho’s no-go and Adani unease
PLUS: China spring cleans its AIs; South Korea fines Meta, probes Broadcom; and more! PLUS: China spring cleans its AIs; South Korea fines Meta, probes Broadcom; and more! India’s ambition to become a global semiconductor manufacturing player went backwards last…
Microsoft tries to knife passwords once and for all – at least for consumers
PLUS: AirPlay exploits; Six-year old backdoor opens; Raytheon settles federal charges; and more! Infosec In Brief Microsoft has decided to push its consumer customers to dump password in favor of passkeys.… This article has been indexed from The Register –…
RSAC wrap: AI and China on everything, everywhere, all at once
With North Korean IT workers storming the gates, too RSAC Another RSAC has come and gone, with almost 44,000 attendees this year spread across San Francisco’s Moscone Center and the surrounding facilities, according to conference organizers. Hopefully, all of us…
Altman’s eyeball-scanning biometric blockchain orbs officially come to America
El Reg checks out shop in SF On Thursday, six stores across America opened their doors with a curious proposition: Come on in, let a metal orb scan your irises, and walk out with a new online profile that promises…
Disney Slack attack wasn’t Russian protesters, just a Cali dude with malware
A 25-year-old California man pleaded guilty to stealing and dumping 1.1TB of data from the House of Mouse When someone stole more than a terabyte of data from Disney last year, it was believed to be the work of Russian…
Generative AI makes fraud fluent – from phishing lures to fake lovers
Real-time video deepfakes? Not convincing yet RSAC Spam messages predate the web itself, and generative AI has given it a fluency upgrade, churning out slick, localized scams and letting crooks hit regions and dialects they used to ignore.… This article…
Three Brits charged over ‘active shooter threats’ swattings in US, Canada
UK starts prosecution days after FBI vowed to clamp down on the crime Three young Brits are accused of stateside swatting offences and will appear in a UK court today to face their charges after a joint investigation by the…
British govt agents step in as Harrods becomes third mega retailer under cyberattack
Experts suggest the obvious: There is an ongoing coordinated attack on the Britain’s retail sector Globally recognized purveyor of all things luxury Harrods is the third major UK retailer to confirm an attempted cyberattack on its systems in under two…
Dems look to close the barn door after top DOGE dog has bolted
House Oversight probes missing Musk disclosures, background checks, data mess at NLRB Elon Musk is backing away from his Trump-blessed government gig, but now House Democrats want to see the permission slip that got him in the door.… This article…
Healthcare group Ascension discloses second cyberattack on patients’ data
This time criminals targeted partner’s third-party software It’s more bad news from Ascension Health which is informing some of its patients, potentially for the second time in the space of a year, that their medical data was compromised during a…
How Amazon red-teamed Alexa+ to keep your kids from ordering 50 pizzas
Will the personal assistant shop for groceries? Or get hijacked by a teen? RSAC If Amazon’s Alexa+ works as intended, it could show how an AI assistant helps with everyday tasks like making dinner reservations or arranging an oven repair.…
Chris Krebs loses Global Entry membership amid Trump feud
President’s campaign continues against man he claims covered up evidence of electoral fraud in 2020 Chris Krebs, former CISA director and current political punching bag for the US President, says his Global Entry membership was revoked.… This article has been…
Data watchdog will leave British Library alone – further probes ‘not worth our time’
No MFA? No problem – as long as you show you’ve learned your lesson The UK’s data protection overlord is not going to pursue any further investigation into the British Library’s 2023 ransomware attack.… This article has been indexed from…
Ex-NSA cyber-boss: AI will soon be a great exploit coder
For now it’s a potential bug-finder and friend to defenders RSAC Former NSA cyber-boss Rob Joyce thinks today’s artificial intelligence is dangerously close to becoming a top-tier vulnerability exploit developer.… This article has been indexed from The Register – Security…
Ex-CISA chief decries cuts as Trump demands loyalty above all else
Cybersecurity is national security, says Jen Easterly RSAC America’s top cyber-defense agency is “being undermined” by personnel and budget cuts under the Trump administration, some of which are being driven by an expectation of perfect loyalty to the President rather…
Maryland man pleads guilty to outsourcing US govt work to North Korean dev in China
Feds say $970K scheme defrauded 13+ companies A Maryland man has pleaded guilty to fraud after landing a job with a contractor working on US government software, and then outsourcing the work to a self-described North Korean developer in China.……
Maryland man pleads guilty to outsourcing US gov work to North Korean dev in China
Feds say $970k scheme defrauded 13+ companies A Maryland man has pleaded guilty to fraud after landing a job with a contractor working on US government software, and then outsourcing the work to a self-described North Korean developer in China.……
FBI steps in amid rash of politically charged swattings
No specific law against it yet, but that’s set to change A spate of high-profile swatting incidents in the US recently forced the FBI into action with its latest awareness campaign about the occasionally deadly practice.… This article has been…
Ghost in the shell script: Boffins reckon they can catch bugs before programs run
Go ahead, please do Bash static analysis Shell scripting may finally get a proper bug-checker. A group of academics has proposed static analysis techniques aimed at improving the correctness and reliability of Unix shell programs.… This article has been indexed…
Cloud doesn’t mean secure: How Intruder finds what others miss
A cloud security platform that manages the attack surface and security vulnerabilities in AWS Sponsored post You’d be naïve to believe that the cloud is secure by default, and while most hosting services provide basic defenses, it’s not always clear…
Watch out for any Linux malware sneakily evading syscall-watching antivirus
Google dumped io_uring after $1M in bug bounties A proof-of-concept program has been released to demonstrate a so-called monitoring “blind spot” in how some Linux antivirus and other endpoint protection tools use the kernel’s io_uring interface.… This article has been…
Enterprise tech dominates zero-day exploits with no signs of slowdown
As Big Tech gets used to the pain, smaller vendors urged to up their game This article has been indexed from The Register – Security Read the original article: Enterprise tech dominates zero-day exploits with no signs of slowdown
China now America’s number one cyber threat – US must get up to speed
Former Rear Admiral calls for National Guard online deployment and corporates to be held accountable RSAC Russia used to be considered America’s biggest adversary online, but over the past couple of years China has taken the role, and is proving…
Infosec pros tell Trump to quit bullying Chris Krebs – it’s undermining security
Top voices warn that political retaliation puts democracy and national defense at risk The Electronic Frontier Foundation (EFF) and numerous infosec leaders are lobbying US President Donald Trump to drop his enduring investigation into Chris Krebs, claiming that targeting the…
China is using AI to sharpen every link in its attack chain, FBI warns
Artificial intelligence is helping Beijing’s goons break in faster and stay longer RSAC The biggest threat to US critical infrastructure, according to FBI Deputy Assistant Director Cynthia Kaiser, can be summed up in one word: “China.”… This article has been…
The one interview question that will protect you from North Korean fake workers
FBI and others list how to spot NK infiltrators, but AI will make it harder RSAC Concerned a new recruit might be a North Korean stooge out to steal intellectual property and then hit an org with malware? There is…
Swiss boffins admit to secretly posting AI-penned posts to Reddit in the name of science
They’re sorry/not sorry for testing if bots can change minds by pretending to be a trauma counselor or a victim of sexual abuse Researchers from the University of Zurich have admitted to secretly posting AI-generated material to popular Subreddit r/changemyview…
Open source text editor poisoned with malware to target Uyghur users
Whoever could be behind this attack on an ethnic minority China despises? Researchers at Canada’s Citizen Lab have spotted a phishing campaign and supply chain attack directed at Uyghur people living outside China, and suggest it’s an example of Beijing’s…
Ex-Disney employee gets 3 years in the clink for goofy attacks on mousey menus
Florida man altered allergen info, DoSed former colleagues Former Disney employee Michael Scheuer was sentenced to 36 months in prison and fined almost $688,000 for screwing up a software application the entertainment giant used to cook up its restaurant menus.……
Cybersecurity CEO accused of running malware on hospital PC blabs about it on LinkedIn
Sometimes, silence is the best option An Oklahoma City cybersecurity professional accused of installing spyware on a hospital PC confirmed on LinkedIn key details of the drama.… This article has been indexed from The Register – Security Read the original…
How to survive as a CISO aka ‘chief scapegoat officer’
Whistleblowing, email is evidential mail, HR is not your friend, and more discussed by CxO panel RSAC Chief security officers should negotiate personal liability insurance and a golden parachute when they start a new job – in case things go…
Admission impossible: NSA, CISA brass absent from RSA Conf
Homeland Security boss Noem added as last-minute keynote, mind you RSAC There’s a notable absence from this year’s RSA Conference that kicked off today in San Francisco: The NSA’s State of the Hack panel.… This article has been indexed from…
The future of AI in cybersecurity in a word: Optimistic
Think of artificial intelligence as your embedded ally Sponsored post AI is reshaping cybersecurity in real time, raising the stakes on both sides of the battlefield. For defenders, it brings speed, precision, and automation at scale, helping security teams detect…
From 112K to 4M folks’ data – HR biz attack goes from bad to mega bad
It took a 1 year+ probe, plenty of client calls for VeriSource to understand just how much of a yikes it has on its hands Houston-based VeriSource Services’ long-running probe into a February 2024 digital break-in shows the data of…
From 112k to 4 million folks’ data – HR biz attack goes from bad to mega bad
It took a 1 year+ probe, plenty of client calls for VeriSource to understand just how much of a yikes it has on its hands Houston-based VeriSource Services’ long-running probe into a February 2024 digital break-in shows the data of…
Back online after ‘catastrophic’ attack, 4chan says it’s too broke for good IT
Image board hints that rumors of a poorly maintained back end may be true Clearweb cesspit 4chan is back up and running, but says the damage caused by a cyberattack earlier this month was “catastrophic.”… This article has been indexed…
4chan back online after ‘catastrophic’ attack, says it’s too broke for good IT
Image board hints that rumors of a poorly maintained back end may be true Clearweb cesspit 4chan is back up and running, but says the damage caused by a cyberattack earlier this month was “catastrophic.”… This article has been indexed…
Microsoft pitches pay-to-patch reboot reduction subscription for Windows Server 2025
Redmond reckons $1.50/core/month hotpatch service is worth it to avoid eight Patch Tuesday scrambles each year Microsoft has announced that its preview of hotpatching for on-prem Windows Server 2025 will become a paid subscription service in July.… This article has…
Samsung admits Galaxy devices can leak passwords through clipboard wormhole
PLUS: Microsoft fixes messes China used to attack it; Mitre adds ESXi advice; Employee-tracking screenshots leak; and more! Infosec in brief Samsung has warned that some of its Galaxy devices store passwords in plaintext.… This article has been indexed from…
Signalgate lessons learned: If creating a culture of security is the goal, America is screwed
Infosec is a team sport … unless you’re in the White House Opinion Just when it seems they couldn’t be that careless, US officials tasked with defending the nation go and do something else that puts American critical infrastructure, national…
Amid CVE funding fumble, ‘we were mushrooms, kept in the dark,’ says board member
What next for US-bankrolled vulnerability tracker? It’s edging closer to a more independent, global future Kent Landfield, a founding member of the Common Vulnerabilities and Exposures (CVE) program and member of the board, learned through social media that the system…
More Ivanti attacks may be on horizon, say experts who are seeing 9x surge in endpoint scans
GreyNoise says it is the kind of activity that typically precedes new vulnerability disclosures Ivanti VPN users should stay alert as IP scanning for the vendor’s Connect Secure and Pulse Secure systems surged by 800 percent last week, according to…
Oh, cool. Microsoft melts bug that froze Server 2025 Remote Desktop sessions
Where have we heard this before? Feb security update needs its own fix More than one month after complaints starting flying, Microsoft has fixed a Windows bug that caused some Remote Desktop sessions to freeze.… This article has been indexed…
M&S stops online orders as ‘cyber incident’ issues worsen
One step forward and one step back as earlier hopes of progress dashed by latest update Marks & Spencer has paused online orders for customers via its website and app as the UK retailer continues to wrestle with an ongoing…
Emergency patch for potential SAP zero-day that could grant full system control
German software giant paywalls details, but experts piece together the clues SAP’s latest out-of-band patch is for a perfect 10/10 bug in NetWeaver that experts suspect could have already been exploited as a zero-day.… This article has been indexed from…
Claims assistance firm fined for cold-calling people who put themselves on opt-out list
Third-party data supplier also in hot water with Brit regulator over consent issues Britain’s data privacy watchdog has slapped a fine of £90k ($120k) on a business that targeted people with intrusive marketing phone calls, despite them being registered with…
Darcula adds AI to its DIY phishing kits to help would-be vampires bleed victims dry
Because coding phishing sites from scratch is a real pain in the neck Darcula, a cybercrime outfit that offers a phishing-as-a-service kit to other criminals, this week added AI capabilities to its kit that help would-be vampires spin up phishing…
SSNs and more on 5.5M+ patients feared stolen from Yale Health
At least it wasn’t Harvard Yale New Haven Health has notified more than 5.5 million people that their private details were likely stolen by miscreants who broke into the healthcare system’s network last month.… This article has been indexed from…
Microsoft mystery folder fix might need a fix of its own
This one weird trick can stop Windows updates dead in their tracks Turns out Microsoft’s latest patch job might need a patch of its own, again. This time, the culprit is a mysterious inetpub folder quietly deployed by Redmond, now…
Assassin’s Creed maker faces GDPR complaint for forcing single-player gamers online
Collecting data from solo players is a Far Cry from being necessary, says noyb For anyone who’s ever been frustrated by the need to go online to play a single-player video game, the European privacy specialists at noyb have heard…
M&S takes systems offline as ‘cyber incident’ lingers
Customers told to expect further delays as contactless payments still down UK high street retailer Marks & Spencer says contactless payments are still down following its “cyber incident” and order delays are likely to continue.… This article has been indexed…
Your vendor may be the weakest link: Percentage of third-party breaches doubled in a year
Cybercriminals are targeting software shops, accountants, lawyers The percentage of confirmed data breaches involving third-party relationships doubled last year as cybercriminals increasingly exploited weak links in supply chains and partner ecosystems.… This article has been indexed from The Register –…
Booby-trapped Alpine Quest Android app geolocates Russian soldiers
Back of the nyet! Russian soldiers are being targeted with an Android app specially altered to pinpoint their location and scan their phones for files, with the ability to exfiltrate sensitive documents if instructed.… This article has been indexed from…
Ransomware scum and other crims bilked victims out of a ‘staggering’ $16.6B last year, says FBI
Biggest threat to America’s critical infrastructure? Ransomware Digital scammers and extortionists bilked businesses and individuals in the US out of a “staggering” $16.6 billion last year, according to the FBI — the highest losses recorded since bureau’s Internet Crime Complaint…
Blue Shield says it shared health info on up to 4.7M patients with Google Ads
Tech giants don’t need smartphone mics to target adverts – your insurer just gives your data away, anyway US health insurance giant Blue Shield of California handed sensitive health information belonging to as many as 4.7 million members to Google’s…
Ripple NPM supply chain attack hunts for private keys
A mystery thief and a critical CVE involved in crypto cash grab Many versions of the Ripple ledger (XRPL) official NPM package are compromised with malware injected to steal cryptocurrency.… This article has been indexed from The Register – Security…
We’re calling it now: Agentic AI will win RSAC buzzword Bingo
All aboard the hype train The security industry loves its buzzwords, and this is always on full display at the annual RSA Conference event in San Francisco. Don’t believe us? Take a lap on the expo floor, and you’ll be…
Who needs phishing when your login’s already in the wild?
Stolen credentials edge out email tricks for cloud break-ins because they’re so easy to get Criminals used stolen credentials more frequently than email phishing to gain access into their victims’ IT systems last year, marking the first time that compromised…
Ex-NSA chief warns AI devs: Don’t repeat infosec’s early-day screwups
Bake in security now or pay later, says Mike Rogers AI engineers should take a lesson from the early days of cybersecurity and bake safety and security into their models during development, rather than trying to bolt it on after…
America’s cyber defenses are being dismantled from the inside
The CVE system nearly dying shows that someone has lost the plot Opinion We almost lost the Common Vulnerabilities and Exposures (CVE) database system, but that’s only the tip of the iceberg of what President Trump and company are doing…
RIP, Google Privacy Sandbox
Chrome will keep third-party cookies, a loss for privacy but a win for web ad rivals After six years of work, Google’s Privacy Sandbox, technology for delivering ads while protecting privacy, looks like dust in the wind.… This article has…
Two CISA officials jump ship, both proud of pushing for Secure by Design software
As cyber-agency faces cuts, makes noises about switching up program Two top officials have resigned from Uncle Sam’s Cybersecurity and Infrastructure Security Agency, aka CISA, furthering fears of a brain drain amid White House cuts to the federal workforce.… This…