Now if only someone would remember to apply those rules inside the DoD It’s about to get a lot harder for private companies that are lax on cybersecurity to get a contract with the Pentagon, as the Defense Department has…
Category: The Register – Security
Defense Dept didn’t protect social media accounts, left stream keys out in public
‘The practice… has since been fixed,’ Pentagon official tells The Reg The US Department of Defense, up until this week, routinely left its social media accounts wide open to hijackers via stream keys – unique, confidential identifiers generated by streaming…
No gains, just pains as 1.6M fitness phone call recordings exposed online
HelloGym’s data security clearly skipped leg day Exclusive Sensitive info from hundreds of thousands of gym customers and staff – including names, financial details, and potentially biometric data in the form of audio recordings – was left sitting in an…
What the Plex? Streaming service suffers yet another password spill
For the third time in a decade Streaming platform Plex is warning some users to reset their passwords after suffering yet another breach.… This article has been indexed from The Register – Security Read the original article: What the Plex?…
Anthropic’s Claude Code runs code to test if it is safe – which might be a big mistake
AI security reviews add new risks, say researchers App security outfit Checkmarx says automated reviews in Anthropic’s Claude Code can catch some bugs but miss others – and sometimes create new risks by executing code while testing it.… This article…
Nokia successor HMD spawns secure device biz with Euro-made smartphone
Ivalo XE handset targets governments and security critical sectors, though Qualcomm silicon keeps it tied to the US Finnish phone maker HMD Global is launching a business unit called HMD Secure to target governments and other security-critical customers, and has…
UK toughens Online Safety Act with ban on self-harm content
Charities welcome change, but critics warn the law is already too broad Tech companies will be legally required to prevent content involving self-harm from appearing on their platforms – rather than responding and removing it – in a planned amendment…
Forget disappearing messages – now Signal will store 100MB of them for you for free
Including messages sent to users, a potential problem for the privacy-conscious Encrypted messaging app Signal is rolling out a free storage system for its users, with extra space if folks are willing to pay for it.… This article has been…
WhatsApp’s former security boss claims reporting infosec failings led to ousting
Meta shrugs off allegations of improper dismissal, ignoring privacy and security WhatsApp’s former head of security, Attaullah Baig, has filed a lawsuit against its parent company, Meta, alleging that the social media megalith retaliated against him for reporting security failings…
The US government has no idea how many cybersecurity pros it employs
Auditors find federal cybersecurity workforce data messy, incomplete, and unreliable The US federal government employs tens of thousands of cybersecurity professionals at a cost of billions per year – or at least it thinks it does, as auditors have found…
Drift massive attack traced back to loose Salesloft GitHub account
Meanwhile the victim count grows The Salesloft Drift breach that compromised “hundreds” of companies including Google, Palo Alto Networks, and Cloudflare, all started with miscreants gaining access to the Salesloft GitHub account in March.… This article has been indexed from…
Dev snared in crypto phishing net, 18 npm packages compromised
Popular npm packages debug, chalk, and others hijacked in massive supply chain attack Crims have added backdoors to at least 18 npm packages after developer Josh Junon inadvertently authorized a reset of the two-factor authentication protecting his npm account.… This…
Salt Typhoon used dozens of domains, going back five years. Did you visit one?
Plus ties to the Chinese spies who hacked Barracuda email gateways Security researchers have uncovered dozens of domains used by Chinese espionage crew Salt Typhoon to gain stealthy, long-term access to victim organizations going back as far as 2020.… This…
PACER buckles under MFA rollout as courts warn of support delays
Busy lawyers on hold for five hours as staff handhold users into deploying the security measure US courts have warned of delays as PACER, the system for accessing court documents, struggles to support users enrolling in its mandatory MFA program.……
CISA sounds alarm over TP-Link wireless routers under attack
Plus: Google clears up Gmail concerns, NSA drops SBOM bomb, Texas sues PowerSchool, and more Infosec in brief The US Cybersecurity and Infrastructure Security Agency (CISA) has said two flaws in routers made by Chinese networking biz TP-Link are under…
UK tech minister booted out in weekend cabinet reshuffle
Fallout from latest political drama sparks a changing of the guard UK prime minister Sir Keir Starmer cleared out the officials in charge of tech and digital law in a dramatic cabinet reshuffle at the weekend.… This article has been…
The crazy, true story behind the first AI-powered ransomware
tldr; boffins did it interview It all started as an idea for a research paper. … This article has been indexed from The Register – Security Read the original article: The crazy, true story behind the first AI-powered ransomware
Shell to pay: Crims invade your PC with CastleRAT malware, now in C and Python
Pro tip, don’t install PowerShell commands without approval A team of data thieves has doubled down by developing its CastleRAT malware in both Python and C variants. Both versions spread by tricking users into pasting malicious commands through a technique…
Critical, make-me-super-user SAP S/4HANA bug under active exploitation
9.9-rated flaw on the loose, so patch now A critical code-injection bug in SAP S/4HANA that allows low-privileged attackers to take over your SAP system is being actively exploited, according to security researchers.… This article has been indexed from The…
Knock-on effects of software dev break-in hit schools trust
Affinity Learning Partnership warns staff after Intradev breach A major UK education trust has warned staff that their personal information may have been compromised following a cyberattack on software developer Intradev in August.… This article has been indexed from The…