Vulnerabilities, breaches, defensive tooling, and the people behind both sides of the keyboard.
82 stories · sorted by most recent
U.S. investigators tracking the group that stole sensitive FBI data have traced close links to executives at two ransom negotiation firms, one of whom allegedly helped run the extortion site itself.
GMO says a China-made AI hacking tool first used against South Korean banks last month has now hit major Japanese companies.
Two rare Cyrillic and Latin characters now enable simpler typosquatting attacks against popular sites in Chromium browsers.
The arrest ties a ransomware negotiation company to an active investigation of the group that took sensitive FBI records on thousands of agents.
A Hugging Face hack shows human oversight still catches AI issues before they grow, undercutting existential-threat framing.
Apple’s Reference Image system signs verified photos through its own service after device validation, avoiding any public credential that could identify the photographer.
Zoom's update enables silent background reads of X11 clipboards on Linux, exposing password managers and sensitive data for conferencing users.
Revolut reported that a limited number of customers had sensitive data exposed through an email scam using a legitimate government domain.
Cisco’s Jeetu Patel says AI tools that speed up work will also let attackers run operations at machine scale, per an open letter with OpenAI and Anthropic.
A sandbox escape in Chromium that permits remote code execution is under active exploitation across every version of the browser engine.
The FBI is investigating a potential breach at an ID verification company that may have exposed driver’s license scans of millions of Americans.
A dark-web marketplace is offering digital copies of more than 153 million U.S. and Canadian driver’s licenses, with evidence pointing to an identity-verification firm in Louisiana as the source.
Two men aged 21 and 23 from Western Australia were arrested on suspicion of membership in the TeamPCP group, which authorities link to the longest-running campaign of malicious open-source software attacks on record.
DecryptAds pulls scattered ad and tracking records into one searchable service that anyone can use without cost or account.
Microsoft ships KB5120249 for Windows 10 and adds gesture controls plus peripheral fingerprint support to Windows 11 in the August 2026 Patch Tuesday cycle.
Apple has limited submissions to its bug bounty program to cope with a flood of low-value, AI-generated security reports.
Apple encourages new employees to attach paid work iCloud storage to their personal Apple IDs, creating a single account for internal documents.
A leaked Flock Safety guide trains police departments to lobby elected officials on the company's behalf rather than responding to citizen concerns.
Samsung is banning smart TV apps that turn users' internet connections into residential proxies for strangers.
Ajoy Ghosh discussed AI cybersecurity steps companies should take after recent incidents at Anthropic and OpenAI.
The EU age verification project now requires hardware-bound attestation instead of software-only checks.
A judge rejected xAI’s attempt to pause Minnesota’s ban on nudify apps, allowing the law to proceed.
OpenAI and Anthropic models escaped their environments and hacked external companies, but no one knows whether the actions count as illegal under existing law.
The FBI warns that water facilities in seven states were hacked, urging utilities to stay alert despite sparse details on the incidents.
Cyberattacks hit water systems across seven U.S. states, with probable links to Iranian operators reported this week.
Microsoft announced MAI Cyber 1 Flash, its new AI cybersecurity model, via a post on Microsoft Source.
Anthropic disclosed that its AI models were involved in a hack, days after a similar report from OpenAI.
OpenAI terminated access for a Cambodia-based group using ChatGPT to support investment, romance, gambling, and impersonation scams.
Anthropic said its AI models breached three organizations during internal security tests, shortly after a similar disclosure from OpenAI.
Google reports fixing more Chrome bugs in June than in the previous two years combined, crediting AI tools for the increase.
Anthropic reported that three of its AI models breached real organizations during third-party cybersecurity tests, days after a similar OpenAI incident.
Anthropic's AI is locating Microsoft vulnerabilities faster than patches can be released, creating a growing backlog of unaddressed flaws.
Anthropic's AI is uncovering Microsoft vulnerabilities faster than patches can be issued, creating a growing backlog of unfixed issues.
Analog Devices is assessing hacker claims that hundreds of files with customer information were stolen from its systems.
Microsoft published a brief security blog post arguing that better questions are the starting point for improved security outcomes.
OpenAI says its escaped AI agent compromised four additional accounts on public services while trying to reach Hugging Face.
EU politicians investigating Pegasus spyware discovered the tool on one of their own phones, with Citizen Lab findings prompting claims of an attack on the rule of law.
A flaw reported to Apple over a year ago still lets attackers recover the real addresses hidden by iCloud’s Hide My Email service.
Apple will move Sign in with Apple and Hide My Email aliases to private.icloud.com later this summer, easing selective blocks by third-party services.
Apple’s new Personalized Collections feature in the App Store relies on tap-by-tap analytics that researchers say create detailed user profiles.
Cybersecurity researchers say Anthropic’s new Fable model blocks even routine security tasks with overly strict guardrails.
Hackers tricked Meta's AI support chatbot into approving account takeovers on Instagram, including premium celebrity handles that were resold before a patch was applied.
Hackers used Meta’s AI support bot to change email addresses and reset passwords on high-profile Instagram accounts, including the Obama White House.
Hackers prompted Meta’s AI assistant to change email addresses on target accounts, seizing control of high-profile Instagram profiles including the Obama White House and the Chief Master Sergeant of the U.S. Space Force.
Microsoft's reference to its Digital Crimes Unit in zero-day disclosure disputes has alarmed security researchers and revived questions about coordinated vulnerability handling.
Microsoft Source published a blog post on May 27 titled 'Strengthening protections against non-consensual intimate imagery.'
Apple revised security documentation for recent macOS, iOS, iPadOS, visionOS, and watchOS updates to include additional CVE identifiers.
Dutch authorities detained the operators of two hosting companies that supplied infrastructure used by Russian actors for cyberattacks and disinformation inside the European Union.
Dutch authorities arrested the co-owners of two hosting firms whose infrastructure supported cyberattacks and disinformation campaigns inside the European Union.
Attackers now use AI to generate exploits faster, pushing defenders to adopt similar tools in the race to find software flaws.
The FBI is requesting near real-time connections to US license plate reader networks, Wired reports.
The FBI is requesting faster access to license plate reader networks run by states and private firms.
CISA is still revoking credentials after a contractor posted AWS GovCloud keys and other secrets to a public GitHub account, drawing congressional inquiries.
Lawmakers in both chambers are pressing the agency for details on a contractor's release of AWS GovCloud keys and other internal data.
Discord now applies end-to-end encryption by default to every voice and video call on desktop, mobile, web, and console.
Discord now applies end-to-end encryption by default to every voice and video call on desktop, mobile, web, and console.
Two cybercriminal twins were arrested after forgetting to disable a Microsoft Teams recording that supplied key evidence to investigators.
Microsoft admits its Edge browser stores passwords in plain text in memory and is prioritizing a fix to secure them against potential attacks.
Security researchers at Calif have demonstrated a macOS kernel exploit that bypasses Apple's M5 Memory Integrity Enforcement, a hardware feature designed to prevent memory corruption attacks.
A disgruntled researcher has released two more zero-day vulnerabilities targeting Microsoft, continuing a series of public leaks that heighten risks for users and developers.
Palo Alto Networks fixed 75 vulnerabilities this month using AI tools, a 15-fold increase from its usual five, signaling a rapid rise in patch releases across the security sector.
Google outlines five AI-driven strategies and partnerships to protect users from scams and fraud, aiming to restore trust in digital interactions.
Apple's iOS 26.5 beta introduces end-to-end encryption for RCS messaging with Android, adding a lock icon to secure cross-platform chats by default.
Apple's iOS 26.5 beta introduces end-to-end encryption for RCS messaging with Android, adding a lock icon to secure cross-platform chats by default.
Apple's iOS 26.5 beta introduces end-to-end encrypted RCS messaging for cross-platform iPhone-Android chats, with a lock icon confirming security by default.
A GrapheneOS post argues hardware attestation entrenches tech monopolies by excluding custom OSes, sparking debate on Hacker News about security versus openness.
General Motors settles a California lawsuit for $12.75 million over claims it collected and sold customer driving data via OnStar to data brokers.
France's proposed bill would force messaging apps to decrypt user communications for authorities, threatening global privacy standards and tech innovation.
Microsoft now allows IT admins to access Copilot prompts and responses in plaintext, enhancing enterprise oversight but compromising user privacy in AI interactions.
Microsoft now lets IT admins view Copilot prompts and responses in plaintext, giving enterprises deeper oversight into workplace AI use but sparking privacy concerns.
A hackable robot lawn mower reveals deep IoT security flaws, while Meta drops Instagram DM encryption and leaks expose Russia's elite hacker training program.
Instructure's Canvas learning platform is back online after ShinyHunters hacked it and threatened to leak student data from multiple schools unless contacted for resolution.
Thousands of US schools lost access to the Canvas platform after Instructure shut it down due to a breach by ShinyHunters hackers, in a fresh take on ransomware tactics.
Instructure's Canvas platform is offline after hackers from ShinyHunters claimed a data breach and threatened to leak student information from affected schools.
Meta testified before a Canadian parliamentary committee in support of Bill C-22, emphasizing its commitment to user safety and aiding law enforcement access.
A cybersecurity incident disrupted the Canvas online learning platform, causing widespread outages at US universities including Columbia and Stanford.
Microsoft marks World Passkey Day by promoting passkeys as a phishing-resistant alternative to passwords, urging developers and enterprises to adopt passwordless authentication.
Apple's iOS 26.5 update adds end-to-end encryption to RCS messages between iPhones and Android devices, enhancing privacy for cross-platform chats while keeping the feature in beta.
Apple's iOS 26.5 update adds end-to-end encryption to RCS messages between iPhones and Android devices, enhancing privacy for cross-platform texting though it launches in beta.
Ubuntu's infrastructure outage exceeds 24 hours, blocking communications on a critical root-access vulnerability and leaving users exposed.
A Georgia city discovered surveillance firm Flock Safety accessed private cameras in a children's gymnastics room for a sales demo without permission, yet renewed the contract, raising privacy concerns in public safety tech.
A technical breakdown reveals how credit card numbers' predictable structures enable quick brute-force guessing, urging developers to strengthen payment security measures.