Law enforcement agencies from the United States and France have seized the onion leak website operated by the notorious Scattered LAPSUS$ Hunters collective, displaying a prominent seizure notice featuring logos from the FBI, Department of Justice, and international partners. This…
Hackers Exploiting Microsoft WSUS Vulnerability In The Wild – 2800 Instances Exposed Online
Hackers are actively exploiting a critical flaw in Microsoft’s Windows Server Update Services (WSUS), with security researchers reporting widespread attempts in the wild. The vulnerability, tracked as CVE-2025-59287, allows remote code execution on unpatched WSUS servers, potentially granting attackers full…
Critical Dell Storage Manager Vulnerabilities Let Attackers Compromise System
Dell Technologies has disclosed three critical vulnerabilities in its Storage Manager software that could allow attackers to bypass authentication, disclose sensitive information, and gain unauthorized access to systems. Announced on October 24, 2025, these flaws affect versions of Dell Storage…
Infamous Cybercriminal Forum BreachForums Is Back Again With a New Clear Net Domain
The notorious cybercrime forum BreachForums has resurfaced online, this time on a clearnet domain accessible without specialized tools like Tor. The platform, long a hub for data leaks, hacking tools, and illicit trades, went dark earlier this year following a…
ChatGPT Atlas Browser Can Be Tricked by Fake URLs into Executing Hidden Commands
The newly released OpenAI Atlas web browser has been found to be susceptible to a prompt injection attack where its omnibox can be jailbroken by disguising a malicious prompt as a seemingly harmless URL to visit. “The omnibox (combined address/search…
Anthropic Reaches Google Cloud Deal Worth Tens Of Billions
AI start-up Anthropic buys access to up to 1 million Google TPU chips in endorsement of Google’s AI and cloud infrastructure This article has been indexed from Silicon UK Read the original article: Anthropic Reaches Google Cloud Deal Worth Tens…
IT Security News Hourly Summary 2025-10-27 09h : 9 posts
9 posts were published in the last hour 8:4 : Police Handcuff US Student After AI Mistakes Bag Of Crisps For Gun 8:4 : Critical CoPhish Exploit Uses Copilot Studio to Hijack OAuth Tokens 7:34 : Microsoft Adds Wi-Fi-Based Work…
Police Handcuff US Student After AI Mistakes Bag Of Crisps For Gun
High school student in Baltimore searched by police after AI surveillance system falsely identifies bag of Doritos as gun This article has been indexed from Silicon UK Read the original article: Police Handcuff US Student After AI Mistakes Bag Of…
Critical CoPhish Exploit Uses Copilot Studio to Hijack OAuth Tokens
Security researchers at Datadog have uncovered a sophisticated phishing technique that weaponizes Microsoft Copilot Studio to conduct OAuth token theft attacks. Dubbed “CoPhish,” this attack method leverages the legitimate appearance of Microsoft domains to trick users into consenting to malicious…
Microsoft Adds Wi-Fi-Based Work Location Auto-Detection to Teams
Microsoft is preparing to introduce a groundbreaking feature in Teams that will revolutionise how hybrid workers manage their presence information. The new capability will automatically identify and update users’ work locations by detecting their connection to organisational Wi-Fi networks, eliminating…
A week in security (October 20 – October 26)
A list of topics we covered in the week of October 20 to October 26 of 2025 This article has been indexed from Malwarebytes Read the original article: A week in security (October 20 – October 26)
Delivering often in small increments with Scrum
Agile software development, particularly using Scrum, has revolutionized the way software is built and delivered. At its core, Agile embraces iterative and incremental development, a stark contrast to traditional “waterfall” methodologies. The primary objective is to deliver working software frequently…
Microsoft WSUS vulnerability, LastPass death hoax, Copilot phishing technique
Microsoft WSUS vulnerability could allow for remote code execution Fake LastPass death claims used to breach password vaults New CoPhish attack steals OAuth tokens via Copilot Studio agents Huge thanks to our sponsor, Conveyor If security questionnaires make you feel…
North Korean Chollima Actors Added BeaverTail and OtterCookie to its Arsenal
Famous Chollima, a DPRK-aligned threat group, has evolved its arsenal, with BeaverTail and OtterCookie increasingly merging functionalities to steal credentials and cryptocurrency via deceptive job offers. A recent campaign involved a trojanized Node.js application distributed through a malicious NPM package,…
It’s Always DNS: Lessons from the AWS Outage
In episode 404 (no pun intended!) we discuss the recurring issue of DNS outages, the recent Amazon AWS disruption, and what this reveals about our dependency on cloud services. The conversation touches on the need for tested business continuity plans,…
Can your earbuds recognize you? Researchers are working on it
Biometric authentication has moved from fingerprints to voices to facial scans, but a team of researchers believes the next step could be inside the ear. New research explores how the ear canal’s unique acoustic properties can be used to verify…
Dependency-Track: Open-source component analysis platform
Software is a patchwork of third-party components, and keeping tabs on what’s running under the hood has become a challenge. The open-source platform Dependency-Track tackles that problem head-on. Rather than treating software composition as a one-time scan, it continuously monitors…
706,000+ BIND 9 DNS Resolvers Exposed to Cache Poisoning – PoC Released
A critical vulnerability affecting more than 706,000 BIND 9 DNS resolvers worldwide has been disclosed with proof-of-concept exploit code now publicly available. The security flaw enables attackers to perform cache poisoning attacks by injecting malicious DNS records into vulnerable resolver…
AI writes code like a junior dev, and security is feeling it
The industry is entering a phase where code is being deployed faster than it can be secured, according to OX Security. Findings from the Army of Juniors: The AI Code Security Crisis report show that AI-generated code often appears clean…
DDoS, data theft, and malware are storming the gaming industry
When the pandemic kept people at home in 2020, millions turned to games for an escape. The surge turned every console, PC, and phone into part of a vast online network. More players meant more logins, payments, and personal data.…
WhatsApp 0-Click Exploit Disclosed to Meta at Pwn2Own Security Event
Cybersecurity researchers from Team Z3 have withdrawn their planned demonstration of a zero-click remote code execution vulnerability in WhatsApp at the Pwn2Own Ireland 2025 hacking competition, opting instead for private coordinated disclosure to Meta. The high-stakes exploit, which stood to…
Product showcase: Neo Network Utility makes network checks simple
Want to see if a remote server is still alive, or trace the path your data takes across the internet? Network Utility had you covered, until Apple removed it. Network Utility was the go-to macOS app for quick network checks.…
Pwn2Own Ireland 2025: Major Cybersecurity Revelations & Critical Vulnerabilities
In this episode of Cybersecurity Today, host David Shipley covers the latest updates from the Pwn2Own 2025 event in Ireland, where top hackers earned over $1 million for uncovering 73 zero-day vulnerabilities. Despite significant hype, AI’s impact on cybersecurity remains…
New CoPhish Attack Exploits Copilot Studio to Exfiltrate OAuth Tokens
A sophisticated phishing technique called CoPhish exploits Microsoft Copilot Studio to trick users into granting attackers unauthorized access to their Microsoft Entra ID accounts. Dubbed by Datadog Security Labs, this method uses customizable AI agents hosted on legitimate Microsoft domains…