Section
News
Reporting from the trade press, breach notifications and government press releases.
252 matching records, 11 with confirmed exploitation.
-
European tech buyers add digital sovereignty to cyber shopping list
Sales from EU HQ'd vendor rocket in two years. The Trump affect? Yes but NIS2 and DORA are factors too
-
Notion Customer Data Compromised in Fireworks AI Hack
The attackers accessed chat transcripts for fewer than 1% of Notion workspaces. Most transcripts were unattributable. The post Notion Customer Data Compromised in Fireworks AI Hack appeared first on SecurityWeek .
-
Inside an AI Attack Against a US Retailer
When hand-typed commands failed to breach a US retailer, the attacker turned to AI-generated scripts, achieving lateral movement in minutes.
-
Hackers Deploy Malware in Fresh ScreenConnect Campaign
The attackers exploited a vulnerability in a legitimate extension to bypass ScreenConnect authentication. The post Hackers Deploy Malware in Fresh ScreenConnect Campaign appeared first on SecurityWeek .
-
Hackers Target N-central Zero-Days as N-able Rushes Patches
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones. The post Hackers Target N-central Zero-Days as N-able Rushes Patches appeared first on SecurityWeek .
-
London hotel put admin login for booking website on whiteboard behind the front desk
You could check out more than your room
-
Critical Red Hat Quay Vulnerability Could Expose Private Container Images
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access. The post Critical Red Hat Quay Vulnerability Could Expose Private Container Images…
-
Maersk Confirms Data Theft Amid $5 Million Extortion Attempt
The WhiteArmor ransomware group claims it stole 100GB of data from the shipping giant’s systems. The post Maersk Confirms Data Theft Amid $5 Million Extortion Attempt appeared first on SecurityWeek .
-
Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates
Couldn’t get the hardware it needed to generate certs, so tried to code a workaround
-
Srsly Risky Biz: Iranian hacks with Russian characteristics
Tom Uren and Amberleigh Jack talk about the French government attributing freezer hacks to cyber units within the Iranian Revolutionary Guard Corp. This surprises Tom, because the hacks were entirely consistent with Russian…
-
Chinese AI Project Scouts Spies in Taiwan Chip Industry
The CCP built a Big Data system to scrape reams of information and learn about individuals abroad, to potentially target and exploit them. Think Alice Huang Lite.
-
Japan Pushes Emergency Funding for Cybersecurity as AI-Assisted Breaches Rise
The package adds public-private cyber responders, an AI-focused team run by the economic ministry, and more leeway to use the government's new active cyber-defense powers.
-
AU: Hacker claims to have sold stolen exams to students — but marked them for identification purposes?
Aimee Edwards reports: Victoria’s Year 12 exams have been thrown into turmoil after the state’s curriculum and assessment authority website was hacked. A bizarre message appeared on the Victorian Curriculum and Assessment…
-
WhiteArmor Demands $5 Million from Maersk, Claims Theft of 100GB of Data
Pierluigi Paganini reports: A.P. Moller Maersk, the Danish shipping giant, says it identified an IT security incident involving unauthorized access and data extraction from one of its local legacy systems, one inherited from a…
-
Attackers Say 'Hello' to a Different Scale of Cloud Attack
Researchers dubbed an attack chain "Greeter" after discovering that attackers deliberately covered their trail by leaving "hello" messages in logs.
-
AI Raises the Stakes for Cyber Resilience
An organization's ability to quickly recover from a business disruption will be a competitive advantage in an era of AI-driven threats and business enablement.
-
N-able Takes N-central Platform Offline After Discovery of 33 Flaws
The RMM provider also released a hotfix as one of recommended mitigations to address public exploits for the alleged zero-days that allow for attacker takeover.
-
Vanderbilt restores systems after cyberattack as hackers claim data theft
Vanderbilt University is restoring campus technology, but has not confirmed the attackers’ claims of stolen student and employee data.
-
Who Runs the Ransomware Group Qilin?
The cybercrime group Qilin has emerged as the world's most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone. But even top Russian hackers make operational security…
-
Iran-backed network directed London attacks over FaceTime, US prosecutors say
An indictment unsealed Tuesday says the broader campaign, targeting Jewish and American sites, included attacks on synagogues in Belgium, the Netherlands and London, and U.S. bank buildings in Amsterdam and Paris.
-
The $26 Million Cyber Heist Rocking a Small New Jersey Town
Scott Calvert reports: This historic village, established in 1697, drips with charm. White clapboard houses on Main Street proclaim their vintage—“Built by John Nesbit 1804” reads one plaque—and locals proudly share that George…
-
N-able issues hotfix after researcher dumps PoCs in disclosure spat
The company briefly disabled access to its RMM platform after an independent researcher warned of critical flaws.
-
Critical Xen Orchestra Flaws Exploited in Attacks
A critical authentication bypass allows attackers to execute arbitrary code as admin and take over XCP-ng nodes. The post Critical Xen Orchestra Flaws Exploited in Attacks appeared first on SecurityWeek .
-
CISA sets operational priorities for partnerships, risk assessments and systemic action
An internal memo from CISA’s acting chief instructs senior leaders to keep the new priorities in mind with every choice they make.
-
Ca: York University Breach Exposes 19 Years of Student Health and Financial Data
Garrett Cole reports: Toronto’s York University has confirmed a major cybersecurity incident that resulted in the unauthorized theft of sensitive personal, medical, and financial records submitted across departmental webforms…
-
Hotel giant Wyndham exposed customer data after app security lapse
It’s been a while since hotel and resort giant Wyndham has shown up on DataBreaches.net. There was one report in 2024, but prior extensive coverage involved their historic litigation with the FTC following a breach. Now Zack…
-
Grok’s security blind spot exposed users and Musk’s company secrets
Paulina Okunytė reports: More than 35,000 apps created with Elon Musk’s AI assistant Grok were accessible to anyone on the internet, exposing corporate secrets and sensitive personal data, security researchers find. […] Claroc…
-
2013 breach at Russian cybercrime forum resurfaces with millions of victims’ credentials
Connor Jones reports: A 2013 breach of Russian-language cybercrime forum YouHack exposed its members’ login details – and millions of credentials they had posted about other victims, according to newly cataloged data. Have I Been…
-
Cyber threat prompts New Plymouth School District in Idaho to cancel classes
DysruptionHub reports: New Plymouth School District in Idaho canceled classes at all three schools after detecting a cyber threat in the district’s network Tuesday morning. “At this time we are not using computers or the district…
-
SG: Fullerton Health server hit by cyberattack; personal data of migrant workers affected
Rhea Yasmine reports: A server supporting Fullerton Health’s Migrant Worker Primary Care Plan (PCP) programme was hit by a cybersecurity incident, said the healthcare service provider. In a statement on its website on Nov 9, it…
-
French bank Credit Mutuel Arkea says €100m missing after cyberattack
Mathieu Rosemain, Elizabeth Howcroft and Mateusz Rabiega report: French lender Credit Mutuel Arkea has said that hackers stole around €100 million ($112.61 million) in a cyber heist and it is working to try to recover the money…
-
Hundreds of Dutch sports clubs report cyberattack exposing members’ personal data
NL Times reports: More than 350 Dutch sports clubs have reported a data breach to the Dutch Data Protection Authority (AP) following a cyberattack on membership administration system AllUnited on Monday evening. The number of…
-
ESET Links Cereal to Turla in Romanian Server Breach Case — Defense News
UA News reports: Slovak cybersecurity company ESET said that servers of a Romanian government institution were compromised in December 2025. The malware selected emails related to NATO and the European Union and created copies of…
-
Google DeepMind just mathematically verified key parts of Signal
The four-week project hints that AI could make formal verification far more practical.
-
Asus, Zoom Release Security Patches
Attackers could exploit them for command execution, memory overwrites, and privilege escalation. The post Asus, Zoom Release Security Patches appeared first on SecurityWeek .
-
Remus malware claims Gmail access even after you change your password
Developers of the infostealer Remus claim their malware can retain access to a victim’s Gmail even after a password reset.
-
Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities
Attackers could exploit the bugs to tamper with certificate entries, achieve remote code execution, and compromise hosts. The post Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities appeared first on SecurityWeek .
-
Poland shuts down government services platform ePUAP following cyberattack
The attack targeted a nationwide system that allows users to submit official documents, communicate with government agencies and complete administrative procedures online.
-
Britain, France set out first guidelines for commercial hacking firms
The guidelines call on businesses that develop, sell or finance CCICs to vet their customers, establish technical safeguards against misuse and to maintain systems for monitoring and reporting abuses.
-
Finite State Raises $27 Million to Secure Software and Firmware in Connected Devices
The Series C round will fund international expansion and more autonomous features for the firm’s device security platform. The post Finite State Raises $27 Million to Secure Software and Firmware in Connected Devices appeared…
-
Muse sleep band users weren’t told their brain data was training AI
Muse maker Interaxon reportedly trained AI on users’ de-identified brainwave data, then revised its privacy policy after journalists asked questions.
-
Fortinet Patches Nearly 100 Vulnerabilities
The massive drop comes after the company integrated frontier AI models into its product security testing. The post Fortinet Patches Nearly 100 Vulnerabilities appeared first on SecurityWeek .
-
Shipping giant Maersk probes 'IT security incident,' data theft
Says it 'strongly' suspects attack limited to legacy system, and that nothing sensitive is at risk
-
Three People Arrested for AI-Enhanced Impersonation Fraud
It’s hard to believe how lucrative this crime can be: According to a press release from the United States attorney’s office for the southern district of New York, three men Jacob Soall, Sharon Hazan, and Guy Sheetrit were…
-
NCSC scheme will help critical organisations test their cyber defences
New NCSC Cyber Adversary Simulation scheme will help critical organisations strengthen their resilience through rigorous, real-world testing by trusted providers.
-
Bay Raises $50 Million to Control What Enterprise AI Agents Can Do
Founded by three ex-IDF Unit 8200 intelligence officers, Bay is launched to provide a control plane for AI agents. The post Bay Raises $50 Million to Control What Enterprise AI Agents Can Do appeared first on SecurityWeek .
-
Microsoft Patch Tuesday fixes Outlook flaw already under attack
Microsoft’s November 2026 Patch Tuesday fixes an actively exploited Outlook vulnerability. Check for Office updates separately.
-
Dreeze Emerges From Stealth With $33M to Rebuild Cloud Apps After Cyberattacks
Created by Zerto and Kashya veterans, the startup has launched a platform designed to recover whole cloud applications. The post Dreeze Emerges From Stealth With $33M to Rebuild Cloud Apps After Cyberattacks appeared first on…
-
ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure
Pre-Patch Tuesday advisories were published by VDE CERT, Phoenix Contact, Johnson Controls, and Hitachi Energy. The post ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure appeared first on SecurityWeek .
-
Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities
The flaws, CVE-2026-111793 and CVE-2026-20320, let attackers leak sensitive information, including configuration data. The post Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities appeared first on SecurityWeek .
-
Chipmaker Patch Tuesday: Over 200 Vulnerabilities Addressed by Intel, AMD
Intel and AMD disclose more than 200 vulnerabilities, including critical flaws in Intel TDX software and numerous AMD graphics bugs. The post Chipmaker Patch Tuesday: Over 200 Vulnerabilities Addressed by Intel, AMD appeared…
-
Recently Patched Barracuda Vulnerabilities Exploited in Attacks
The security defects could allow attackers to bypass authorization and gain root access to devices. The post Recently Patched Barracuda Vulnerabilities Exploited in Attacks appeared first on SecurityWeek .
-
YouHack - 7,160,849 breached accounts
In May 2013, the Russian-language hacking forum YouHack suffered a data breach that was later redistributed as part of a larger corpus of data . The breach exposed 107k forum members' email addresses, usernames, IP addresses and…
-
Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms
Apple has patched Bluetooth and AirPlay pairing flaws, iMessage vulnerabilities, and an exploited Brotli bug across its platforms. The post Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms appeared first…
-
OpenAI builds a kill switch for its research models
How much damage can a rogue agent do in 35 seconds? Asking cos that’s how long it might take to shut one down
-
Risky Bulletin: France blames Iran for supermarket freezer hacks
France blames Iran for supermarket freezer hacks, the White House nominates Palantir’s CISO as CISA director, another Russian cloud provider gets hacked, and N-able takes down its SaaS platform after a researcher discloses 33…
-
СберСпасибо (SberSpasibo) - 3,288,711 breached accounts
In March 2023, data allegedly taken from СберСпасибо (SberSpasibo), the loyalty program of Russian bank Сбербанк (Sberbank), was published online . The data contained records relating to 48M users, including 3.3M unique email…
-
CISA director pick already drawing concern from Hill Dems over Palantir connection
Others touted Michael LoSapio as a fit for the job due to his technical credentials as CISO for the company. The post CISA director pick already drawing concern from Hill Dems over Palantir connection appeared first on CyberScoop…
-
November Patch Tuesday boasts over 1,000 bugs, one already under attack
Microsoft admins wail and gnash their teeth
-
November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far
Microsoft admins wail and gnash their teeth
-
Lake County School Board seeks injunction requiring a parent who received unredacted data because of the district’s error to destroy the data
Fox35 in Orlando, Florida, reports that a school district is suing a parent after the district mistakenly sent them unredacted data in 47,000 records: The Lake County School Board filed a lawsuit against a parent after an…
-
November Patch Tuesday: An Overflowing Cornucopia of CVEs
Microsoft serves up an actively exploited Outlook zero-day, and a wave of critical Exchange, SharePoint, Windows Search, and LDAP bugs that exhausted defenders need to prioritize fast.
-
Microsoft Fixes Nearly 1,100 Security Vulnerabilities
Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software. This month's Patch Tuesday addresses 63 critical flaws…
-
The US wants its quantum lead to turn into factories and supply chains
There’s bipartisan support for further investment in the U.S. quantum industry, along with worries that America’s industrial capacity won’t keep up with demand. The post The US wants its quantum lead to turn into factories and…
-
Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday
Microsoft’s November security update addresses roughly 1,090 vulnerabilities across Windows, Office, Azure and the company’s other product lines, the second consecutive monthly release to exceed the totals of all previous years.…
-
Ring robots ready to patrol paranoids’ pads
Amazon calls its home security drone and business patrol bot 'proactive protection'
-
US Army member arrested in UK over allegations of spying for Russia
The unnamed soldier was arrested by British counterterrorism police “working closely” with U.S. authorities, including the FBI and the military, the Metropolitan Police said in a statement.
-
Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
Researcher finds 35,000 Grok Build apps wide open to anyone who looked for them.
-
Artex: The AI Pen-Test Tool Hackers Turned Into a Weapon
Forks of the open source Artex framework, along with 45 similar pen-testing tools, remain capable of executing credential attacks and cloud breaches at machine speed across multiple industries.
-
Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row
An exploited Outlook vulnerability drew most of the attention in Microsoft's latest Patch Tuesday, which listed 1,093 bugs total.
-
F-Secure Identifies 26 Ways AI Can Harm Consumers, and Where to Stop Them
New AI Harms Taxonomy traces how harm moves through AI systems, from misleading chatbot answers to compromised autonomous agents, and identifies where defenses can intervene.
-
Near AI Breach Exposes User Details and Data From 18 AI Agents
Jose Antonio Lanz reports: Near AI has disclosed a breach that exposed account information belonging to about 100 users and data from 18 AI agents after an attacker exploited software running its servers. The company said in a…
-
Checkmarx Appoints Kobi Sivilya as Chief Information Security Officer
Sivilya brings deep cybersecurity and technology leadership to Checkmarx as AI transforms software development.
-
How to Assess OT Incident Response Preparedness
Cloud Range's free 28-question OT Cyber Readiness Assessment helps organizations identify gaps in operational technology (OT) incident response.
-
Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
CVE-2026-124194 is the Outlook zero-day for which Microsoft says it’s aware of active exploitation. The post Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft appeared first on SecurityWeek .
-
Barracuda’s email security gateways bitten by make-me-root vulns
Someone's fishing for exposed devices
-
AI Coding Agents Leak Thousands of Secrets to GitHub
A command in Claude Code inadvertently saves files with credentials and other sensitive data to public Git repositories, creating security gaps for organizations.
-
Adobe Patches 110 Vulnerabilities Across 9 Products
Adobe has fixed vulnerabilities in AEM, Premiere, Photoshop, After Effects, Connect, Audition, Dimension, Content Credentials SDK, and Media Encoder. The post Adobe Patches 110 Vulnerabilities Across 9 Products appeared first on…
-
Vanderbilt University reels following ransomware attack claimed by BYOD group
Some services began returning online Tuesday following a ransomware incident detected on Monday across Vanderbilt systems and applications. The post Vanderbilt University reels following ransomware attack claimed by BYOD group…
-
Software Transparency Is Changing: Allan Friedman on SBOM, AI BOMs and What Comes Next
SBOM pioneer Allan Friedman joined the SecurityWeek Podcast to discuss why knowing what is inside software is only the beginning, how AI is complicating software supply chain visibility, and what organizations should be doing…
-
Google Widens Gemini 4 Carbon Access After AI Agents Verify Signal Code
Google opened Carbon to paying developers and businesses as DeepMind used agents built on it to prove libsignal security guarantees. The post Google Widens Gemini 4 Carbon Access After AI Agents Verify Signal Code appeared first…
-
Trump taps Palantir security chief to run battered US cyber defense agency
Michael LoSapio could inherit a depleted workforce and a political headache or two, courtesy of his current employer
-
AI company Fireworks says hackers stole data, billing info during October breaches
Fireworks said the incident affected a “limited number of customer accounts” — all of whom were notified of the attack.
-
N-able takes its remote access service offline after researcher publishes dozens of zero-day bugs
The remote access giant also urged its self-hosted customers to take down their own servers amid a "critical security incident," fearing the possibility of cyberattacks.
-
Cybercriminals are increasingly infecting regular people with spyware
Cybercriminals are infecting devices on a large scale with spyware, increasingly compromising systems belonging to average people, according to a new report.
-
Trump picks Palantir cybersecurity executive to lead CISA
The nomination — Trump’s second attempt to fill a post that has sat vacant for his entire second term — could face steep odds in the Senate.
-
France attributes grocery hacks to Iran-backed threat actors
Attackers compromised hundreds of refrigerator components at supermarkets, agricultural facilities and local shops.
-
Fireworks AI gets burned twice as customer data exposure widens
Inference biz pins latest breach on cloud provider and LLMJacking miscreants
-
UZ Brussel among hospitals experiencing severe network problems
VRT reports: Brussels University Hospital UZ Brussel (VUB) was the first hospital to report network problems. These are affecting the hospital’s IT infrastructure and telephone systems. There are also problems at AZ Monica in…
-
Researcher bypassed Meta smart glasses’ safeguards to run her own code
She was able to bypass a safeguard meant to stop unauthorized software running on Meta glasses. It wasn't easy, but showed it is possible.
-
Today: CISO Forum Virtual Summit 2026 Day 2 – Join Cybersecurity Leaders Online
Designed for cybersecurity leaders, this immersive two-day virtual event is your premier destination to discuss, share, and learn innovative risk management and defense strategies defining the modern enterprise. The post Today…
-
WhiteMatter Raises $20 Million in Series A Funding
The cybersecurity startup deploys a dedicated guardian agent for every AI agent in an organization’s environment. The post WhiteMatter Raises $20 Million in Series A Funding appeared first on SecurityWeek .
-
HIPAA Enforcement by State Attorneys General
HIPAA Journal has a convenient table of HIPAA enforcement actions by state attorneys general. Most entries involve violations of the Security Rule and/or HITECH, but a few appear to relate more to the Privacy Rule or access to…
-
SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities
SAP has published 42 new and updated security advisories, including nine that address critical-severity vulnerabilities. The post SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities appeared first on SecurityWeek .
-
Palantir exec nominated to lead CISA; lame-duck Senate vote is uncertain
Michael LoSapio, Palantir's chief information security officer, is officially President Donald Trump's pick to lead the Cybersecurity and Infrastructure Security Agency.
-
Chrome zero-day whack-a-mole continues as 2026 tally hits 8
Another Chrome memory bug gets squashed, but not before attackers got their hands on it
-
Over a Dozen Organizations Hit in Qubole Supply Chain Attack
Hackers used compromised Qubole IAM credentials to steal customer files, secrets, keys, environment variables, and credentials. The post Over a Dozen Organizations Hit in Qubole Supply Chain Attack appeared first on SecurityWeek .
-
Update Chrome now to fix a flaw attackers are exploiting
Google has released Chrome updates for desktop and Android to patch a zero-day vulnerability already being exploited in attacks.
-
Before you buy an advent calendar, check these warning signs
Copied storefronts, fake urgency, and contradictory product claims are among the warning signs we found on suspicious advent calendar sites.
-
Cyberattacks threaten to make open source AI a little less open, Hugging Face exec warns
Hugging Face executive Irene Solaiman warns that growing cyberattacks on open AI platforms could force tighter security restrictions, threatening the accessibility that makes open source communities valuable to developers…
Reuse this view
Same filters as JSON: /api/items?category=news&window=7d&sort=newest&limit=100. RSS for this section: feed.xml.