News
Worker surveillance must comply with credit reporting rules
The US Consumer Financial Protection Bureau on Thursday published guidance advising businesses that third-party reports about workers must comply with the consent and transparency requirements set forth in the Fair Credit Reporting Act.…
Just how private is Apple's Private Cloud Compute? You can test it to find out
In June, Apple used its Worldwide Developer Conference to announce the creation of the Private Cloud Compute platform to run its AI Intelligence applications, and now it's asking people to stress test the system for security holes.…
Putin's pro-Trump trolls accuse Harris of poaching rhinos
Russian, Iranian, and Chinese trolls are all ramping up their US election disinformation efforts ahead of November 5, but – aside from undermining faith in the democratic process and confidence in the election result – with very different objectives, according to Microsoft.…
AWS Cloud Development Kit flaw exposed accounts to full takeover
Amazon Web Services has fixed a flaw in its open source Cloud Development Kit that, under the right conditions, could allow an attacker to hijack a user's account completely.…
Emergency patch: Cisco fixes bug under exploit in brute-force attacks
Cisco has patched an already exploited security hole in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software that miscreants have been brute-forcing in attempted denial of service attacks.…
Bitwarden's FOSS halo slips as new SDK requirement locks down freedoms
The Bitwarden online credentials storage service is changing its build requirements – which some commentators feel mean it's no longer FOSS.…
Ransomware's ripple effect felt across ERs as patient care suffers
Ransomware infected 389 US healthcare organizations this fiscal year, putting patients' lives at risk and costing facilities up to $900,000 a day in downtime alone, according to Microsoft.…
Voice-enabled AI agents can automate everything, even your phone scams
Scammers, rejoice. OpenAI's real-time voice API can be used to build AI agents capable of conducting successful phone call scams for less than a dollar.…
China's top messaging app WeChat banned from Hong Kong government computers
Hong Kong’s government has updated infosec guidelines to restrict the use of Chinese messaging app WeChat, alongside Meta and Google products like WhatsApp and Google Drive, on computers it operates.…
Anthropic's latest Claude model can interact with computers – what could go wrong?
The latest version of AI startup Anthropic's Claude 3.5 Sonnet model can use computers – and the developer makes it sound like that's a good thing.…
Perfctl malware strikes again as crypto-crooks target Docker Remote API servers
An unknown attacker is abusing exposed Docker Remote API servers to deploy perfctl cryptomining malware on victims' systems, according to Trend Micro researchers.…
Samsung phone users under attack, Google warns
A nasty bug in Samsung's mobile chips is being exploited by miscreants as part of an exploit chain to escalate privileges and then remotely execute arbitrary code, according to Google security researchers.…
Penn State pays DoJ $1.25M to settle cybersecurity compliance case
Pennsylvania State University has agreed to pay the Justice Department $1.25 million to settle claims of misrepresenting its cybersecurity compliance to the federal government and leaving sensitive data improperly secured. …
Warning! FortiManager critical vulnerability under active attack
Fortinet has gone public with news of a critical flaw in its software management platform.…
'Satanic' data thief claims to have slipped into 350M Hot Topic shoppers info
A data thief calling themselves Satanic claims to have purloined the records of around 350 million customers of fashion retailer Hot Topic.…
Microsoft SharePoint RCE flaw exploits in the wild – you've had 3 months to patch
A Microsoft SharePoint bug that can allow an attacker to remotely inject code into vulnerable versions is under active exploitation, according to the US Cybersecurity and Infrastructure Security Agency (CISA).…
Millions of Android and iOS users at risk from hardcoded creds in popular apps
An analysis of widely used mobile apps offered on Google Play and the Apple App Store has found hardcoded and unencrypted cloud service credentials, exposing millions of users to major security problems.…
US lawmakers push DoJ to prosecute tax prep firms for leaking taxpayer data to big tech
A quartet of lawmakers have penned a letter to the Department of Justice asking it to prosecute tax preparation companies for sharing customer data, including tax return information, with Meta and Google.…
TSMC blows whistle on potential sanctions-busting shenanigans from Huawei
TSMC has reportedly tipped off US officials to a potential attempt by Huawei to circumvent export controls and obtain AI chips manufactured by the Taiwanese company.…
VMware fixes critical RCE, make-me-root bugs in vCenter - for the second time
VMware has pushed a second patch for a critical, heap-overflow bug in the vCenter Server that could allow a remote attacker to fully compromise vulnerable systems after the first software update, issued last month, didn't work.…
Pages
