September bundle the largest this year, and possibly the most serious Patch Tuesday is next week, but Android is ahead of the game, dropping its biggest patch bundle this year while attackers actively exploit two of the now-fixed flaws.… This…
Tag: The Register – Security
Crims claim HexStrike AI penetration tool makes quick work of Citrix bugs
LLMs and 0-days – what could possibly go wrong? Attackers on underground forums claimed they were using HexStrike AI, an open-source red-teaming tool, against Citrix NetScaler vulnerabilities within hours of disclosure, according to Check Point cybersecurity evangelist Amit Weigman.… This…
It looks like you’re ransoming data. Would you like some help?
AI-powered ransomware, extortion chatbots, vibe hacking … just wait until agents replace affiliates It’s no secret that AI tools make it easier for cybercriminals to steal sensitive data and then extort victim organizations. But two recent developments illustrate exactly how…
Matrix.org homeserver grinds to a halt after RAID meltdown
Engineers wrangle 55 TB restore and traffic replay as millions of messages queue up A RAID failure has taken the Matrix.org homeserver offline, leaving users of the decentralized messaging service unable to send or receive messages while engineers attempt a…
Internet mapping and research outfit Censys reveals state-based abuse, harassment
‘Universities are being used to proxy offensive government operations, turning research access decisions political’ Censys Inc, vendor of the popular Censys internet-mapping tool, has revealed that state-based actors are trying to abuse its services by hiding behind academic researchers.… This…
How big will this Drift get? Cloudflare cops to Salesloft Drift breach
Show of hands: who WASN’T targeted? The list of victims keeps growing, as yet another company — Cloudflare — today disclosed that some of its customers’ data was also compromised in the Salesloft Drift breach.… This article has been indexed from…
Who watches the watchmen? Surveillanceware firms make bank, avoid oversight
Enough governments love it and it’s highly lucrative Governments can’t get enough of hacking services to use against their citizens, despite their protestations that elements of the trade need sanctioning.… This article has been indexed from The Register – Security…
Zscaler latest victim of Salesloft Drift attacks, customer data exposed
Joins Google, Palo Alto Networks in the ever-growing supply chain compromise Zscaler is the latest company to disclose some of its customers’ data was exposed in the recent spate of Salesloft Drift attacks affecting Salesforce databases.… This article has been…
Stolen OAuth tokens expose Palo Alto customer data
Security firm’s Salesforce instance accessed using credentials stolen from Salesloft’s Drift platform breach Palo Alto Networks is writing to customers that may have had commercially sensitive data exposed after criminals used stolen OAuth credentials lifted from the Salesloft Drift break-in…
Huawei counts cost of Western bans as UK business withers
Brit limb books just £188M in revenue – down 85% since 2019 Huawei’s business in Britain has dwindled in the half-decade since the UK acquiesced to demands from the US to ban the Chinese networking giant from local telco networks.……
Frostbyte10 bugs put thousands of refrigerators at major grocery chains at risk
Major flaws uncovered in Copeland controllers: Patch now Ten vulnerabilities in Copeland controllers, which are found in thousands of devices used by the world’s largest supermarket chains and cold storage companies, could have allowed miscreants to manipulate temperatures and spoil…
Reg readers have spoken: 93% back move away from Microsoft in UK public sector
As government says £9B could end up in Redmond, poll says it’s time for new thinking Register debate series Register readers are backing a shift away from Microsoft software as a default across the UK public sector after the government…
Europe Putin the blame on Russia after GPS jamming disrupts president’s plane
Bloc working on anti-jamming measures and plans extra sat to help A plane carrying European Commission (EC) president Ursula von der Leyen to Bulgaria was forced to resort to manual navigation techniques after GPS jamming that authorities have pinned on…
In the rush to adopt hot new tech, security is often forgotten. AI is no exception
Cisco finds hundreds of Ollama servers open to unauthorized access, creating various nasty risks Cisco’s Talos security research team has found over 1,100 Ollama servers exposed to the public internet, where miscreants can use them to do nasty things.… This…
Norway’s £10B UK frigate deal could delay Royal Navy ships
BAE’s sub hunter production line warms up – shame it’s not for Britain Norway has ordered British-made Type 26 frigates in a contract valued at roughly £10 billion to the UK economy, but this may delay the introduction of the…
DDoS is the neglected cybercrime that’s getting bigger. Let’s kill it off
Don’t worry, there’s a twist at the end Opinion Agatha Christie stuck a dagger in the notion that crime doesn’t pay. With sales of between two and four billion books – fittingly, the exact number is a mystery – she…
LegalPwn: Tricking LLMs by burying badness in lawyerly fine print
Trust and believe – AI models trained to see ‘legal’ doc as super legit Researchers at security firm Pangea have discovered yet another way to trivially trick large language models (LLMs) into ignoring their guardrails. Stick your adversarial instructions somewhere…
Traffic to government domains often crosses national borders, or flows through risky bottlenecks
Sites at yourcountry.gov may also not bother with HTTPs Internet traffic to government domains often flows across borders, relies on a worryingly small number of network connections, or does not require encryption, according to new research.… This article has been…
WhatsApp warns of ‘attack against specific targeted users’
PLUS: Microsoft ends no-MFA Azure access; WorkDay attack diverts payments; FreePBX warns of CVSS 10 flaw; and more Infosec In brief A flaw in Meta’s WhatsApp app “may have been exploited in a sophisticated attack against specific targeted users.”… This…
Researcher who found McDonald’s free-food hack turns her attention to Chinese restaurant robots
The admin controls were left wide open on Pudu’s robots A researcher caught the world’s leading supplier of commercial service robots using shoddy admin security that let attackers redirect the delivery machines to anywhere and make them follow any command.……