News
Apple slips up on ChillyHell macOS malware, lets it past security . . . for 4 years
ChillyHell, a modular macOS backdoor believed to be long dormant, has likely been infecting computers for years while flying under the radar, according to security researchers who spotted a malware sample uploaded to VirusTotal in May.…
Jaguar Land Rover U-turns to confirm 'some data' affected after cyber prang
Jaguar Land Rover (JLR) says "some data" was affected after the luxury car maker suffered a digital break-in early last week.…
Uncle Sam indicts alleged ransomware kingpin tied to $18B in damages
A Ukrainian national faces serious federal charges and an $11 million bounty after allegedly orchestrating ransomware operations that caused an estimated $18 billion in damages across hundreds of organizations worldwide.…
Flu jab email mishap exposes hundreds of students' personal data
A clumsy data breach has affected hundreds of children at a Birmingham secondary school.…
Cybercrooks ripped the wheels off at Jaguar Land Rover. Here's how not to get taken for a ride
Feature Jaguar Land Rover (JLR) is the latest UK household name to fall victim to a major cyberattack. IT systems across multiple sites have been offline for over a week after what the company described as a "severe disruption."…
This Patch Tuesday, SAP is the worst offender and Microsoft users can kinda chill
September’s Patch Tuesday won’t require Microsoft users to rapidly repair rancid software, but SAP users need to move fast to address extremely dangerous bugs.…
More packages poisoned in npm attack, but would-be crypto thieves left pocket change
During the two-hour window on Monday in which hijacked npm versions were available for download, malware-laced packages reached one in 10 cloud environments, according to Wiz researchers. But crypto-craving crims did little more than annoy defenders.…
New cybersecurity rules land for Defense Department contractors
It's about to get a lot harder for private companies that are lax on cybersecurity to get a contract with the Pentagon, as the Defense Department has finalized a rule requiring contractor compliance with its Cybersecurity Maturity Model Certification (CMMC) program.…
Defense Dept didn't protect social media accounts, left stream keys out in public
The US Department of Defense, up until this week, routinely left its social media accounts wide open to hijackers via stream keys - unique, confidential identifiers generated by streaming platforms for broadcasting content. If exposed, these keys can allow attackers to output anything they want from someone else's channel.…
No gains, just pains as 1.6M fitness phone call recordings exposed online
Exclusive Sensitive info from hundreds of thousands of gym customers and staff – including names, financial details, and potentially biometric data in the form of audio recordings – was left sitting in an unencrypted, non-password protected database, according to a security researcher who shut it down.…
What the Plex? Streaming service suffers yet another password spill
Streaming platform Plex is warning some users to reset their passwords after suffering yet another breach.…
Nokia successor HMD spawns secure device biz with Euro-made smartphone
Finnish phone maker HMD Global is launching a business unit called HMD Secure to target governments and other security-critical customers, and has its first device ready to go.…
Anthropic's Claude Code runs code to test if it is safe – which might be a big mistake
App security outfit Checkmarx says automated reviews in Anthropic's Claude Code can catch some bugs but miss others – and sometimes create new risks by executing code while testing it.…
UK toughens Online Safety Act with ban on self-harm content
Tech companies will be legally required to prevent content involving self-harm from appearing on their platforms – rather than responding and removing it – in a planned amendment to the UK's controversial Online Safety Act.…
Forget disappearing messages – now Signal will store 100MB of them for you for free
Encrypted messaging app Signal is rolling out a free storage system for its users, with extra space if folks are willing to pay for it.…
WhatsApp's former security boss claims reporting infosec failings led to ousting
WhatsApp's former head of security, Attaullah Baig, has filed a lawsuit against its parent company, Meta, alleging that the social media megalith retaliated against him for reporting security failings that violated legal commitments.…
The US government has no idea how many cybersecurity pros it employs
The US federal government employs tens of thousands of cybersecurity professionals at a cost of billions per year – or at least it thinks it does, as auditors have found the figures are incomplete and unreliable. …
Drift massive attack traced back to loose Salesloft GitHub account
The Salesloft Drift breach that compromised "hundreds" of companies including Google, Palo Alto Networks, and Cloudflare, all started with miscreants gaining access to the Salesloft GitHub account in March.…
Dev snared in crypto phishing net, 18 npm packages compromised
Crims have added backdoors to at least 18 npm packages after developer Josh Junon inadvertently authorized a reset of the two-factor authentication protecting his npm account.…
Salt Typhoon used dozens of domains, going back five years. Did you visit one?
Security researchers have uncovered dozens of domains used by Chinese espionage crew Salt Typhoon to gain stealthy, long-term access to victim organizations going back as far as 2020.…
Pages
