The Register

High-severity flaw let malicious add-ons access system via browser's embedded AI feature

Security boffins have discovered a high-severity bug in Google Chrome that allowed malicious extensions to hijack its Gemini Live AI panel and inherit privileges they were never meant to have.…

Third-party software supplier breached leading to leak of notes

Around 15.8 million administrative files were stolen after attackers breached a software supplier to France's health ministry.…

Slow disclosure and odd reassurance that exposing names and contact details won't be a problem isn't going down well

Gamers are ready to unleash their mightiest virtual weapons and point them at British games studio Cloud Imperium, after it sat on news of a data breach and then announced it without fanfare.…

Crims hope for payday from malicious payloads rather than stealing access tokens

Microsoft has warned organizations about ongoing OAuth abuse scams that use phishing emails and URL redirects to infect victims' machines with malware and take over their devices.…

'Expect elevated activity for the foreseeable future'

Iranian hackers have launched spying expeditions, digital probes, and distributed denial of service (DDoS) attacks in the wake of the US and Israel launching missile strikes over the weekend, and security researchers urge organizations to expect more cyber intrusions as the war continues.…

NCSC urges all to review posture as escalating tensions increase risk of indirect digital spillover

The UK's cybersecurity agency is warning British organizations to brace for potential digital blowback as the Middle East conflict spills further into the online world.…

We can remember it for you wholesale, and sell it back to you for big bucks

Web scraping bots are increasing the pressure on the tech supply chain by scouring sites for DRAM, so their minders can snap up increasingly scarce inventory and resell it for a quick profit.…

Vulnerable citizens targeted by criminals purporting to represent fake police crisis department

Scammers targeted Dubai citizens mere hours after missiles struck the city, attempting to gain access to their bank accounts, police have warned.…

PLUS: Firefox adds XSS protection; Leadership turnover at CISA; FTC exempts some data collection

Infosec In Brief  DNS vulnerabilities are being addressed 84 percent faster in the UK public sector thanks to an automated vulnerability scanning system established as part of a program kicked off early last year.…

Went from triumph at having busted tax dodgers to embarrassment at losing the proceeds

South Korea’s National Tax Service has apologized after it leaked passwords to a stash of stolen crypto, which parties unknown used to make off with the digi-cash.…

Jake Braun thinks hackers need to create a 'Digital arsenal of democracy' to defend us all

Interview  Hackers – especially Jake Braun – are "fed up with government."…

Credential and cryptocurrency theft, live surveillance, ransomware - an attacker's Swiss Army knife

A new remote access trojan (RAT) being sold on cybercrime networks enables double extortion attacks on Windows machines by bundling ransomware and data theft, along with credential and cryptocurrency stealers, live surveillance, and a whole host of other illicit capabilities, all controllable from a centralized dashboard.…

Who is knocking at the Dohdoor?

Digital intruders with possible links to North Korea have been infecting US education and healthcare sectors with a never-before-seen backdoor since at least December, according to security researchers.…

Smaller crews piled in as old names splintered and rebranded

Ransomware payments cratered in 2025, but it seems like the cybercrooks launching the attacks didn't get the memo.…

Crooks claim they helped themselves to over 37M accounts during January hit on subcontractor

French online marketplace ManoMano is warning customers their personal data was siphoned off after a cyberattack hit one of its customer support subcontractors – and criminals are already claiming the haul is far larger than the company's carefully worded notice suggests.…

Company refuses to pay ransom as attackers threaten larger daily dumps

The Netherlands' national police is backing Odido's refusal to pay a ransom after ShinyHunters leaked a second round of records belonging to the telco.…

Report claims more vulnerabilities created than fixed as remediation gap widens

Veracode has posted its annual State of Software Security report, based on data from 1.6 million applications tested on its cloud platform, finding that more vulnerabilities are being created than are being fixed, and that high-velocity development with AI is making comprehensive security unattainable.…

Telegram posts promise up to $1,000 per call as gang refines IT helpdesk ruse

Prolific cybercrime crew Scattered Lapsus$ Hunters (SLSH) is reportedly recruiting women in the hope of improving its social engineering success.…

A rare joint alert from all five spy agencies means serious business

The Five Eyes intelligence alliance is urgently warning defenders to patch two Cisco Catalyst SD-WAN vulnerabilities used in attacks.…

Anthropic fixed the flaws - but the AI-enabled attack surfaces remain

Security vulnerabilities in Claude Code could have allowed attackers to remotely execute code on users' machines and steal API keys by injecting malicious configurations into repositories, and then waiting for a developer to clone and open an untrustworthy project.…