Fake Cloudflare page on Indian IT agency site pushed terminal commands
A government-linked Indian IT portal served a fake Cloudflare check that tried to get visitors to run a copied command.
The Latest
AWS benchmark finds AI code scanners drown in false alarms
A new AWS benchmark finds that AI models catch most real bugs but flag a huge share of safe code…
Britain nudges 23 million One Login users toward passkeys
GOV.UK One Login is opening passkeys to more than 23 million users, letting them sign in without a password.
Telus tells customers their accounts were raided with stolen passwords
Canada's Telus says attackers used stolen credentials to reach customer records over more than a year.
A Twitch viewer add-on slipped 31,000 session tokens to a bot service
A viewer add-on with tens of thousands of installs sent live Twitch session tokens to a commercial bot operator.
Microsoft moves Teams and M365 web users to new domains
Firewall and proxy rules that allow the old addresses will need updating before early October.
Airlines win relief from compensation when a hack delays flights
A new Transportation Department rule lets carriers skip meal vouchers and hotels for cyberattack delays if they meet security rules.
A few dollars is enough to kill a stranger’s phone signal
Researchers blocked devices they never owned for under $4, exploiting six weaknesses in the lost and stolen phone system.
FTC drops its health app breach notice policy
The commission withdrew a Biden-era statement that treated health and fitness apps as covered by federal breach notification rules.
Surfshark traces an exposure to a test server left open
The VPN provider says a misconfigured internal test server gave outsiders engineering material and build credentials.
Android work profiles become a hiding place for Gigabud trojan
Group-IB found the long-running banking trojan building a second app that shelters inside Android's employer workspace.
Revolut treated a spoofed agency email as a lawful data request
A forged request sent from inside a real government domain was enough to pull identity documents, selfies, and Bitcoin histories…
cPanel bug lets one mailbox account seize the whole server
One cPanel account with mail rights could reach root on a shared server before this week's fix.
ConnectWise patches a ScreenConnect flaw that let sessions move files
ConnectWise closed a ScreenConnect gap that let live sessions move and run files without consent.
Spotlight
Android Early Access window hides thousands of shady apps
Bitdefender says Google Play's Early Access program shelters thousands of deceptive apps.
Anthropic blocks Yemen accounts that asked Claude to build missiles
Anthropic says blocked accounts in Houthi-held Yemen tried to use Claude for missile work.
OpenAI agents flooded RubyGems with thousands of fake packages
New research ties May's RubyGems junk-package flood to a swarm of autonomous OpenAI agents.
GitLab patches a 10.0 file-read flaw as scanning begins within hours
Two GitLab flaws, one a perfect 10.0, drew automated probes within hours of the patch.
Features
Stolen AI session tokens let thieves skip the login step
Okta found thousands of live AI session tokens in a stealer log, letting thieves replay their way into paid tools.
A Conti coder’s ransomware spree ends in a four-year sentence
Oleksii Lytvynenko, a lawyer who coded for the Conti ransomware crew, will spend four years in a US prison.
Apple Watch Series 12 can transcribe chats without asking
Apple's new Watch can turn nearby speech into text and summaries, and bystanders never get a say.
Vendors now have 24 hours to report exploited flaws in the EU
Manufacturers selling software and connected products in the EU must report exploited flaws within 24 hours.
Old Chromium build inside Sogou let attackers into Windows
Gen Digital says a China-linked crew used a Sogou input method flaw to plant the GRAYRABBIT backdoor on Windows machines.
AI agents ran a PaperCut break-in across 395 organizations
GreyNoise says a lone operator used hundreds of AI agents to break into 395 organizations through two PaperCut flaws.