Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
The npm package known as "tensorlake," a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromise...
general
20 articles
Who watches the AI watching your street?
Yusaku Fujii, a professor at Gunma University in Japan, has designed audits and penalties to stop operators from misusing AI that analyzes street camera foot...
PoeLLM Malware Hijacks 3,400+ Servers for Crypto Mining and Botnet Expansion
A cryptocurrency mining campaign dubbed PoeLLM has compromised more than 3,400 servers by targeting exposed AI infrastructure and other internet-facing appli...
How AI can fix cybersecurity compliance: From dashboards to continuous execution
Most compliance work goes into proving security, not improving it. That isn’t because the rules are unreasonable.
Malicious npm Packages Steal Browser Passwords, Discord Tokens and Crypto Wallets.
MALFEX, a persistent npm supply-chain campaign distributing Windows malware through eight malicious packages. Linked to an apparent single operator active si...
The people who know passkeys best are still typing passwords
Yubico and Okta asked 1,890 technology and security professionals across nine countries how they sign in to work accounts. The most common answer was a usern...
Java library vulnerabilities: IBM and Red Hat fix 400+ previously unknown flaws
IBM and Red Hat have found and fixed more than 400 previously unknown vulnerabilities in widely used Java libraries through Lightwell, their program for patc...
Medical devices patients rely on most are least prepared for quantum attacks
Threat actors are exploiting IT, IoMT, OT and IoT devices across healthcare delivery organizations (HDOs) to deploy ransomware, demand payments and monetize ...
Smashing Security podcast #487: Clippy’s crypto comeback
Microsoft's Twitter account, with its 13 million followers, was hijacked by a paperclip. There was no ransomware or data theft, just Clippy, a dodgy crypto c...
Ransomware recovery CEO charged over secret ransom payments
The owner of ransomware remediation company MonsterCloud has been charged with allegedly defrauding ransomware victims by secretly paying their attackers for...
Cisco quantum network controller lets apps order entanglement on demand
Cisco has built a Quantum Network Controller, a research prototype that lets an application ask a quantum network for entanglement and leaves the network to ...
FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins
The FBI is warning that FortiBleed attacks are still ongoing, targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways and locking out legitimate ...
Hackers hijack Google domains after breaching ccTLD registries
Hackers obtained unauthorized HTTPS certificates for several Google domains and hijacked domains in the country-code top-level domains (ccTLDs) for Ghana, Am...
US posts $10 million reward for accused Chinese ‘Hafnium’ hacker
U.S.
AI security is an architecture problem, not just a model problem
AI security depends on architecture governing identity, access, permissions and actions.
Major rules for federal contractors handling sensitive data are nearing the finish line
The regulations on “controlled unclassified information” include security rules and requirements for reporting when they’re breached, including by cyberattac...
FortiBleed campaign still attacking Fortinet devices, US agencies warn
FBI warns FortiBleed attackers remain active, turning stolen credentials into persistent access.
Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains
Attackers compromised three country-code top-level domains (ccTLDs) and obtained unauthorized HTTPS certificates for several Google domains, Google said on O...
$11 million plan for psychological support at Cyber Command gets fresh boost from lawmakers
Lawmakers who oversee military cyber policy as well as the Fort Meade, Maryland, hub for those agencies say an $11 million mental health program should be lo...
Arizona courts say hackers stole info on more than 1.3 million people
The investigation into the incident revealed cybercriminals were able to breach the Fines/Fees and Restitution Enforcement (FARE) Program, a statewide progra...