Mozilla CTO says AI means developers finally have a chance to get on top of security The Mozilla Foundation has revealed it tested Anthropic’s bug-finding “Mythos” AI model and feels the results it experienced represent a watershed moment for software…
Category: The Register – Security
Nation-states want to cause harm, not just steal cash – stop handing your cyber defenses to the cheapest contractor
NCSC boss says China’s whole-of-state cyber machine has become Britain’s peer competitor in cyberspace State-sponsored cyberattacks from Chinese intelligence and military agencies display “an eye-watering level of sophistication,” UK National Cyber Security Centre CEO Richard Horne is expected to say…
Murder, she wrote: Ex-FBI chief wants some ransomware crims charged with homicide
Lawmakers decry CISA cuts: ‘We are shooting ourselves in the foot’ If a cyberattack leads to a death, that’s murder. A former FBI cyber division chief urged the US Justice Department to consider felony homicide charges against ransomware actors when…
More Cisco SD-WAN bugs battered in attacks
CISA gives federal agencies 4 days to patch America’s lead cyber-defense agency has warned that three Cisco Catalyst SD-WAN Manager bugs are under attack, and given federal agencies just four days to patch the security holes.… This article has been…
macOS ClickFix attacks deliver AppleScript stealers to snarf credentials, wallets
Data from browsers, cryptocurrency wallets, 200+ extensions hoovered up A ClickFix campaign targeting macOS users delivers an AppleScript-based infostealer that collects credentials and live session cookies from 14 browsers, 16 cryptocurrency wallets, and more than 200 extensions.… This article has…
Yet another ex-ransomware negotiator admits turning rogue after payoff from crimelords
Plus: Court papers reveal nonprofit paid a ransom worth nearly $26.8 million The third of three former ransomware negotiators accused of assisting the ALPHV/BlackCat ransomware gang in extorting US businesses has pleaded guilty, months after his two co-workers did the…
AI-assisted intruders pwned Vercel via OAuth abuse and a pilfered employee account
CEO suspects silicon sidekick behind ‘surprising velocity’ breach – cyber crims shop stolen data for $2M Vercel’s CEO reckons the crooks behind its recent breach likely had a helping hand from AI, saying the attackers moved with “surprising velocity” and…
Crook claims to leak ‘video surveillance footage’ of companies
Mexican IT services firm admits it was hacked, but says client operations weren’t affected A Mexican IT infrastructure and digital transformation biz is on clean-up duty after a criminal posted screenshots of what they claimed was company video surveillance footage…
Met police trials snoop tech platform in push to cuff more London shoplifters
No facial recognition privacy intrusions either! Well, maybe a little London’s Metropolitan Police is trialing new retail technology to help curtail the city’s pervasive shoplifting problem… and it doesn’t rely on live facial recognition (LFR).… This article has been indexed…
Adaptavist Group breach spawns imposter emails as ransomware crew claims mega-haul
Fake emails already doing the rounds as ransomware crew boasts about what it allegedly stole UK enterprise software consultancy The Adaptavist Group is investigating a security breach after an intruder logged in with stolen credentials, while a ransomware crew claims…
Panasonic creates device-locked QR codes to speed facial biometric capture
Admins are tired of taking photos, so this enables secure on-site unattended enrolment Japanese industrial giant Panasonic has created a new form of QR code it says will only work on designated devices and environments.… This article has been indexed…
Iran claims US used backdoors to knock out networking equipment during war
And China is loving it Iranian media is claiming that the US used backdoors and/or botnets to disable networking equipment during the current war, and Chinese state media is dining out on the allegations.… This article has been indexed from…
Vibe coding upstart Lovable denies data leak, cites ‘intentional behavior,’ then throws HackerOne under the bus
A lesson in how not to respond to vulnerability reports Vibe-coding platform Lovable is pooh-poohing a researcher’s finding that anyone could open a free account on the service and read other users’ sensitive info, including credentials, chat history, and source…
Claude Desktop changes app access settings for browsers you don’t even have installed yet
Installation and pre-approval without consent looks dubious under EU law One app should not modify another app without asking for and receiving your explicit consent. Yet Anthropic’s Claude Desktop for macOS installs files that affect other vendors’ applications without disclosure,…
Scot becomes second Scattered Spider-linked crook to plead guilty in US
Tyler Buchanan admits role in scheme that stole at least $8 million in virtual currency A Scottish man linked to the Scattered Spider cybercrime crew has pleaded guilty in the US to a phishing and SIM-swap scheme that stole at…
Microsoft releases Windows Server update fix to fix its April update fixes
Out-of-band or out of control? Microsoft has pushed out an out-of-band update to address the restart loop that hit some Windows Server devices after its April update.… This article has been indexed from The Register – Security Read the original…
Next.js developer Vercel warns of customer credential compromise
Blames outfit called Context.ai, which reckons an agentic OAuth tangle caused the incident Vercel, the company that created the open source Next.js web development framework, has a data leak that led to compromise of some customer credentials, and blamed an…
Just like phishing for gullible humans, prompt injecting AIs is here to stay
Aren’t we all just prompting tokens of linguistic meaning and hoping the other person isn’t bullshitting us? kettle It’s a week of the year, which means there’s been the discovery of yet another prompt injection attack that will force supposedly…
I meant to do that! AI vendors shrug off responsibility for vulns
Passing the buck, and the blame, down the road shows lack of AI companies’ maturity OPINION AI vendors: “You need to use AI to fight AI threats (and do everything else in your corporate IT environment).” Also AI vendors: “That’s…
CISA tells feds to patch 13-year-old Apache ActiveMQ bug under active attack
Bug hiding in plain sight for over a decade lands on KEV list CISA is sounding the alarm on a newly-exploited Apache ActiveMQ bug, ordering federal agencies to patch within two weeks as attackers circle a flaw that’s been quietly…