Smashing Security podcast #480: This is the AI service you should never sign up to
Would you like access to Anthropic's Claude at 90% off the normal price? All you have to do is redirect your traffic to a mysterious service called "Poison C...
general
20 articles
"City-Forum" data-theft attacks target Salesforce, ServiceNow portals
An ongoing data theft campaign uses custom tools to steal data exposed to anonymous users through Salesforce Experience Cloud and ServiceNow customer portals...
Android malware combo takes out loans and relays victims' credit cards
A new Android NFC relay malware called WindRelay is being used alongside the SpyNote remote administration tool (RAT) to steal live card data and send it to ...
Akira ransomware attacker uses Safe Mode reboot to evade EDR
The ransomware payload ultimately failed to deploy due to insufficient virtual memory.
Thailand plans mandatory multi-factor authentication after massive data leak
The Digital Economy and Society Minister is seeking cabinet approval for compulsory multi-factor authentication across all government systems.
Uber Freight investigating data security incident after Helix claims breach
The incident at Uber Freight, the logistics arm of the ride-sharing giant, comes after the Helix group listed the company on its data leak site on August 6, ...
Colombia's Ministry of Justice hit by ransomware attack
The attack, which impacted services related to illicit-drug monitoring and legal processes, followed a warning from Colombia's national CERT about increased ...
Who owns the agent? Identity governance for autonomous AI
Here's why AI agents must be treated as a new type of identity -- yet always must be tied to a human.
LiteLLM supply chain attack impacted over 2,500 organizations
The compromise of LiteLLM, a Python library and proxy server, occurred indirectly.
New 'Plug and Pwn' attacks exploit Windows Plug and Play for SYSTEM privileges
Security researchers Alejandro Hernando and Borja Martínez demonstrated attacks at DEF CON 34 that exploit Windows' automatic hardware identification and dri...
Trump administration lifts ban on TikTok for federal devices
The ban, introduced in 2022, was a response to concerns that TikTok's parent company, ByteDance, had ties to the Chinese government, raising fears about data...
Hackers exploit critical Adobe Commerce flaw to hijack customer accounts
Attempts to exploit a critical vulnerability (CVE-2026-71362) in Adobe's Commerce and Magento e-commerce platforms have been detected, potentially allowing a...
CEVA Logistics Cyberattack Disrupts European Warehouses and Shipments
CEVA Logistics suffered a cyberattack disrupting European operations, with eight warehouses affected and shipments halted at impacted sites. CEVA Logistics s...
Hundreds of fake Chrome VPN extensions route traffic through a proxy
More than 737 browser extensions published on the Chrome Web Store impersonated well-known VPN and proxy services while routing users' traffic through SOCKS5...
Critical VMware vCenter flaw actively exploited in 47 countries
Unspecified APT group has made attacks across 361 unique IP addresses in 47 countries.
The vulnerability flood is here. Here’s what it means – and how to prepare
We can't control the pace of AI-driven vulnerability discovery, but we can control how fast we respond.
China-Linked Hackers Use AI Agents in Autonomous Attack on Taiwan
China-linked hackers reportedly used eight AI agents to breach a government network, steal data and compromise accounts with minimal human oversight. Israeli...
Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Wi...
FBI: Hackers using social engineering to breach accounts and steal explicit content
Leaked passwords, social engineering and spoofed social media sites are among the tools hackers are using to gather individuals' private content and sell it ...
Researchers observe first ‘near-autonomous’ AI attack on government target in Taiwan
Israeli cyber firm Dream said the framework adapted mid-operation, corrected its mistakes and expanded as it went along. The post Researchers observe first ‘...