PhantomRaven slipped over a hundred credential-stealing packages into npm A new supply chain attack dubbed PhantomRaven has flooded the npm registry with malicious packages that steal credentials, tokens, and secrets during installation. The packages appear safe when first downloaded, making…
Tag: The Register – Security
Cyberpunks mess with Canada’s water, energy, and farm systems
Infosec agency warns hacktivists broke into critical infrastructure systems to tamper with controls Hacktivists have breached Canadian critical infrastructure systems to meddle with controls that could have led to dangerous conditions, marking the latest in a string of real-world intrusions…
Postcode Lottery’s lucky dip turns into data slip as players draw each other’s info
Biz says ‘technical error’ caused short-lived leak affecting small number of users A major UK lottery organization says it has resolved a technical error that exposed customer data to other users.… This article has been indexed from The Register –…
France jacks into the Matrix for state messaging – and pays too
Governments eye comms alternatives as sovereignty worries mount Comment Decentralized communications network Matrix is hoping to be the beneficiary as European public and private sector organizations ponder alternatives to the messaging status quo.… This article has been indexed from The…
This security hole can crash billions of Chromium browsers, and Google hasn’t patched it yet
Edge, Atlas, Brave among those affected Exclusive A critical, currently unpatched bug in Chromium’s Blink rendering engine can be abused to crash many Chromium-based browsers within seconds, causing a denial-of-service condition – and, in some tests, freezing the host system.……
EY exposes 4TB+ SQL database to open internet for who knows how long
The Big Four biz’s big fat fail exposed a boatload of secrets online A Dutch cybersecurity outfit says its lead researcher recently stumbled upon a 4TB+ SQL Server backup file belonging to EY exposed to the web, effectively leaking the…
Marketing giant Dentsu warns staff after Merkle data raid
Emails confirm payroll and bank details lifted in cyberattack on US subsidiary Global marketing giant Dentsu is writing to current and former staff after a cyberattack on a subsidiary led to bank, payroll, and other sensitive data being stolen.… This…
Sole trader dispatched almost 1M spam texts to hard-up Brits, says watchdog
ICO fined Bharat Singh Chand £200,000 after receiving 19,138 complaints Britain’s data watchdog has fined a sole trader £200,000 for nearly a million spam texts targeting people in debt – almost 20 pence per message.… This article has been indexed…
UK government on the lookout for bargain-priced CTO
Dangles £100K for someone to fix £23B tech mess The UK government is on the hunt for a new CTO after incumbent David Knott announced his departure, citing family reasons.… This article has been indexed from The Register – Security…
9 in 10 Exchange servers in Germany still running out-of-support software
Cybersecurity agency urges organizations to upgrade or risk total network compromise Germany’s infosec office (BSI) is sounding the alarm after finding that 92 percent of the nation’s Exchange boxes are still running out-of-support software, a fortnight after Microsoft axed versions…
Australian police building AI to translate emoji used by ‘crimefluencers’
Five Eyes intel alliance has created a team to target these scum who prey on kids Australia’s Federal Police (AFP) is working on an AI to interpret emojis and the slang used online by Generation Z and Generation Alpha, so…
Clearview AI faces criminal heat for ignoring EU data fines
Noyb says New York-based facial recognition biz flouted GDPR orders and kept scraping anyway Privacy advocates at Noyb filed a criminal complaint against Clearview AI for scraping social media users’ faces without consent to train its AI algorithms.… This article…
AI browsers face a security flaw as inevitable as death and taxes
Agentic features open the door to data exfiltration or worse Feature With great power comes great vulnerability. Several new AI browsers, including OpenAI’s Atlas, offer the ability to take actions on the user’s behalf, such as opening web pages or…
Beatings, killings, and lasting fear: The human toll of MoD’s Afghan data breach
Research submitted to Parliament details deaths, raids, and mental trauma linked to 2022 relocation leak Research submitted to the UK Parliament has revealed explicit threats to life and the deaths of family members and colleagues directly linked to the Ministry…
Google says reports of a Gmail breach have been greatly exaggerated
Ad and cloud biz rubbishes claims that 183 million accounts broken into Panic spread faster than a phishing email on Tuesday after claims of a massive Gmail breach hit the headlines – but Google says it’s all nonsense.… This article…
Chatbots parrot Putin’s propaganda about the illegal invasion of Ukraine
Fake views from Moscow’s pet media outlets appear in about one in five responses Popular chatbots powered by large language models cited links to Russian state-attributed sources in up to a quarter of answers about the war in Ukraine, raising…
Marks & Spencer swaps out TCS for fresh helpdesk deal
Move follows months-long procurement process as retailer refreshes parts of its IT support setup UK retailer Marks & Spencer has replaced Tata Consultancy Services as its IT service desk provider following a procurement process that began in January.… This article…
WSUS attacks hit ‘multiple’ orgs as Google and other infosec sleuths ring Redmond’s alarm bell
If at first you don’t succeed, patch and patch again More threat intel teams are sounding the alarm about a critical Windows Server Update Services (WSUS) remote code execution vulnerability, tracked as CVE-2025-59287 and now under active exploitation, just days…
Iran’s school for cyberspies could’ve used a few more lessons in preventing breaches
Ravin Academy confirms the intrusion on Telegram, says student data was stolen Iran’s school for state-sponsored cyberattackers admits it suffered a breach exposing the names and other personal information of its associates and students.… This article has been indexed from…
Breach at Iran’s cyberspy factory results in leak of student data
Ravin Academy confirms the intrusion on Telegram, says investigation continues Iran’s school for state-sponsored cyberattackers admits it suffered a breach exposing the names and other personal information of its associates and students.… This article has been indexed from The Register…