As you should, when being told the only remedy is deleting everything and starting again On Call 2025 has ended and a new year is upon us, but The Register will continue opening Friday mornings with a fresh installment of…
Category: The Register – Security
As agents run amok, CrowdStrike’s $740M SGNL deal aims to help get a grip on identity security
Authentication is basically solved. Authorization is another thing entirely… CrowdStrike has signed a $740 million deal to buy identity security startup SGNL. The move underscores the growing threat of identity-based attacks as companies struggle to secure skyrocketing numbers of non-human…
Patch Cisco ISE bug now before attackers abuse proof-of-concept exploit
No reports of active exploitation … yet Cisco patched a bug in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) products that allows remote attackers with admin-level privileges to access sensitive information – and warned that a…
Ransomware attacks kept climbing in 2025 as gangs refused to stay dead
Cop wins hit crime infrastructure, not the people behind it If 2025 was meant to be the year ransomware started dying, nobody appears to have told the attackers.… This article has been indexed from The Register – Security Read the…
CISA flags actively exploited Office relic alongside fresh HPE flaw
Max-severity OneView hole joins a PowerPoint bug that should’ve been retired years ago CISA has added a pair of security holes to its actively exploited list, warning that attackers are now abusing a maximum-severity bug in HPE’s OneView management software…
UK regulators swarm X after Grok generated nudes from photos
Lawyers say Musk’s platform may face punishment under Online Safety Act priority offenses Elon Musk’s X platform is under fire as UK regulators close in on mounting reports that the platform’s AI chatbot, Grok, is generating sexual imagery without users’…
Maximum-severity n8n flaw lets randos run your automation server
Unauthenticated RCE means anyone on the network can seize full control A maximum-severity bug in the popular automation platform n8n has left an estimated 100,000 servers wide open to complete takeover, courtesy of a flaw so bad it doesn’t even…
Are criminals vibe coding malware? All signs point to yes
They also hallucinate when writing ransomware code Interview With everyone from would-be developers to six-year-old kids jumping on the vibe coding bandwagon, it shouldn’t be surprising that criminals like automated coding tools too.… This article has been indexed from The…
OpenAI putting bandaids on bandaids as prompt injection problems keep festering
Happy Groundhog Day! Security researchers at Radware say they’ve identified several vulnerabilities in OpenAI’s ChatGPT service that allow the exfiltration of personal information.… This article has been indexed from The Register – Security Read the original article: OpenAI putting bandaids…
Logitech macOS mouse mayhem traced to expired dev certificate
Company says it dropped the ball, apologizes for wasting people’s time Logitech says an expired developer certificate is to blame after swaths of customers were left infuriated when their mice malfunctioned.… This article has been indexed from The Register –…
Cloudflare pours cold water on ‘BGP weirdness preceded US attack on Venezuela’ theory
Suggests rotten routing, not evidence of a cyber-strike before kinetic action Cloudflare has poured cold water on a theory that the USA’s incursion into Venezuela coincided with a cyberattack on telecoms infrastructure.… This article has been indexed from The Register…
IBM’s AI agent Bob easily duped to run malware, researchers show
Prompt injection lets risky commands slip past guardrails IBM describes its coding agent thus: “Bob is your AI software development partner that understands your intent, repo, and security standards.” Unfortunately, Bob doesn’t always follow those security standards.… This article has…
ESA calls cops as crims lift off 500 GB of files, say security black hole still open
Two weeks, two major data leaks … not a good look for the European Space Agency exclusive The European Space Agency on Wednesday confirmed yet another massive security breach, and told The Register that the data thieves responsible will be…
Stalkerware slinger pleads guilty for selling snooper software to suspicious spouses
pcTattletale boss Bryan Fleming faces up to 15 years in prison when sentenced later this year The US government has secured a guilty plea from a stalkerware maker in federal court, marking just the second time in more than a…
Microsoft scraps Exchange Online spam clamp after customers cry foul
Negative feedback sinks Redmond’s plan to cap outbound email recipients Microsoft has backed away from planned changes to Exchange Online after customers objected to limits designed to curb outbound email abuse.… This article has been indexed from The Register –…
Ministry of Justice splurged £50M on security – still missed Legal Aid Agency cyberattack
High-risk system compromised long before intrusion was finally spotted The UK’s Ministry of Justice spent £50 million ($67 million) on cybersecurity improvements at the Legal Aid Agency (LAA) before the high-profile cyberattack it disclosed last year.… This article has been…
Jaguar Land Rover wholesale volumes plummet 43% in cyberattack aftermath
Production halts and supply-chain disruption left luxury automaker reeling in fiscal Q3 Brit luxury automaker Jaguar Land Rover has reported devastating preliminary Q3 results that lay bare the cascading consequences of a crippling cyberattack, revealing wholesale volumes collapsed more than…
HSBC app takes a dim view of sideloaded Bitwarden installations
Customers report being locked out after grabbing the password manager via F-Droid Some HSBC mobile banking customers in the UK report being locked out of the bank’s app after installing the Bitwarden password manager via an open source app catalog.……
HackerOne ‘ghosted’ me for months over $8,500 bug bounty, says researcher
Long after CVEs issued and open source flaws fixed Last fall, Jakub Ciolek reported two denial-of-service bugs in Argo CD, a popular Kubernetes controller, via HackerOne’s Internet Bug Bounty (IBB) program. Both were assigned CVEs and have since been fixed.…
Brightspeed investigates breach as crims post stolen data for sale
Crimson Collective claims ‘sophisticated attack’ that allows them to ‘disconnect every user from their mobile service’ Internet service provider Brightspeed confirmed that it’s investigating criminals’ claims that they stole more than a million customers’ records and have listed them for…