Information security
Information security
[ follow ]
#supply-chain-attacks
Information security
fromTechCrunch
17 hours agoOpenAI says hackers stole some data after latest code security issue | TechCrunch
Hackers injected malicious updates into open source TanStack, compromising OpenAI employee devices and stealing limited credentials while not accessing user data or altering production systems.
Information security
fromThe Hacker News
4 hours agoCISA Adds Cisco SD-WAN CVE-2026-20182 to KEV After Admin Access Exploits
CVE-2026-20182 in Cisco Catalyst SD-WAN Controller enables unauthenticated remote authentication bypass and administrative access, added to CISA KEV with FCEB remediation by May 17, 2026.
Information security
fromtheregister
11 hours agoNobody believes the 'criminals and scumbags' who hacked Canvas really deleted stolen student data
Instructure claims stolen data was destroyed and no customers will be extorted, but ransomware researchers doubt deletion and warn further threats are likely.
fromnews.bitcoin.com
9 hours agoRipple's Schwartz Warns XRP Users to Stay Safe From Giveaway Scams
SCAM ALERT: There has been a huge escalation lately in airdrop and giveaway scams targetting XRPL users lately. Any such posts you see are likely scams. Ripple-linked fraud warnings in recent months have also covered phishing operations targeting XRP holders through fake verification requests and malicious wallet prompts. Some schemes encouraged users to connect wallets or submit sensitive recovery information through unofficial channels masquerading as trusted XRP resources.
Information security
Information security
fromTechCrunch
20 hours agoA spyware investigator exposed Russian government hackers trying to hijack Signal accounts | TechCrunch
Hackers impersonated Signal, warned of fake security threats, and used verification-code prompts to trick users into granting account access via attacker-controlled devices.
#ai-cybersecurity
Information security
fromSocial Media Explorer
1 day agoAI Model "Claude Mythos" Raises New Questions About Cybersecurity and Machine Intelligence - Social Media Explorer
AI systems are rapidly advancing in cybersecurity tasks, creating dual-use risks by improving vulnerability discovery while potentially lowering barriers to cyberattacks.
Information security
fromNextgov.com
17 hours agoHouse Homeland panel gets briefing on Anthropic's Mythos
A congressional briefing demonstrated Anthropic’s Mythos AI hacking capabilities and emphasized urgent, responsible deployment of advanced U.S. models to patch vulnerabilities before adversaries exploit them.
Information security
fromThe Hacker News
15 hours agoCisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access
Cisco released updates for CVE-2026-20182, a maximum-severity authentication bypass in Catalyst SD-WAN Controller that enables unauthenticated remote admin access and NETCONF configuration changes.
Information security
fromThe Hacker News
16 hours agoThreatsDay Bulletin: PAN-OS RCE, Mythos cURL Bug, AI Tokenizer Attacks, and 10+ Stories
Compromised sites and fake helpdesks enable modular persistence, encrypted proxy access, credential theft, privilege escalation, lateral movement, and data exfiltration.
Information security
fromSecuritymagazine
1 day agoThe Bench You'll Need in Three Years Depends on Decisions You Make Now
AI-native security tools automate entry-level tasks, shrinking the entry talent pipeline and creating a widening skills mismatch that will reduce hiring, provider quality, and bench strength.
fromSecurityWeek
23 hours agoF5 Patches Over 50 Vulnerabilities
The most severe of the resolved issues is CVE-2026-42945 (CVSS v4.0 score of 9.2), a denial-of-service (DoS) condition in NGINX's ngx_http_rewrite_module module. The bug allows an unauthenticated attacker to send crafted HTTP requests that, combined with certain conditions beyond the attacker's control, could trigger a heap buffer overflow and a restart. If Address Space Layout Randomization (ASLR) is disabled, the flaw can be exploited for code execution.
Information security
fromArs Technica
15 hours agoZero-day exploit completely defeats default Windows 11 BitLocker protections
A zero-day exploit circulating online allows people with physical access to a Windows 11 system to bypass default BitLocker protections and gain complete access to an encrypted drive within seconds. The exploit, named YellowKey, was published earlier this week by a researcher who goes by the alias Nightmare-Eclipse. It reliably bypasses default Windows 11 deployments of BitLocker, the full-volume encryption protection Microsoft provides to make disk contents off-limits to anyone without the decryption key, which is stored in a secured piece of hardware known as a trusted platform module (TPM).
Information security
Information security
fromFortune
22 hours agoNorth Korean operatives stole $2 billion last year-and financial firms are the next target | Fortune
North Korea-linked cyber groups stole over $2 billion in digital assets in 2025, using credential theft and laundering to fund military and nuclear programs.
Information security
fromThe Hacker News
19 hours agoGhostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt Strike
Ghostwriter/FrostyNeighbor conducts persistent, adaptive cyber operations against Eastern European government targets using evolving malware, phishing, and credential abuse.
#ai-security
#cybersecurity
Information security
fromSecuritymagazine
2 days agoCybersecurity Is No Longer a Gatekeeper, But the Engine of Delivery Across Digital Economy
Cybersecurity is a top fast-growing skill and must be integrated into product delivery, since both protection gaps and misconfigured controls can cause outages, breaches, and lost trust.
Information security
from24/7 Wall St.
1 day agoAI Threats Are Accelerating and These 3 Cybersecurity Stocks Under $30 Are Built to Win
Cybersecurity demand for AI workloads, identity control, and data pipeline protection is driving growth, while several stocks trade under $30 at compressed valuations.
Information security
fromSecurityWeek
1 day agoGovernment to Scrutinize Instructure Over Canvas Disruption, Data Breach
Instructure faced repeated Canvas intrusions, exploited Free-For-Teacher issues, and is temporarily shutting accounts while the House Homeland Security Committee demands incident details.
#microsoft-security-updates
Information security
fromZero Day Initiative
2 days agoZero Day Initiative - The May 2026 Security Update Review
Most Microsoft fixes address elevation of privilege, with several code execution paths requiring varying attacker access levels and one kernel issue enabling code execution via crafted NVMe-oF handshake messages.
Information security
fromtheregister
1 day agoWelcome to the vulnpocalypse, as vendors use AI to find bugs and patches multiply like rabbits
AI-based code scanning is rapidly increasing vulnerability discovery, driving more patches and greater administrative workload while raising risks if patches break systems.
Information security
fromLondon Business News | Londonlovesbusiness.com
2 days agoHow we can combat the critical national infrastructure threat from the Iran war - London Business News | Londonlovesbusiness.com
UK critical infrastructure faces elevated, evolving cyber risk from Iran-related conflict, especially via indirect attacks through regional supply chains and overseas assets.
Information security
fromSecurityWeek
2 days agoICS Patch Tuesday: New Security Advisories From Siemens, Schneider, CISA
Multiple vendors released May 2026 ICS security advisories addressing critical and high-severity vulnerabilities, including remote code execution, takeover, XSS, and session hijacking.
fromThe Hacker News
1 day agoAzerbaijani Energy Firm Hit by Repeated Microsoft Exchange Exploitation
A threat actor with affiliations to China has been linked to a "multi-wave intrusion" targeting an unnamed Azerbaijani oil and gas company between late December 2025 and late February 2026, marking an expansion of its targeting.
Information security
fromIndependent
2 days agoMore than 200 fake websites targeted Irish residents with scams last year
More than 200 websites were found to be targeting Irish residents with scams last year, including fake online shops and fraudulent loan websites claiming to be regulated by the Central Bank of Ireland.
Information security
#soc-operations
Information security
fromThe Hacker News
2 days agoWebinar: What the Riskiest SOC Alerts Go Unanswered - and How Radiant Security Can Help
High-risk SOC alerts go unanswered due to structural coverage ceilings, lack of specialized expertise, and automation limits that deprioritize unfamiliar or novel alert categories.
Information security
fromTNW | Data-Security
2 days agoGoogle identifies first AI-developed zero-day exploit and thwarts planned mass exploitation event
Google identified an AI-assisted zero-day exploit, disrupted a planned mass exploitation event, and documented state-sponsored AI use in vulnerability research and malware development.
[ Load more ]