The Register

Encryption protects content, not context

Mischief-makers can guess the subjects being discussed with LLMs using a side-channel attack, according to Microsoft researchers. They told The Register that models from some providers, including Anthropic, AWS, DeepSeek, and Google, haven't been fixed, putting both personal users and enterprise communications at risk.…

Resolution acquiesced to by 8 Dems includes CISA Act funding, layoff reversals, and could be easily undone

The US Senate voted on Sunday to advance a short-term funding bill for the federal government, moving the country closer to ending its longest-ever shutdown. Part of the spending bill also restores critical cybersecurity programs that lapsed as the shutdown began. …

One company alone was hit with more than 4,200 emails

More than 5,000 businesses that use Facebook for advertising were bombarded by tens of thousands of phishing emails in a credential- and data-stealing campaign.…

Aleksei Volkov faces years in prison, may have been working with other crews

A Russian national will likely face several years in US prison after pleading guilty to a range of offenses related to his work with ransomware crews.…

Insurance giant’s UK arm says cybercriminals misattributed the real victim

Allianz UK confirms it was one of the many companies that fell victim to the Clop gang's Oracle E-Business Suite (EBS) attack after crims reported that they had attacked a subsidiary.…

Breaking down trends in exposure management with insightsfrom 3,000+ organizations and Intruder's security experts

Partner Content  This year has shown just how quickly new exposures can emerge, with AI-generated code shipped before review, cloud sprawl racing ahead of controls, and shadow IT opening blind spots. Supply chain compromises have disrupted transport, manufacturing, and other critical services. On the attacker side, AI-assisted exploit development is making it faster than ever to turn those weaknesses into working attacks.…

Doubles parameters to over 17 billion, to detect threats and recommend actions

Exclusive  Cisco is working on a new AI model that will more than double the number of parameters used to train its current flagship Foundation-Sec-8B.…

Licensing expert worries they’ll be out of control on day one

Microsoft has teased what it’s calling “a new class” of AI agents “that operate as independent users within the enterprise workforce.”…

PLUS: India’s tech services exports growing fast; South Korea puts the bite on TXT spam; NTT gets into autonomous vehicles; and more!

Asia In Brief  Chinese infosec blog MXRN last week reported a data breach at a security company called Knownsec that has ties to Beijing and Chinas military.…

PLUS: CISA layoffs continue; Lawmakers criticize camera security; China to execute scammers; And more

Infosec in brief  There's no indication that the brazen bandits who stole jewels from the Louvre attacked the famed French museum's systems, but had they tried, it would have been incredibly easy.…

Esra'a Al Shafei spoke with The Reg about the spy tech 'global trade'

interview  Digital rights activist Esra'a Al Shafei found FinFisher spyware on her device more than a decade ago. Now she's made it her mission to surveil the companies providing surveillanceware, their customers, and their funders.…

'Precision espionage campaign' began months before the flaw was fixed

A previously unknown Android spyware family called LANDFALL exploited a zero-day in Samsung Galaxy devices for nearly a year, installing surveillance code capable of recording calls, tracking locations, and harvesting photos and logs before Samsung finally patched it in April.…

Multi-year wait for destruction comes to an end for mystery attackers

Security experts have helped remove malicious NuGet packages planted in 2023 that were designed to destroy systems years in advance, with some payloads not due to hit until the latter part of this decade.…

Under shadow of US CLOUD Act, Redmond releases raft of services to calm customers in the EU

Microsoft is again banging the data sovereignty drum in Europe, months after admitting in a French court it couldn't guarantee that data will not be transmitted to the US government when it is legally required to do so.…

This kind of material economic impact from online crooks thought to be a UK-first

The Bank of England (BoE) has cited the cyberattack on Jaguar Land Rover (JLR) as one of the reasons for the country's slower-than-expected GDP growth in its latest rates decision.…

What to do when even your espresso machine needs end-to-end encryption

Sponsored Feature  The security landscape is getting more perilous day by day, as both nation-state groups and financially-motivated hackers ramp up their activity.…

Move fast - miscreants compromised a domain controller in 17 hours

Gootloader JavaScript malware, commonly used to deliver ransomware, is back in action after a period of reduced activity.…

Plus 2 new critical vulns - patch now

Cisco warned customers about another wave of attacks against its firewalls, which have been battered by intruders for at least six months. It also patched two critical bugs in its Unified Contact Center Express (UCCX) software that aren't under active exploitation - yet.…

Most of you still can't do better than 123456?

123456. admin. password. For years, the IT world has been reminding users not to rely on such predictable passwords. And yet here we are with another study finding that those sorts of quickly-guessable, universally-held-to-be-bad passwords are still the most popular ones.…

Spies, not crooks, were behind digital heist – damage stopped at the backups, says US cybersec biz

SonicWall has blamed an unnamed, state-sponsored collective for the September break-in that saw cybercriminals rifle through a cache of firewall configuration backups.…