Section
News
Reporting from the trade press, breach notifications and government press releases.
255 matching records, 4 with confirmed exploitation.
-
Feds warn grocers: Don't chill on cyber defenses as freezer hacking spree heats up
No documented attacks against American supermarkets…yet
-
Queens Public Library says ransomware attack disrupted Wi-Fi, on-site computers
The library system, which has 66 branches serving the borough’s 2.3 million residents, published multiple alerts on Wednesday confirming that the disruption was caused by a ransomware attack.
-
US Government Email Systems Open to Abuse Thanks to Typos
Erroneous or outdated DNS records can give attackers surprising powers over organizations' email systems.
-
What We Missed: Knicks Phishing Test Goes Out of Bounds
In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from an ill-conceived phishing simulation to a hacktivist attack on a US government agency.
-
The White House is apparently a popular residential proxy exit spot
How it got there is another matter entirely
-
Social media giants sue California to overturn law shielding kids 15 and under from compulsive use
Google, Meta and TikTok each filed suit in federal court against an incoming California law that blocks platforms from deploying features considered “psychologically exploitative.”
-
US issues more sanctions against Prince Group scam center affiliates
The sanctions target four people and 41 companies linked to the Prince Group — a Cambodian company accused of running a billion-dollar scam operation.
-
Air Force cyber official: need to invest in digital forensics
Wanda Jones-Heath said it’s key to keeping pace with incidents and threats, speaking at a Datadog event Thursday. The post Air Force cyber official: need to invest in digital forensics appeared first on CyberScoop .
-
Harden cooling systems now, feds warn critical infrastructure operators amid attacks
The U.S. government on Thursday called on critical infrastructure operators to safeguard their cooling systems following hacks that have caused chaos in European supermarkets in recent weeks.
-
US government warns of ‘ongoing cyber threat’ amid mass hacks of industrial retail and military freezers
A joint U.S. government statement says the hacks are affecting the food, transportation, and healthcare industries after reports of global mass hacks.
-
Get root on a musl Linux system by slamming it with an overly long password
Decade-old vulnerability in OpenSSH is now fixed, so get a-patchin'
-
October crypto-tracker hack: Access cracked, law enforcement tokens packed
Agentic 'on-path attack' went after Chainalysis's tools, which are routinely called upon to assist police investigations
-
AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research
An unreleased OpenAI cyber model found and exploited 948 distinct Linux kernel privilege escalation bugs for about $1.2 million. The post AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research appeared first on…
-
Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign
Russian state-linked hackers targeted users in Ukraine, the United States and Europe in a campaign to steal sensitive information from iPhone and Android devices, researchers found.
-
OpenAI releases GPT-6 Cyber, and promises this one stays within 'rules of engagement'
The latest bug hunting model 'avoided exploiting out-of-scope services over 99 percent of the time', claims House of Altman
-
OpenAI debuts GPT-6 Cyber, touting better performance — and safety guardrails
After a summer of sandbox escaping hacks, OpenAI said their new model was trained to be more cautious around user intent and less sensitive to “reward hacking” behaviors. The post OpenAI debuts GPT-6 Cyber, touting better…
-
Ninth Circuit: Breach Of Confidence Confers Standing In Health Data Security Case
Claire E. Castles, Amanda Fitzsimmons, Nathaniel P. Garrett, Rebekah Byers Kcehowski, Mary Alexander Myers, and Alexander H. Southwell of Jones Day write: Departing from the risk-based approach many courts have applied since…
-
SecurityDataPipeline.com Launches as a New Educational Resource for the AI Era
The ungated resource explains how security data pipelines reduce SIEM ingestion costs, preserve detection coverage, and prepare the data layer for AI-driven security operations.
-
What to expect from Democrats’ cybersecurity agenda in Congress
From CISA to AI and beyond, the new Democratic majority will have many opportunities to scrutinize government programs and push new policies.
-
UK: Royal Cornwall Hospitals Trust data breach exposed health details of 7,715 staff
Lee Trewhela reports: The Royal Cornwall Hospitals Trust (RCHT) has admitted a huge data breach has led to many affected staff experiencing “significant distress, loss of trust and ongoing anxiety”. The breach exposed sensitive…
-
Tobacco company got smoked by leaving secret recipes on a file share
They denied the data was real...then removed it
-
French authorities probe cyberattack targeting nation’s blood supply
The attack follows a wave of hacks against refrigeration systems at supermarkets across Europe.
-
Anthropic won’t fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries
Jessica Lyons reports: A vulnerability in Anthropic’s Claude products lets any browser extension that can control Claude Dispatch make Claude Desktop run code on the computer – or even a different machine signed into the same…
-
Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns
More than 200 sites were seen serving phishing content to first-time visitors but not to those who revisit. The post Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns appeared first on SecurityWeek .
-
Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries
From EOP to RCE in six simple steps
-
Cyberattack Hits French Blood Bank Site but No Blood Products Are Compromised
The incident comes after supermarkets in a number of European countries reported this week that their fridges and freezers warmed up after they were remotely hacked. The post Cyberattack Hits French Blood Bank Site but No Blood…
-
Korean court keeps Coupang’s record data breach fine in force, delays corrective action plan for 30 days
There’s yet another update in the Coupang data breach case. Previous coverage on DataBreaches.net of the incident, enforcement actions, and Coupang’s objections to the fines and enforcement actions can be found in links under…
-
Canadian man extradited to the U.S. for his role in computer hacking scheme targeting universities
November 3, 2026: ROCHESTER, N.Y.-U.S. Attorney Michael DiGiacomo announced today that a federal grand jury has returned an indictment charging Ryan James Roach, 35 of Saskatchewan, Canada, and Mathiew James Stubbings, 41, of…
-
Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws
Cisco patched an RCE in UCS Central Software; WatchGuard fixed authentication and MitM flaws. The post Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws appeared first on SecurityWeek .
-
Vizio, Samsung smart TVs seem to ignore tracking opt outs
If you thought that opting out of surveillance on your smart TV would give you your privacy back, think again.
-
New York's Queens Public Library battles ransomware crims: Wi-Fi, checkouts, and website go dark
No gang has claimed the attack on incredible neighborhood resource yet
-
Norway's aid agency pwned and all users' data is stolen
Norad said it cannot be sure that the details of those in 'conflict areas and authoritarian states' are safe or not
-
The Agent Smith Dilemma: Governing Agentic Identities
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter. The post The Agent Smith Dilemma: Governing Agentic Identities appeared first on SecurityWeek .
-
CISO Conversations: Ryan Davis – The Unknown Is Where Security Meets Reality
Ryan Davis went from hacking his school’s network to running security at New Charter Technologies. What worries him now is shadow AI. The post CISO Conversations: Ryan Davis – The Unknown Is Where Security Meets Reality appeared…
-
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
Tracked as CVE-2026-107441, the out-of-bounds write flaw could allow attackers to execute OS commands via crafted HTTP requests. The post Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day appeared first on…
-
Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes
The large-scale watering hole campaign has been targeting entities in the US and Europe, mainly in Ukraine. The post Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes appeared first on…
-
OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming, Exploit Tasks
OpenAI says its Critical-rated cyber model met fewer hidden task goals when work was framed as AI safety research, often silently. The post OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming, Exploit Tasks…
-
Want to Rent an Internet Address at the White House?
Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy…
-
Srsly Risky Biz: The ritual bitcoin sacrifices will continue until security improves
Tom Uren and Amberleigh Jack talk about North Korea’s hack of the Binance cryptocurrency exchange. Binance’s founder CZ says it is a wake up call for real banks, but he’s wrong. Even though they are probably just as hackable as…
-
Chainalysis warns all users hit in cyber breach involving ‘agentic’ techniques
Chainalysis, the blockchain analytics company, said Wednesday night that some information belonging to all its users — which its website says include those in the law enforcement and national security sectors — had been exposed…
-
Ukraine fires two senior security officials amid corruption probe into scam call centers
Ukraine's security service has fired two senior officials amid a corruption investigation into an alleged criminal network that bribed law enforcement officers to protect fraudulent call centers and other illegal operations.
-
What Democratic control of Congress means for cybersecurity
There’s a lame-duck session before Dems take over, but the leaders of the homeland security panels are already teeing up their agendas. The post What Democratic control of Congress means for cybersecurity appeared first on…
-
Lab 1 warns breach data now exposes thousands more firms
Mara Sugue reports: Lab 1 has published a report analysing 328 million files from 2,089 datasets exposed after cyber attacks. It found that the median breach now exposes data linked to 542 organisations beyond the named victim.…
-
Student Data Breach Affects Up to 16 Icelandic Schools
Iceland Review reports: A security breach affected Inna, the student-information system used by Icelandic upper-secondary schools. It allowed a student to attempt to alter other pupils’ grades and attendance records. Iceland’s…
-
Hackers exploited iOS and Android flaws to infect phones
Researchers say group may have been Kremlin-sponsored in search of diplomatic targets.
-
Apple turns iCloud into spy cloud, will start looking at public share links
Content shared with anyone who has the URL will be scanned for 'harmful content,' though the iMaker hasn't defined that term
-
Critical Rails Bug Threatens to Derail Vulnerable Servers
An attacker could write arbitrary files and read sensitive files via images uploaded to the Rails Active Storage ImageMagick integration, possibly positioning a threat actor for lateral movement.
-
More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus
Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines have all come forward over the last week to report data breaches traced back to Amadeus IT Group — a company that builds and…
-
Hackers stole DreamHost customer files and inboxes during months-long attack
The web host said hackers exploited a vulnerability to access customer emails and files during a "deliberate attack."
-
Officials extradite Canadian man to US for alleged cryptomining spree
Ryan Roach and his alleged co-conspirator, Mathiew Stubbings, are accused of compromising U.S. universities’ computers and taking over processing power to mine for cryptocurrency. The post Officials extradite Canadian man to US…
-
Canadian extradited to US for allegedly hacking schools in at least four states
The Department of Justice said it identified two suspects in a case that dates back to 2016 and involved illicit cryptomining on the computers of U.S. educational institutions.
-
Hugging Face’s CEO Says His P(Doom) Is ‘Close to Zero’
“Most of the risk is actually created by a couple of players building behind closed doors,” Clément Delangue said of the need for open source AI.
-
French bank confirms cyber heist, hackers suspected to have stolen an estimated $133 million
Crédit Mutuel Arkéa said in a press notice that the attackers were able to make transfers using the bank’s own account after compromising an unnamed supplier.
-
The fake $750 Apple Cash reward that pays out nothing
A fake $750 Apple Cash offer uses scripted checks and fake countdowns. Affiliate marketers earn a commission; you get no reward.
-
Building on open source AI? Hugging Face’s policy chief on the costs, risks, and trade-offs
Open source models are becoming more mainstream as enterprises, governments and startups alike rely on the promise of lower costs, more control, and more flexibility. But as increasingly capable models become more freely…
-
Hackers steal 320,000 UK school files and publish them on dark web
Nicole Wootton-Cane reports: At least 320,000 school files stolen during a cyber attack on Bristol City Council’s servers have been found posted to the dark web. Hackers targeted the council’s Trading with Schools platform and…
-
Cyberattack wipes cloud data at major Russian hosting provider Beget
Daryna Antoniuk reports: A major Russian web hosting provider is struggling to restore its services after a cyberattack destroyed data across its cloud infrastructure and disrupted hundreds of websites. Beget, one of Russia’s…
-
mSecure tells users to change passwords but won’t say why
mSecure has urged users to protect information stored in its app, but hasn’t explained what happened or whether anyone’s data was exposed.
-
Google, Partners Disrupt 1.3 Million-Device-Strong XCPE Botnet
Google alleges that Android device manufacturer Videostrong ran the operation, which infected set-top boxes and IoT devices with a backdoor to create infrastructure for criminal activity.
-
Attacker abuses Microsoft Entra ID to target downstream MSP clients
The campaign uses valid credentials to gain access to organizations across various sectors.
-
Ukrainian news outlet Kyiv Independent hit by suspected Russian cyberattack
A suspected Russian cyberattack disrupted the website of The Kyiv Independent, one of Ukraine’s leading English-language news outlets.
-
Binance says hackers who stole billions in crypto spent months planning heist
Techniques included laptop infections, compromised internal tooling, and fake job interviews.
-
US gov IT worker pleads guilty to sending Top Secret files to Ethiopia
Help desk technician agrees to minimum 10-year jail term after being caught copying files for more than 2 years
-
Companies spend more on cybersecurity but still struggle with AI oversight
Shadow AI remains a persistent problem, even as IT and security budgets grow, according to a new report.
-
Sysdig Adds Runtime Security and Governance for AI Agents
Sysdig’s platform uses runtime visibility to track AI agent actions and block risky behavior before it reaches production systems. The post Sysdig Adds Runtime Security and Governance for AI Agents appeared first on SecurityWeek .
-
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
An authentication bypass and a command injection flaw can be chained for root access on Barracuda’s Email Security Gateway appliances. The post Barracuda ESG Authentication Bypass Flaw Opens Path to Root appeared first on…
-
Incidents Move Too Fast for Pen & Paper
Organizations may not be ready for completely autonomous communication processes, but there are places where automating information updates would alleviate pressure.
-
Agentic Data Security Firm Sentra Raises $150 Million
The company will invest in agentic data security capabilities and expand its go-to-market organization. The post Agentic Data Security Firm Sentra Raises $150 Million appeared first on SecurityWeek .
-
Cyberattack wipes cloud data at major Russian hosting provider Beget
A major Russian web hosting provider is struggling to restore its services after a cyberattack destroyed data across its cloud infrastructure and disrupted hundreds of websites.
-
French blood service hit by Europe-wide cyberattacks on refrigeration
Temperature controls were altered at three of France’s national blood service sites this week amid a wave of cyberattacks affecting refrigeration systems across Europe.
-
AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks
Hackers have been harvesting AI access tokens and have been using AI-assisted offensive tools to automate attacks. The post AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks appeared first on SecurityWeek…
-
Canadian Extradited to US Over Cryptomining Hacks on University Supercomputers
A federal grand jury indicted two Canadian men for hijacking university supercomputers to secretly mine Electroneum cryptocurrency. The post Canadian Extradited to US Over Cryptomining Hacks on University Supercomputers appeared…
-
Chrome 157 fixes 213 security issues, including 7 critical flaws
Your browser may not have updated itself yet. Here’s how to check your version and install the fix manually.
-
Cyberattack on French plasma stores is enough to make your blood boil
Attackers reportedly set cold-room controls to 110°C, but safeguards prevented stock losses
-
Malicious cPGuard Updates Served in OpsShield Supply Chain Attack
Using compromised credentials, the attackers accessed OpsShield’s update servers and poisoned multiple cPGuard versions. The post Malicious cPGuard Updates Served in OpsShield Supply Chain Attack appeared first on SecurityWeek .
-
Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical
The browser update resolves dozens of memory safety bugs and incorrect/missing authorization issues. The post Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical appeared first on SecurityWeek .
-
Rigged Coding Assignment, Abused AI Tool Opened Path to $6 Billion Binance Heist
Binance’s first incident report traces the record theft to a months-long campaign that compromised three engineers’ computers. The post Rigged Coding Assignment, Abused AI Tool Opened Path to $6 Billion Binance Heist appeared…
-
North Korea Launches Missiles Toward the Sea as Pyongyang Protests Against US Claims on Binance Hack
In recent months, North Korea has accelerated its weapons tests in a likely bid to increase its leverage in potential diplomacy with the US. The post North Korea Launches Missiles Toward the Sea as Pyongyang Protests Against US…
-
Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million
A $300,000 award went to a pre-launch flaw that exposed conversations and tokens on internal Muse test VMs used by Meta staff. The post Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million appeared first on…
-
Philippine Migrant Worker Data Likely Leaked in 69GB Government Breach
An unknown operator appears to have exfiltrated SQL Server backups from the Philippine Overseas Employment Administration in under a half hour.
-
French blood storage units targeted in cyberattack
OMM reports: Cold-storage facilities used by France’s national blood service were targeted in a cyberattack, with units containing blood samples reportedly programmed to reach 110 degrees Celsius (230 degrees Fahrenheit), French…
-
Phishing-Resistant Isn't Enough; Yubico Takes Aim at Identity-Verification Gap
The new YubiID service bridges identity verification with credential enrollment and recovery across existing identity platforms, closing a phishing-resistant authentication gap. Plus: post-quantum YubiKey beta.
-
Risky Bulletin: Hackers brick Chinese EVs in Russia
Hackers brick Chinese EVs in Russia, a second wave of hacks defrost European supermarket freezers, the US boots Acronis from government networks and the major distros patch a Linux kernel RCE. Show notes Risky Bulletin: Hackers…
-
AU: Criminal investigation after NSW Health hit by cyber breach
Richard Wood reports: A major cyber breach has been declared at NSW Health, but officials say patient data has not been affected. A spokesperson for Cyber Security NSW says investigations are under way. “Cyber Security NSW is…
-
Fresh European Fridge Attacks Put Cold-Chain Security in Focus
Beyond food storage, the same combination of Internet connectivity, remote access, and inadequate security practices can put temperature-controlled infrastructure across other critical sectors at risk.
-
North Korean fake job interview led to $6.3B Binance heist
'It was not a single isolated breach or a simple phishing incident,' exchange says
-
Germany Busts 'Crime-as-a-Service' Investment Fraud Outfit
Authorities seized more than 100 servers and arrested seven as part of a crackdown on a fraud network spanning more than 50 countries.
-
Defense and aerospace firm settles with government over allegedly failing to meet cybersecurity contract requirements
ILC settled for $13 million, and its parent company said it resolved the issues before settling without an admission of liability. The post Defense and aerospace firm settles with government over allegedly failing to meet…
-
Ted Schlein’s Ballistic Ventures seeks $490M for new funds amid AI-driven cybersecurity boom
Cybersecurity-focused Ballistic Ventures is seeking to raise $360 million for a new flagship fund and another $130 million for a separate investment vehicle.
-
Ukraine and Russia both report fake emergency alerts after cyberattacks target apps as limited ceasefire ends
AP reports: Authorities in Ukraine and Russia said their emergency alert mobile apps had been targeted by cyberattacks, with users in Ukraine receiving false warnings of an imminent nuclear threat. It was not clear if the attacks…
-
Ukraine and Russia both report fake emergency alerts after cyberattacks target apps as limited ceasefire ends
AP reports: Authorities in Ukraine and Russia said their emergency alert mobile apps had been targeted by cyberattacks, with users in Ukraine receiving false warnings of an imminent nuclear threat. It was not clear if the attacks…
-
Nine health systems affected by AI company data breach
Giles Bruce reports: A data breach involving healthcare AI company Xsolis has ensnared at least nine health systems and 1.4 million patients. Xsolis, which provides utilization management and care coordination technology for…
-
Nine health systems affected by AI company data breach
Giles Bruce reports: A data breach involving healthcare AI company Xsolis has ensnared at least nine health systems and 1.4 million patients. Xsolis, which provides utilization management and care coordination technology for…
-
JPN: More companies seeking cyber insurance following high-profile data breaches
Maddie Baker reports: “Cybersecurity insurance normally covers compensation for costs arising from data breaches such as hacking, internally caused cyber leaks and, in some cases, IT security assessments to prevent similar data…
-
JPN: More companies seeking cyber insurance following high-profile data breaches
Maddie Baker reports: “Cybersecurity insurance normally covers compensation for costs arising from data breaches such as hacking, internally caused cyber leaks and, in some cases, IT security assessments to prevent similar data…
-
KR: Presidential office holds emergency meeting over leak of personal data of president, trip entourage
Park Boram reports: The presidential office held an emergency meeting Tuesday to address the leak of personal information of President Lee Jae Myung and members of an entourage that accompanied him on his overseas trip in June.…
-
KR: Presidential office holds emergency meeting over leak of personal data of president, trip entourage
Park Boram reports: The presidential office held an emergency meeting Tuesday to address the leak of personal information of President Lee Jae Myung and members of an entourage that accompanied him on his overseas trip in June.…
-
Syrian Man Sentenced for Wide-Ranging Hacking Conspiracy Conducted on Behalf of the Bashar Al Assad Regime
Ahmad Umar Agha (also known as Th3Pr0) had spent more than a decade as a fugitive for targeting of Western media entities, businesses, NGOs, and U.S. and allied government entities October 29 – Today a federal district court in…
-
Syrian Man Sentenced for Wide-Ranging Hacking Conspiracy Conducted on Behalf of the Bashar Al Assad Regime
Ahmad Umar Agha (also known as Th3Pr0) had spent more than a decade as a fugitive for targeting of Western media entities, businesses, NGOs, and U.S. and allied government entities October 29 – Today a federal district court in…
-
A Defense Contractor Gave Their Personal AI Agent Access to a Secure Pentagon System
Vittoria Elliott reports: Earlier this year, sources tell WIRED, a contractor caused a security incident at the Department of Defense by connecting a secure centralized system used by multiple intelligence agencies to their…
Reuse this view
Same filters as JSON: /api/items?category=news&window=7d&sort=newest&limit=100. RSS for this section: feed.xml.