Fri 30 Oct
LiveGet it free
ZOTPAPER

News without the noise

Security

Cybersecurity news: breaches, ransomware, actively exploited vulnerabilities and the attackers behind them, with what to patch.

552 articles · page 1 of 12

AllAIHardware & DevicesCryptoProgrammingSecurity
Viewgridlistcompact
Security

CISA confirms active exploitation of maximum-severity GitLab flaw

The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are actively exploiting a maximum-severity vulnerability in GitLab, tracked as CVE-2026-97229. The flaw, which was patched earlier this month, could allow unauthenticated remote attackers to run arbitrary code via a maliciously crafted regular expression in CI/CD configuration files. CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog and ordered federal agencies to secure their servers by Sunday.

Security

Researchers find 'Embrace' flaws in five AI developer tools; OpenAI, Microsoft bugs unpatched

Researchers at security firm Forever Security have discovered vulnerabilities in five popular AI developer tools that could let attackers execute code on host machines, steal files, or spoof website addresses. The flaws, which affect Cursor, GitHub Copilot, Anthropic's Claude Desktop, Microsoft's VS Code and OpenAI's Codex, stem from a common class of weakness the company calls 'Embrace', over-empowered embedded browsers. While Cursor and GitHub Copilot have been patched, flaws in VS Code and Codex remain unpatched, according to the researchers.

Security

Hackers exploit Cisco SD-WAN flaw to deploy 'KeyDrift' malware, researchers say

A hacking group was observed exploiting a patched Cisco vulnerability to deploy a custom malware framework called KeyDrift in attacks on space and satellite services, defense and aerospace technology, and policy research organizations, Cisco Talos researchers reported. The group, tracked as UAT-11473, appears to overlap with the Chinese state-sponsored Volt Typhoon's 'Silent Train' covert access network, though Talos made no definitive links.

Security

GCHQ cannot account for thousands of storage devices, watchdog finds

Britain's intelligence agency GCHQ cannot locate thousands of removable storage devices that may contain highly sensitive intercepted communications, according to a report from the Investigatory Powers Commissioner (IPCO) published Thursday. Brian Leveson, the Investigatory Powers Commissioner, said GCHQ "still cannot tell me what has happened to removable media that may hold sensitive data, years after I first raised it with them."

Security

Ransomware hits exposed Synology NAS, likely exploiting 18-month-old flaw

A Reddit user says files on their Synology DS918+ NAS were encrypted in a ransomware attack; analysis of logs and operating system files suggested the attack likely involved CVE-2024-10441, a remote code execution vulnerability revealed 18 months ago. The device had its web interface exposed to the internet and was roughly a year and a half out of date with security patches, according to a detailed write-up by user NakamuraHwang.

Security

Fake PS5 emulator repositories on GitHub spread password-stealing malware

Malicious repositories pretending to offer popular PS5 emulation tools have been found spreading malware reported to steal passwords, according to a report by NordVPN's Threat Intelligence research team. The malware's payload is believed to be an infostealer, a type of malware that can steal passwords and other sensitive data. The campaign targets users looking for AnyPS5 and Kyttyps5, two legitimate projects for running PlayStation 5 games on PC.

Security

US and European Authorities Seize Virtualine, a Bulletproof Hosting Service for Cybercrime

US law enforcement, alongside agencies in the Netherlands, Germany, and the United Kingdom, has seized the primary domain and server infrastructure of Virtualine, a bulletproof hosting service authorities say has been at the centre of a broad range of cybercrime operations since at least 2022. The FBI seized the service's main domain, while Dutch police seized dozens of physical servers in Limburg. The service is accused of facilitating ransomware, infostealers, drug trafficking, and hosting a forum for child sexual abuse material.

Security

DHS takedown push fails to stop spread of leaked employee data

The Trump administration's efforts to contain a leak of records for more than 41,000 Department of Homeland Security employees and contractors struggled on Thursday as a searchable directory was taken down, but the information moved to a different domain and the Icelandic company hosting it refused a takedown request. Social media platform Bluesky also blocked links to DDoSecrets, marking them as malicious.

· 14 sources
Security

Hotel booking scam hits Australians after RMS Cloud cyberattack

Australian travellers are being targeted in a sophisticated hotel booking scam after hackers accessed customer information held by accommodation software provider RMS Cloud. The company confirmed on Tuesday it was investigating phishing messages that use genuine reservation details to threaten cancellation unless payment is reconfirmed. The Australian Competition and Consumer Commission has received 62 reports in three days, with one victim losing more than $300.

· 2 sources
Security

Black October's AI-discovered PHP bugs prove hard to exploit, but experts warn of coming 'vulnpocalypse'

The cybersecurity world braced for catastrophe after AI uncovered critical flaws in PHP, the language behind roughly 70% of websites, but the anticipated wave of automated attacks has surprisingly struggled to get off the ground. Security researchers say the vulnerabilities have proven unusually difficult to exploit, drawing comparisons to the Y2K phenomenon where warnings of armageddon helped rally companies to engineer a solution in time. However, experts caution this is a temporary reprieve, with one warning that 'we don't have to wait another two years before this happens (again), it could be three hours from now.'

· 7 sources
Security

GMO urges customers to shut down PCs after hackers publish stolen data

Japanese internet giant GMO Internet has told customers of its Onamae Desktop Cloud service to disconnect their computers, shut them down and unplug all cables, after a threat actor who breached the service published stolen company and customer data and threatened to trigger a ransomware attack. GMO confirmed the publication in a report on Tuesday and said it was verifying whether the leaked information was genuine.

· 3 sources
Security

Attack on AfD email host exposes 345,000 accounts, party says AI used to analyse stolen data

A cyberattack on the email hosting provider of Germany's far-right Alternative for Germany (AfD) party exposed more than 345,000 unique email addresses and a large volume of confidential emails and attachments, Have I Been Pwned confirmed. The party disclosed the September attack on its own hosting provider, Alternita Dienstleistungs GmbH, last week and said it is 'deeply concerned', describing the incident as an illegal attack on democracy.

Security

Microsoft removes seven certificates from Windows trust list in eMudhra response, plans Edge update

Microsoft has released an out-of-band Windows update that removes seven certificates from the Windows trust list, including six eMudhra G3 root certificates and an AAA Certificate Services cross-sign, as part of its response to the compromise of eMudhra intermediate certificate authority private keys. The company plans to remove the same certificates from the Microsoft Edge trust list on October 27.

· 3 sources