The Register

Negative feedback sinks Redmond's plan to cap outbound email recipients

Microsoft has backed away from planned changes to Exchange Online after customers objected to limits designed to curb outbound email abuse.…

High-risk system compromised long before intrusion was finally spotted

The UK's Ministry of Justice spent £50 million ($67 million) on cybersecurity improvements at the Legal Aid Agency (LAA) before the high-profile cyberattack it disclosed last year.…

Production halts and supply-chain disruption left luxury automaker reeling in fiscal Q3

Brit luxury automaker Jaguar Land Rover has reported devastating preliminary Q3 results that lay bare the cascading consequences of a crippling cyberattack, revealing wholesale volumes collapsed more than two-fifths year-on-year.…

Customers report being locked out after grabbing the password manager via F-Droid

Some HSBC mobile banking customers in the UK report being locked out of the bank's app after installing the Bitwarden password manager via an open source app catalog.…

Long after CVEs issued and open source flaws fixed

Last fall, Jakub Ciolek reported two denial-of-service bugs in Argo CD, a popular Kubernetes controller, via HackerOne's Internet Bug Bounty (IBB) program. Both were assigned CVEs and have since been fixed. But instead of receiving an $8,500 reward for the two flaws, Ciolek says, HackerOne ghosted him for months.…

Crimson Collective claims 'sophisticated attack'

Internet service provider Brightspeed confirmed that it's investigating criminals' claims that they stole more than a million customers' records and have listed them for sale for three bitcoin, or about $276,370. …

Phishers posing as Booking.com use panic-inducing blue screens to bypass security controls

Russia-linked hackers are sneaking malware into European hotels and other hospitality outfits by tricking staff into installing it themselves through fake Windows Blue Screen of Death (BSOD) crashes.…

Order and contact details accessed via ecommerce partner, and phishing has begun

Blockchain security biz Ledger says customer information was accessed in a breach at its ecommerce payment partner Global-e, and is warning that other brands using the platform may also be affected.…

Phones, email, and core systems knocked out at Higham Lane in Nuneaton

Students at a school in Warwickshire, England, have scored an extended Christmas break after a cyberattack crippled its IT systems, forcing classrooms to close and staff to summon government incident responders.…

Central government will supposedly be as secure as energy facilities and datacenters under new proposals

The UK today launches its Government Cyber Action Plan, committing £210 million ($282 million) to strengthen defenses across digital public services and hold itself to the same cybersecurity standards it's imposing on critical infrastructure operators.…

Crim used infostealer to get cloud credentials

If you don't say "yes way" to MFA, the consequences can be disastrous. Sensitive data belonging to about 50 global enterprises is listed for sale – and, in some cases, has already been sold – on the dark web following a major infostealer campaign, with apparent victims including American utility engineering firm Pickett and Associates; Japan's homebuilding giant Sekisui House; and Spain's largest airline Iberia.…

A subpoena has been issued, apparently

Resecurity offered its "congratulations" to the Scattered Lapsus$ Hunters cybercrime crew for falling into its threat intel team's honeypot – resulting in a subpoena being issued for one of the data thieves. Meanwhile, the notorious extortionists have since removed their claims of gaining "full access" to the security shop's systems.…

CEO Nikesh Arora's trip to Tel Aviv last month sparked rumors.

Palo Alto Networks is on shopping spree. The company is reportedly considering a $400 million purchase of Israeli cybersecurity start up Koi, which raised $48 million in funding last year. …

It's January 2026, and Google is finding innovative new ways to make one of its services worse

Important news for Gmail power users: Google is dropping the feature whereby Gmail can collect mail from other email accounts over POP3.…

Government 'incredibly' concerned about breach potentially affecting more than 100,000 patients

New Zealand health minister Simeon Brown has ordered a review into the cyberattack at ManageMyHealth, which threatens the data of hundreds of thousands of Kiwis.…

Also, Korean Air hacked, EmEditor installer hijacked, a perfect 10 router RCE vuln, and more

infosec in brief  The Trump administration has cleared a trio of individuals sanctioned by the Biden administration for involvement with the Intellexa spyware consortium behind the Predator surveillance tool, removing restrictions that had barred them from doing business with the US.…

Lock 'em down

interview  AI agents represent the new insider threat to companies in 2026, according to Palo Alto Networks Chief Security Intel Officer Wendi Whitmore, and this poses several challenges to executives tasked with securing the expected surge in autonomous agents.…

Netflix documentary part 2 in the works?

Ilya Lichtenstein, who pleaded guilty to money-laundering charges tied to the 2016 theft of about 120,000 bitcoins from the Bitfinex exchange and was sentenced to five years in prison, has been released after roughly 14 months in the slammer.…

For the bargain price of 6.5 bitcoin

A cybercrook claims to have breached Pickett and Associates, a Florida-based engineering firm whose clients include major US utilities, and is selling what they claim to be about 139 GB of engineering data about Tampa Electric Company, Duke Energy Florida, and American Electric Power. The price is 6.5 bitcoin, which amounts to about $585,000.…

Jacob Riggs is set to swap London for Sydney some time in the next year

A British security researcher has secured Australia's strictest, invite-only visa after discovering a critical vulnerability in a government system.…