The Vatican’s official Click to Pray app has exposed the personal information of more than 700,000 users through an unauthenticated API flaw. The issue allowed anyone with a web browser to retrieve account data without needing to sign in. Click…
Tag: EN
GitHub Adds 3-Day Dependabot Cooldown to Block Malicious Package Updates
GitHub has introduced a default three-day cooldown period for Dependabot version updates to reduce the risk of projects automatically adopting new malicious packages. This change targets a prevalent pattern in software supply chain attacks where attackers compromise a trusted package…
EY Data Breach Claimed by ShinyHunters Hacker Group
The notorious ShinyHunters extortion gang has publicly claimed responsibility for the Ernst & Young (EY) data breach, alleging it stole employee credentials and sensitive files through a supply-chain compromise of a third-party IT support platform. The claim, posted on the…
Announcing the Cloud Security Alliance on AWS Compliance Guide
AWS Security Assurance Services is announcing the release of the Cloud Security Alliance (CSA) Compliance Guide on Amazon Web Service (AWS), a new resource that maps the 17 control domains and 207 control objectives of the Cloud Controls Matrix v4.1…
Critical vBulletin Flaw Lets Unauthenticated Attackers Execute PHP Code Remotely
vBulletin has patched CVE-2026-61511, a critical remote code execution flaw that could let unauthenticated attackers execute arbitrary PHP code and compromise vulnerable forum servers. This issue affects vBulletin versions 6.2.1 and earlier as well as versions 6.1.6 and earlier. The…
Coca-Cola restores most production capacity at dairy unit after ransomware attack
The company said it does not expect the Fairlife disruption to have a material impact on financial performance or operations. This article has been indexed from Cybersecurity Dive – Latest News Read the original article: Coca-Cola restores most production capacity…
A Fake Teams Update Can Give Hackers Two Separate Ways to Control Your PC
A new phishing operation, tracked as Operation BlueDash, is tricking users into installing a fake Microsoft Teams update that silently hands attackers not one but two independent ways to remotely control infected computers. The infection starts with an email claiming…
Tech giants link hands to praise open AI models after OpenAI – Hugging Face attack
The Open Security AI Alliance says the Hugging Face/OpenAI mess proves frontier labs can't be trusted to properly secure sensitive systems This article has been indexed from www.theregister.com – Articles Read the original article: Tech giants link hands to praise…
NVIDIA Launches Open Secure AI Alliance to Build Open-Source Defenses for AI Agents
A coalition of over 30 technology industry leaders, including NVIDIA, Microsoft, CrowdStrike, Cisco, IBM, Palo Alto Networks, and Red Hat, has launched the Open Secure AI Alliance. The initiative aims to equip cyber defenders with transparent, community-driven AI security tools…
Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw
Public exploit details released on July 27 show how an unauthenticated request can reach PHP's eval() function inside vBulletin and execute code on an unpatched forum server. The attack requires no account, administrative access, or interaction from another user. SSD…
Tech industry giants say US must embrace openness, transparency in AI
Open-source and open-weight AI models are essential cybersecurity tools, two groups of major AI and security firms said. This article has been indexed from Cybersecurity Dive – Latest News Read the original article: Tech industry giants say US must embrace…
What’s your data worth on the dark web? (Lock and Code S07E15)
This week on the Lock and Code podcast, we discuss just exactly why it is that hackers and scammers want your data—and how you're at risk. This article has been indexed from Malwarebytes Read the original article: What’s your data…
Tech giants form alliance to put open AI in cyber defenders’ hands
NVIDIA and a group of tech companies have formed an alliance to promote the use of open AI models in cybersecurity, days after OpenAI disclosed that one of its own AI models breached Hugging Face’s systems during an internal security…
US Treasury Sanctions VPN Provider Linked to Ransomware Operations
The United States Department of the Treasury has taken unprecedented steps by sanctioning a virtual private network (VPN) service provider and its administrator for the first time ever. The VPN was used by ransomware groups to disguise their digital…
Canada Signs the UN Cybercrime Convention: Turning Global Agreement into Coordinated Action
Canada’s signing of the UN Convention against Cybercrime advances global cooperation and highlights the essential role of public-private partnerships. This article has been indexed from Industry Trends & Insights Read the original article: Canada Signs the UN Cybercrime Convention: Turning…
OpenAI-Hugging Face Incident: What We Know
An experimental AI agent powered by OpenAI models has successfully compromised part of Hugging Face’s infrastructure during a controlled cybersecurity evaluation, offering a glimpse into the evolving offensive capabilities of advanced AI systems. The incident, first disclosed by Hugging Face…
Hackers Compromise Hotel Wi-Fi Gateways to Hijack Microsoft 365 Accounts
Compromised hotel Wi-Fi gateways redirect business travelers to fake Microsoft 365 login pages allowing attackers to steal credentials and authorization tokens. This article has been indexed from Hackread – Cybersecurity News, Data Breaches, AI and More Read the original article:…
The Branding and Attribution Behind Cybercrime
Threat actor names can sound simple. LockBit. Fancy Bear. BlackCat. Scattered Spider. Anonymous Sudan. Each name gives the impression of a clear group with a defined identity. In threat intelligence, however, the name is rarely the whole story. Some names…
Sextortion scammers are exploiting ShinyHunters data leaks
Scammers are posing as ShinyHunters and using leaked email addresses to make their sextortion emails seem more credible. This article has been indexed from Malwarebytes Read the original article: Sextortion scammers are exploiting ShinyHunters data leaks
GitHub Fake Repos Spread Malware in New Infostealer Campaign
Cybersecurity researchers have uncovered a large-scale campaign in which hundreds of GitHub repositories were made to look like legitimate software projects while actually distributing malware. According to the report, the attackers created 292 fake repositories that impersonated security tools, developer…