Hijacked HBO Max account floods Reddit with ClickFix ads
A verified HBO Max Reddit account pushed 108 malicious ads in 48 hours, part of a broader operation spreading infostealers.
The Latest
A $200 circuit board cracks Intel and AMD confidential computing
Researchers built a cheap interposer that silently drops DDR5 writes and breaks the integrity guarantees behind confidential VMs.
Cisco patches a zero-day that turns one email into root
A crafted message can give an unauthenticated attacker root on Cisco's secure email gateway, and the flaw is already being…
Chinese spies pair a Chrome zero-day with a fake Gemini extension
A recently patched Chrome and Windows exploit chain is now delivering two separate espionage toolsets against NGO targets.
Chinese crew turns a Gitea bug into a 13-victim espionage spree
A newly named threat actor automated a July Gitea flaw into a framework that stole source code and pushed on…
Mass scans drain cloud keys from exposed Vite dev servers
Attackers are hammering internet-facing Vite development servers to pull AWS and Azure credentials and infrastructure state files.
A patchable VPN flaw exposed 246,000 Japanese government records
A shared platform serving 23 ministries was breached through an unpatched VPN, with disclosure coming 78 days after detection.
Old Telegram exports can still run a hidden attacker script
A flaw fixed in July left previously exported HTML chats able to run hidden JavaScript that copies messages to an…
Fake Cloudflare page on Indian IT agency site pushed terminal commands
A government-linked Indian IT portal served a fake Cloudflare check that tried to get visitors to run a copied command.
AWS benchmark finds AI code scanners drown in false alarms
A new AWS benchmark finds that AI models catch most real bugs but flag a huge share of safe code…
Britain nudges 23 million One Login users toward passkeys
GOV.UK One Login is opening passkeys to more than 23 million users, letting them sign in without a password.
Telus tells customers their accounts were raided with stolen passwords
Canada's Telus says attackers used stolen credentials to reach customer records over more than a year.
A Twitch viewer add-on slipped 31,000 session tokens to a bot service
A viewer add-on with tens of thousands of installs sent live Twitch session tokens to a commercial bot operator.
Microsoft moves Teams and M365 web users to new domains
Firewall and proxy rules that allow the old addresses will need updating before early October.
Spotlight
Airlines win relief from compensation when a hack delays flights
A new Transportation Department rule lets carriers skip meal vouchers and hotels for cyberattack delays if they meet security rules.
A few dollars is enough to kill a stranger’s phone signal
Researchers blocked devices they never owned for under $4, exploiting six weaknesses in the lost and stolen phone system.
FTC drops its health app breach notice policy
The commission withdrew a Biden-era statement that treated health and fitness apps as covered by federal breach notification rules.
Surfshark traces an exposure to a test server left open
The VPN provider says a misconfigured internal test server gave outsiders engineering material and build credentials.
Features
Android work profiles become a hiding place for Gigabud trojan
Group-IB found the long-running banking trojan building a second app that shelters inside Android's employer workspace.
Revolut treated a spoofed agency email as a lawful data request
A forged request sent from inside a real government domain was enough to pull identity documents, selfies, and Bitcoin histories…
cPanel bug lets one mailbox account seize the whole server
One cPanel account with mail rights could reach root on a shared server before this week's fix.
ConnectWise patches a ScreenConnect flaw that let sessions move files
ConnectWise closed a ScreenConnect gap that let live sessions move and run files without consent.
Android Early Access window hides thousands of shady apps
Bitdefender says Google Play's Early Access program shelters thousands of deceptive apps.
Anthropic blocks Yemen accounts that asked Claude to build missiles
Anthropic says blocked accounts in Houthi-held Yemen tried to use Claude for missile work.