Largest LGBTQ dating app closes UK suit with £26M payment
Grindr will pay £26M to settle a British lawsuit over pre-2020 data sharing with third parties, including HIV status information.
The Latest
AI models become ransom bait as thieves threaten to leak them
Google's newest AI Threat Tracker says extortion crews are stealing proprietary AI models and research, then demanding payment to keep…
Bing poisoners push crypto miner behind phony tech support pages
The DFIR Report traces BengalSEO, an India-based search poisoning operation that has steered Bing users into scams and a miner-dropping…
BigBear 2.0 phishing panel reveals thousands of stolen Microsoft sessions
CloudSEK says it reached the admin panel of a phishing service holding thousands of session cookies stolen from Microsoft 365…
Bookmarks add-on hides a backdoor that crosses the browser sandbox
SOCRadar details PEEP, a post-compromise toolkit that rides a fake bookmarks extension from the browser out to host-level command execution.
Red Hat identity stack opens anonymous path to admin credentials
Two flaws chained together let a FreeIPA client that has never logged in plant a Kerberos identity into the administrators…
Conde Nast user trove from 32.8 million accounts goes for $15,000
A Russian-language forum seller is offering what analysts call a genuine 32.8 million-account Conde Nast database tied to December's WIRED…
Bitcoin sidechain loses $320M to self-proclaimed white hats
Nearly all of the Bitcoin backing Blockstream's Liquid sidechain has been drained, with the responsible hackers promising to return it…
Zero-day hunter adds Avast and Nvidia bugs to a CrowdStrike streak
Nightmare Eclipse adds Avast and Nvidia zero-day exploits to its CrowdStrike drop, and Gen says the Avast bug is fixed.
Check Point cracks JSCeal’s V8 shell to expose Google session replay
Check Point's static deobfuscation exposes JSCeal, a compiled V8 malware family that replays stolen cookies into Google accounts.
N-central zero-day claims split N-able’s advisories as hotfix four ships
N-able's fourth N-central hotfix closes a CVSS 10 pre-auth RCE while its own advisories disagree on whether it is already exploited.
Telerik UI exploit goes public for a chain Progress fixed in July
TantoSec's public tool turns a Telerik UI padding oracle into unauthenticated code execution for shops that skipped the July patch.
Tech support scams turn ScreenConnect into a worm that jumps hosts
Three August lures ended in rogue ScreenConnect clients that spread a four-stage VBScript chain to every new host.
Airport operator refuses ransom, extortionists dump 8.8M records
FulcrumSec dumped MAG airport customer data after the operator refused a ransom, exposing 8.8 million people.
Spotlight
JetBrains’ own Cadence cloud fell to an unpatched TeamCity flaw
JetBrains tells Cadence users to rotate all credentials after attackers breached its own cloud via unpatched TeamCity.
Dormant German wiki hosted 18,000 secret posts from OpenAI agents
Researchers say OpenAI agents left roughly 18,000 posts on a dormant German wiki while coordinating on timed tasks.
REVSTEALER’s leftover modules outlast the stealer to mine crypto
Elastic finds four REVSTEALER companion modules that persist after the stealer deletes itself, including one that mines crypto.
StyleSmuggler zero-day hijacks Magento stores with no patch ready
An unpatched flaw named StyleSmuggler is letting attackers backdoor Magento and Adobe Commerce stores with no login.
Features
MikroTik SSH hijacks need no password, CERT Polska warns
CERT Polska warns that MikroTik routers with SSH exposed to the internet are being hijacked without any authentication.
Plex ships quiet fixes for flaws across server and desktop apps
Plex pushes security fixes for undisclosed flaws in Media Server 1.43.3 and Desktop 1.115.0.
Super Forms upload bug draws 250,000 blocked exploit tries
Wordfence counts 440,000 exploit attempts against Super Forms and Elementor Pro file-upload flaws.
Daybreak hands $1B in OpenAI credits to stretched defenders
OpenAI pledges $1B in credits and training for under-resourced defenders through its Daybreak program.
HPE fixes 34 ArubaOS-CX flaws led by a 9.8 RCE cluster
HPE's AOS-CX updates close 34 CVEs including a 9.8-rated unauthenticated RCE cluster.
Invisible Unicode tags hide phishing lures from email filters
Microsoft tracks a phishing wave that splits lure words with invisible tag characters to dodge email filters.