August 2025
268 posts. Browse all months
- TransUnion data breach may have affected 4.4 million users - here’s what we know, and how to stay safe | TechRadar
TransUnion reported a data breach affecting 4.4 million Americans after hackers infiltrated the company’s Salesforce account on July 28, 2025, with the …
- Google issues another warning for Gmail users to secure their accounts | Mashable
Google urges Gmail users to change their passwords and enable two-factor authentication due to increased phishing activity and data breaches. Users should be …
- FBI cyber cop: Salt Typhoon pwned ‘nearly every American’ • The Register
The Salt Typhoon cyber espionage campaign, backed by China, has compromised telecommunications networks and collected information from nearly every American …
- Amazon blocks APT29 campaign targeting Microsoft device code authentication
Amazon disrupted a watering hole campaign by APT29, a Russia-linked cyber espionage group, that targeted Microsoft device code authentication. The campaign …
- WhatsApp Issues Emergency Update for Zero-Click Exploit Targeting iOS and macOS Devices
WhatsApp addressed a security vulnerability (CVE-2025-55177) in its iOS and macOS apps, potentially exploited in conjunction with an Apple flaw …
- Pentagon Probes Microsoft’s Use of Chinese Coders
The Pentagon is reviewing Microsoft’s use of Chinese nationals to write code for military cloud infrastructure. The program, which involved inexperienced U.S. …
- CISA AA25-239A: Global Advisory on Chinese State-Sponsored Threat Campaigns
The CISA Cybersecurity Advisory AA25-239A, co-authored by leading cybersecurity agencies from the United States, Canada, United Kingdom, Australia, New Zealand, …
- Interlock Ransomware: The 2025 Cyber Threat Redefining Ransomware Tactics
The Interlock ransomware group has emerged as a significant cybersecurity threat in 2025, employing sophisticated social engineering tactics that distinguish it …
- AI’s Energy Challenge: Efficiency Gains vs. Rising Demand
AI has achieved remarkable efficiency gains, with energy use per query dropping more than thirtyfold in the past year, yet overall demand is still set to surge …
- Google’s AI hurricane model impresses in first real-time test with Hurricane Erin - CBS Miami
Hurricane Erin’s rapid escalation to a Category 5 storm provided an early test for Google DeepMind’s new artificial intelligence forecasting model, which …
- Google’s NotebookLM updates Audio and Video Overviews
Google’s NotebookLM is expanding Video Overviews to 80 languages while upgrading Audio Overviews in all supported languages to match the comprehensive depth …
- Hackers steal data from Salesforce instances in widespread campaign | Cybersecurity Dive
Google researchers have linked a large-scale credential theft campaign to hackers exploiting compromised OAuth tokens from Salesloft’s Drift AI chat agent, …
- TransUnion data breach hits 4.4 million consumers
TransUnion reported a data breach affecting over 4.4 million consumers, caused by hackers accessing a third-party application. While the specific information …
- Sensitive medical marijuana patient data exposed in major breach
Ohio Marijuana Card, a company processing medical marijuana recommendations, exposed nearly 1 million records containing sensitive patient information, …
- Incident response planning linked to fewer cyber insurance claims: Marsh | Insurance Business America
New research from Marsh McLennan highlights that organizations regularly testing their cyber incident response plans are significantly less likely to file …
- AI is making dark web monitoring crucial, says BOXX Insurance cyber chief | Insurance Business Canada
Dark web monitoring has shifted from optional to essential for organizations in 2025, according to Neal Jardine, BOXX Insurance’s chief cyber intelligence and …
- Google previews cyber ‘disruption unit’ as U.S. government, industry weigh going heavier on offense | CyberScoop
Google announced a new cyber “disruption unit” focused on proactive, intelligence-led actions to disrupt cyber campaigns. This development comes amid …
- OpenAI Says It’s Scanning Users' ChatGPT Conversations and Reporting Content to the Police
OpenAI has quietly implemented monitoring systems that scan ChatGPT conversations for harmful content, escalating concerning messages to human reviewers and …
- NSA, NCSC, and allies detailed TTPs associated with Chinese APT actors targeting critical infrastructure Orgs
The NSA, NCSC, and allies warn that Chinese APT actors, including Salt Typhoon, are targeting global telecom, government, transport, lodging, and military …
- The Role of Enterprise Email Security in Modern Cybersecurity Strategies
Email remains a primary entry point for cyberattacks, despite advancements in cybersecurity. Modern strategies employ multi-layered defenses, including …
- Claude AI chatbot abused to launch “cybercrime spree” | Malwarebytes
Anthropic, the company behind the Claude AI chatbot, uncovered a large-scale extortion operation where cybercriminals abused Claude to automate and orchestrate …
- New zero-day startup offers $20 million for tools that can hack any smartphone | TechCrunch
Advanced Security Solutions, a new UAE-based startup, is offering up to $20 million for hacking tools that can break into any smartphone. The company, which …
- China linked Silk Typhoon targeted diplomats by hijacking web traffic
The China-linked APT group Silk Typhoon targeted diplomats by hijacking web traffic to deliver malware disguised as an Adobe Plugin update. The attackers used …
- ESET warns of PromptLock, the first AI-driven ransomware
ESET discovered PromptLock, the first AI-driven ransomware, using OpenAI’s gpt-oss:20b model to generate and execute malicious Lua scripts. The ransomware, …
- Blind Eagle’s Five Clusters Target Colombia Using RATs, Phishing Lures, and Dynamic DNS Infra
Cybersecurity researchers discovered five activity clusters linked to the threat actor Blind Eagle, targeting Colombian government entities and other sectors …
- Vulnerability landscape analysis for Q2 2025 | Securelist
Vulnerability registrations in Q2 2025 were dynamic, impacting various computer subsystems. Threat actors continue to exploit vulnerabilities in real-world …
- krebsonsecurity.com/2025/08/d…
The cybersecurity community on Reddit responded in disbelief this month when a self-described Air National Guard member with top secret security clearance …
- Tech jobs in Canada: Market has gone from boom to bust, Indeed
A new study from Indeed shows that Canada’s tech job market has declined, with August openings down 19% from early 2020 levels. The decline is attributed to a …
- Docker Desktop Vulnerability Leads to Host Compromise - SecurityWeek
A critical vulnerability (CVE-2025-9074) in Docker Desktop allows attackers to gain administrative privileges on Windows and macOS hosts. The flaw, impacting …
- Study Reveals TikTok, Alibaba, Temu Collect Extensive User Data in US
A study by Incogni reveals that popular foreign apps, particularly those owned by Chinese companies, are aggressively collecting and sharing user data in the …
- MixShell Malware Delivered via Contact Forms Targets U.S. Supply Chain Manufacturers
A sophisticated social engineering campaign, codenamed ZipLine, is targeting U.S. supply chain manufacturers with in-memory malware called MixShell. The …
- Nevada State Offices Halts Services After Cyber Incident
A network security incident disrupted Nevada state offices, suspending some in-person services and affecting access to websites, online portals, and phone …
- Farmers Insurance, Aflac Report Data Breaches to Regulators
Farmers Insurance and Aflac Inc. reported data breaches to regulators following cyberattacks. Farmers’ breach, affecting over 1.1 million people, involved a …
- Social media apps may know your exact location
A Surfshark study reveals that all top 10 social media apps collect location data, with X being the most invasive by gathering both precise and coarse location …
- 90K exposed after sleep therapy provider data breach | Cybernews
CPAP Medical Supplies and Services, a sleep therapy gear provider focused on US military personnel, suffered a cyberattack between December 13-21, 2024, that …
- Uzbekistan airline hack reveals data on U.S. government employees
A hacker claiming to be “ByteToBreach” allegedly breached Uzbekistan Airways, stealing 300 gigabytes of data including 500,000 passenger email addresses, 2,626 …
- Hackers claim millions of PayPal accounts leaked while experts say the data looks suspiciously cheap and possibly stolen from old infostealer logs | TechRadar
Cybercriminals claim to be selling 15.8 million stolen PayPal credentials on dark web forums, allegedly including login emails, plaintext passwords, and URLs …
- Engineered to Fail: The DNA of Negligent Cyber Defenses | by Deep Specter Research | Aug, 2025 | Medium
Deep Specter Research has uncovered evidence of multiple sophisticated cyberattacks against 23andMe leading up to its 2023 data breach, including …
- Zuckerberg freezes AI hiring amid bubble fears
The article describes Mark Zuckerberg’s decision to freeze AI hiring at Meta amid concerns about the profitability of AI investments. The freeze comes after a …
- 5 Simple Labels to Supercharge Your AI Prompts
Artificial intelligence can be dazzling one moment and faltering the next. The difference often lies not in the technology but in how you ask for help. The good …
- Rural Health System in Michigan Notifying 140,000 of Hack
Aspire Rural Health System in Michigan is notifying 138,386 individuals that their personal information was potentially compromised in a data theft incident …
- Coinbase CEO Fired Employees Who Didn’t Adopt AI After Being Told to - Business Insider
Coinbase CEO Brian Armstrong mandated AI adoption for engineers, setting a one-week deadline for onboarding. Those who failed to comply faced consequences, …
- China’s Great Firewall blocked all traffic to a common HTTPS port for over an hour, severing connection to the outside world — with no hint as to its intention | Tom’s Hardware
China’s Great Firewall blocked all traffic to HTTPS port 443 for 74 minutes on August 20th, disrupting all connections. The incident, which targeted only port …
- A Huge Number of Grok AI Chats Just Leaked, and Their Contents Are So Disturbing That We’re Sweating Profusely
Over 370,000 conversations with Elon Musk’s Grok chatbot were inadvertently made public after users clicked a “share” button that allowed the chats to be …
- OpenAI CEO Sam Altman Concedes GPT-5 Was a Misfire, Bets on GPT-6 - Decrypt
OpenAI CEO Sam Altman acknowledged the company “totally screwed up” GPT-5’s rollout after widespread user backlash over replacing ChatGPT’s beloved “4o” model, …
- Nearly 1M SSNs and Health Records Exposed in Marijuana Patient Database
Ohio Medical Alliance exposed a medical marijuana patient database containing nearly one million records, including SSNs, IDs, health files, and sensitive …
- Microsoft restricts Chinese firms’ access to vulnerability warnings after hacking concerns | CSO Online
Microsoft has restricted certain Chinese firms from its cybersecurity vulnerability early warning program following concerns about potential misuse of …
- AWS Trusted Advisor flaw allowed public S3 buckets to go unflagged - Help Net Security
Researchers at Fog Security uncovered a flaw in AWS Trusted Advisor that allowed publicly exposed S3 buckets to go unflagged if certain deny policies were …
- Orange Belgium Data Breach Impacts 850,000 Customers - SecurityWeek
Orange Belgium has disclosed that a July cyberattack exposed data from 850,000 customer accounts, including names, phone numbers, SIM numbers, PUK codes, and …
- Orange Belgium Data Breach Impacts 850,000 Customers - SecurityWeek
Orange Belgium has disclosed that a July cyberattack exposed data from 850,000 customer accounts, including names, phone numbers, SIM numbers, PUK codes, and …
- Apple Patches Zero-Day Exploited in Targeted Attacks - SecurityWeek
Apple released security updates for iOS, iPadOS, and macOS to address a zero-day vulnerability exploited in targeted attacks. The vulnerability, …
- Russian Espionage Group Exploits Old Cisco Flaw To Target Critical Infrastructure
A Russian cyber espionage group, Static Tundra, linked to the FSB, has been exploiting a seven-year-old Cisco vulnerability (CVE-2018-0171) to target critical …
- Using lightweight LLMs to cut incident response times and reduce hallucinations - Help Net Security
Researchers from the University of Melbourne and Imperial College London have introduced a novel approach to incident response planning using LLMs, designed to …
- Europol Says Qilin Ransomware Reward Fake - SecurityWeek
Europol denies offering a $50,000 reward for information on two members of the Qilin ransomware group, stating the message is a scam. The Qilin group, active …
- Phishing in the Cloud: SendGrid Campaign Exploits Account Security
A new phishing campaign exploits SendGrid’s reputation to deliver emails with spoofed sender addresses and malicious links. The emails, themed around …
- From Impact to Action: Turning BIA Insights Into Resilient Recovery - The Cyber Post
A business impact analysis (BIA) is crucial for identifying critical business functions and their dependencies on IT systems. IT leaders play a vital role in …
- SIM-Swapper, Scattered Spider Hacker Gets 10 Years – Krebs on Security
Noah Michael Urban, a 20-year-old Florida man, was sentenced to 10 years in federal prison for his involvement in the Scattered Spider cybercrime group. He …
- Microsoft Lays Out Its Quantum-Safe Plans
Microsoft aims to make all its products and services quantum-safe by 2033, two years ahead of the government deadline. The Quantum-Safe Program (QSP) involves …
- Fake Employees Pose Real Security Risks
The rise of AI-generated job candidates poses a significant security risk, particularly for IT positions with privileged access. North Korean hackers have …
- Russian cyberattack in the Netherlands leaves speed cameras offline indefinitely | TechSpot
A cyberattack on the Netherlands’ Public Prosecution Service by Russian and Chinese-linked hackers has left dozens of speed cameras permanently offline across …
- Travel eSIMs secretly route traffic over Chinese and undisclosed networks: study - iTnews
Security researchers from Northeastern University found that travel eSIM providers frequently route user traffic through foreign networks, particularly Chinese …
- Mozilla security advisory (AV25-529) - Canadian Centre for Cyber Security
Mozilla published security advisories on August 19, 2025, addressing vulnerabilities in Focus for iOS, Firefox for iOS, Firefox ESR, and Firefox. The Cyber …
- Asian Orgs Shift Cybersecurity Requirements to Suppliers
The increasing number of cyber breaches in Asia, particularly those linked to suppliers, has prompted companies like Kioxia Holdings and the Singaporean …
- Apache ActiveMQ Flaw Exploited to Deploy DripDropper Malware on Cloud Linux Systems - The Cyber Post
Threat actors are exploiting a nearly two-year-old vulnerability in Apache ActiveMQ to deploy malware called DripDropper on cloud Linux systems. The attackers …
- iOS security features you should use to protect your privacy - Help Net Security
The article describes several iOS security features that users can use to protect their privacy. These features include USB Accessories Lock, which allows …
- Intel Employee Data Exposed by Vulnerabilities - SecurityWeek
A security researcher discovered vulnerabilities in several Intel internal websites, allowing access to employee information including names, email addresses, …
- Google fixed Chrome flaw found by Big Sleep AI
Google Chrome 139 addressed a high-severity vulnerability in the V8 JavaScript engine, discovered by Big Sleep AI. The update patches the flaw, CVE-2025-9132, …
- North Korea Uses GitHub in Diplomat Cyber Attacks as IT Worker Scheme Hits 320+ Firms
North Korean threat actors, likely Kimsuky, conducted a cyber espionage campaign targeting diplomatic missions from March to July 2025. The campaign involved …
- Malaysia: Proposed new regulatory framework against Unsolicited Commercial Electronic Messages - Global Compliance News
Malaysia is proposing a regulatory framework for Unsolicited Commercial Electronic Messages (UCEM), commonly known as spam. The framework, based on a …
- United States: Internet across borders — What law governs? - Global Compliance News
This legal article explores how national laws apply to cross-border internet activities, noting that while countries generally limit enforcement to their …
- Exploit for critical SAP Netweaver flaws released (CVE-2025-31324, CVE-2025-42999) - Help Net Security
A working exploit for two critical SAP Netweaver vulnerabilities, CVE-2025-31324 and CVE-2025-42999, has been released. The exploit, which chains the two …
- Guess Who Would Be Stupid Enough To Rob The Same Vault Twice? Pre-Auth RCE Chains in Commvault
Two pre-authentication Remote Code Execution (RCE) chains were discovered in Commvault version 11.38.20. The first chain, applicable to any unpatched instance, …
- US Intel Chief Celebrates UK Retreat on Apple Backdoor Order
The U.S. Director of National Intelligence praised the U.K.’s apparent reversal of its demand for Apple to provide a backdoor to encrypted iCloud accounts. The …
- Why returning to the office is a pay cut for many people | Financial Post
The return-to-office mandates in Ontario, particularly in the banking sector, are facing resistance from employees who prefer flexible work arrangements. While …
- Grok Exposes Underlying Prompts for Its AI Personas: ‘EVEN PUTTING THINGS IN YOUR ASS’
The website for Elon Musk’s AI chatbot Grok is exposing the underlying prompts for its AI personas, including a conspiracy theorist, an unhinged comedian, and …
- Internet-wide Vulnerability Enables Giant DDoS Attacks
A new DDoS vulnerability, “MadeYouReset,” has been discovered in the HTTP/2 protocol, allowing attackers to overwhelm servers by exploiting a flaw in stream …
- Noodlophile infostealer is hiding behind fake copyright and PI infringement notices - Help Net Security
Attackers are using spear-phishing emails, disguised as copyright infringement notices, to deliver the Noodlophile infostealer. The emails, tailored to …
- Defending Against Cloud Threats Across Multicloud Environments
Companies struggle to establish and monitor security across multiple cloud environments, leaving them vulnerable to attacks. The use of multiple cloud …
- Top Israeli Cybersecurity Director Arrested in US Child Exploitation Sting
A top Israeli cybersecurity official, Tom Artiom Alexandrovich, was arrested in a Las Vegas child exploitation sting operation. Alexandrovich, along with seven …
- ERMAC 3.0 source code leak reveals expanding threat
Hunt.io researchers obtained the source code for ERMAC 3.0, an Android banking trojan targeting over 700 apps. The code reveals exploitable weaknesses and …
- Colt Technology faces multi-day outage after WarLock ransomware attack
Colt Technology Services, a multinational telecommunications company, suffered a cyberattack caused by WarLock ransomware, leading to multi-day outages for …
- Threat Actor Claims to Sell 15.8 Million Plain-Text PayPal Credentials
The article describes a threat actor’s claim to be selling 15.8 million plain-text PayPal credentials. The data is allegedly from infostealer malware logs, …
- Human resources firm Workday disclosed a data breach
Workday, a cloud-based software company, disclosed a data breach after attackers accessed a third-party CRM platform through social engineering. The …
- US Seizes $2.8 Million From Zeppelin Ransomware Operator - SecurityWeek
The US Department of Justice indicted Ianis Antropenko, a Zeppelin ransomware operator, and seized over $2.8 million in cryptocurrency. Antropenko allegedly …
- Wireless-Tap: Automatic Transcription of Phone Calls Using Millimeter-Wave Radar Sensing | 18th ACM Conference on Security and Privacy in Wireless and Mobile Networks
This paper presents WirelessTap, a system that demonstrates the potential for automated speech recognition (ASR) on phone call audio eavesdropped remotely …
- Discover a Smoother YouTube Experience with yout-ube.com
A Cleaner Way to Watch YouTube Videos Looking for a cleaner way to watch YouTube videos? Try yout-ube.com—a simple tool that lets you enjoy ad-free, full-screen …
- www.vice.com/en/articl…
Apple is reportedly developing real-time translation capabilities for AirPods that would be triggered by pressing both AirPod stems simultaneously, according …
- futurism.com/mckinsey-…
McKinsey is deploying 12,000 AI agents while its workforce shrunk from 45,000 to 40,000 employees, as the consulting firm confronts AI’s potential to automate …
- Russian Hackers Breach Norwegian Dam: Cyberattack Exposes Critical Infrastructure Risks
Norwegian intelligence has confirmed that Russian hackers took control of a hydropower dam in Bremanger this April, opening a floodgate and releasing 500 litres …
- House of Commons Breach Highlights Rising State-Sponsored Cyber Threats to Canada
The House of Commons is investigating a major cybersecurity breach after an unidentified threat actor exploited a recent Microsoft vulnerability to access …
- $70K Vanished: Questrade Case Exposes Investor Vulnerabilities in the Age of Sophisticated Cybercrime
When Toronto-based CPA Megan Tong lost $70,000 to hackers who infiltrated her Questrade investment account, she expected the brokerage’s online security …
- WestJet Breach Exposes Passport Data: A Growing Threat to Airlines and Insurers
WestJet has confirmed that a cyberattack earlier this year led to the theft of sensitive passenger data, including information from government-issued travel …
- Zoom patches critical Windows flaw allowing privilege escalation
Zoom has patched a critical Windows client vulnerability (CVE-2025-49457, CVSS 9.6) that could allow unauthenticated attackers to escalate privileges via …
- ‘MadeYouReset’ HTTP2 Vulnerability Enables Massive DDoS Attacks - SecurityWeek
Researchers from Imperva and Tel Aviv University have uncovered “MadeYouReset,” a new HTTP/2-based DDoS attack vector exploiting a design flaw tracked as …
- 46% of Enterprise Passwords Can Be Cracked | Security Magazine
Picus Security’s latest report highlights a sharp decline in enterprise cyber defence effectiveness, with cracked password hashes found in 46% of …
- For $40, you can buy stolen police and government email accounts - Help Net Security
Active police and government email accounts from the US, UK, Germany, India, and Brazil are being sold on dark web forums for as little as $40, giving …
- Feds Issue More HIPAA Guidance in Push for Patient Access
The Department of Health and Human Services’ Office for Civil Rights released new HIPAA Privacy Rule guidance supporting the Trump administration’s “Make …
- The Art of Iteration – How to Refine ChatGPT Responses for Better Results
Iteration is the secret to getting the best results from ChatGPT, turning a first draft into a polished, audience-ready answer. By refining your prompts and …
- OpenAI’s Prompt Optimizer
OpenAI’s Prompt Optimizer for GPT-5 transforms ordinary requests into clear, detailed, and highly effective prompts—helping you get better results, faster. It’s …
- APT groups are getting personal, and CISOs should be concerned - Help Net Security
APT groups are targeting executives’ personal lives, exploiting remote work and cloud storage. CISOs should focus on protecting executives without invading …
- 5 key takeaways from Black Hat USA 2025 | CSO Online
Black Hat and DEF CON conferences revealed several critical cybersecurity vulnerabilities that CISOs should address, with AI systems emerging as a major attack …
- SAP Patches Critical S/4HANA Vulnerability - SecurityWeek
SAP released 15 new security notes, including four critical fixes, addressing vulnerabilities in S/4HANA, NetWeaver, and other products. Two of the critical …
- Dutch Investigators Blame Multiple Threat Actors on Hacks
Dutch investigators believe multiple threat actors, possibly Russian, were involved in a May breach of the country’s law enforcement network using a Citrix …
- UWA hit by major data breach, students locked out of accounts | news.com.au — Australia’s leading news site for latest headlines
A data breach at the University of Western Australia compromised hundreds of passwords, leading to account lockouts for staff and students. The university is …
- BadCam: Linux-based Lenovo webcam bugs enable BadUSB attacks
Eclypsium researchers discovered vulnerabilities in Lenovo webcams, dubbed BadCam, that allow attackers to remotely hijack and weaponize them as BadUSB …
- AgentFlayer 0-click exploit abuses ChatGPT Connectors to Steal 3rd-party app data
Cybersecurity researchers at Zenity have discovered “AgentFlayer,” a critical zero-click vulnerability in ChatGPT Connectors that allows attackers to secretly …
- New Win-DDoS Flaws Let Attackers Turn Public Domain Controllers into DDoS Botnet via RPC, LDAP
A new attack technique, Win-DDoS, exploits vulnerabilities in Windows LDAP client code to turn public domain controllers into a DDoS botnet. The attack, which …
- Tea App Slammed With Ten Lawsuits After Data Breach Leaks Women’s Private Photos And Messages To 4chan, Triggering Outrage, Scandal, And Fierce Demands For Stronger Privacy Protections
The article describes a data breach on the Tea app that exposed women’s private photos and messages on 4chan. The breach led to ten class-action lawsuits …
- How to get your share of AT&T’s $177M data breach settlement - secure that $7,500 payout ASAP | ZDNET
AT&T customers affected by the 2019 and 2024 data breaches can file claims for a portion of the $177 million settlement. Claims can be filed online or by mail …
- CERT-EU - Critical Vulnerabilities in Microsoft SharePoint
Critical vulnerabilities in Microsoft SharePoint are being monitored. The query analyzes various events, including DnsEvents, IdentityQueryEvents, and …
- CERT-EU - CrushFTP zero-day exploited in the wild
Threat actors are exploiting a zero-day vulnerability in CrushFTP versions prior to v10.8.5 and v11.3.4_23, allowing administrative access via the web …
- CERT-EU - High Severity Vulnerability in Microsoft Exchange
high-severity vulnerability (CVE-2025-53786) in Microsoft Exchange hybrid environments allows attackers with administrative access to on-premises Exchange …
- CISA Adds Three Known Exploited Vulnerabilities to Catalog | CISA
CISA added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, all affecting D-Link devices. CISA strongly urges all organizations …
- CISA Releases Ten Industrial Control Systems Advisories | CISA
CISA Releases Ten Industrial Control Systems Advisories
- Trend Micro security advisory (AV25-487) - Canadian Centre for Cyber Security
Trend Micro published a security advisory on August 5, 2025, addressing vulnerabilities in Trend Micro Apex One (on-prem) Management Server versions 14039 and …
- Cisco security advisory (AV25-488) - Canadian Centre for Cyber Security
Cisco published security advisories on August 6, 2025, addressing vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity …
- Splunk security advisory (AV25-489) - Canadian Centre for Cyber Security
Splunk published security advisories on August 6, 2025, addressing vulnerabilities in Splunk AppDynamics On-Premises Enterprise Console and Splunk AppDynamics …
- Microsoft Exchange security advisory (AV25-490) - Canadian Centre for Cyber Security
Microsoft released a security update on August 6, 2025, to address a vulnerability in Exchange Server 2016, 2019, and Subscription Edition. The vulnerability …
- SSL VPN vulnerability impacting Gen 7 SonicWall Firewalls (CVE-2024-40766) – Update 1 - Canadian Centre for Cyber Security
A vulnerability in SonicWall SSL VPN, CVE-2024-40766, is being exploited to bypass MFA and deploy ransomware. Organizations are advised to update firmware to …
- Critical Zero-Days Crack Open CyberArk Password Vaults
Researchers discovered 14 zero-day vulnerabilities in HashiCorp Vault and CyberArk Conjur, popular password vaults used by thousands of companies. These …
- Luxembourg probes reported attack on Huawei tech that caused nationwide telecoms outage | The Record from Recorded Future News
Luxembourg is investigating a cyberattack on Huawei equipment that caused a nationwide telecommunications outage. The attack, which exploited a vulnerability …
- French Telecom Firm Bouygues Says Data Breach Affects 6.4M Customers - SecurityWeek
French telecom company Bouygues Telecom was recently targeted in a cyberattack that compromised the personal information of 6.4 million customers. The company …
- Columbia University Data Breach Impacts 860,000 - SecurityWeek
Columbia University experienced a cyberattack resulting in the theft of personal information from over 860,000 individuals, including students, applicants, and …
- Leaked Credentials Up 160%: What Attackers Are Doing With Them
Leaked credentials have surged by 160% in 2025, accounting for 22% of data breaches, according to Verizon’s 2025 Data Breach Investigations Report. Cyberint, …
- GreedyBear: 40 Fake Crypto Wallet Extensions Found on Firefox Marketplace
A cybercrime campaign called “GreedyBear” has stolen over $1 million from cryptocurrency users using a combination of malicious browser extensions, malware, …
- How Devin AI Can Leak Your Secrets via Multiple Means · Embrace The Red
Security researchers have detailed multiple methods for exfiltrating sensitive data from Devin, an AI-powered software development agent, through indirect …
- Adult sites trick users into Liking Facebook posts using a clickjack Trojan | Malwarebytes
As age-verification requirements for adult websites expand globally, cybercriminals are exploiting the shift by luring users to malware-laden sites, often …
- Privilege Escalation Issue in Amazon ECS Leads to IAM Hijacking
At Black Hat USA 2025, Sweet Security’s Naor Haziz unveiled “ECScape,” a technique exploiting an undocumented Amazon Elastic Container Service (ECS) protocol …
- Black Hat USA 2025 – Summary of Vendor Announcements (Part 1) - SecurityWeek
The article describes vendor announcements from the Black Hat USA 2025 conference. Some of the notable announcements include AirMDR launching a new AI-powered …
- Black Hat USA 2025 – Summary of Vendor Announcements (Part 2) - SecurityWeek
The article describes various vendor announcements made at the Black Hat USA 2025 conference. Some of the key announcements include 1Password’s study on AI …
- Black Hat USA 2025 – Summary of Vendor Announcements (Part 3) - SecurityWeek
At Black Hat USA 2025, various companies showcased their cybersecurity products and services. Highlights include 7AI’s platform enhancements and partnership …
- Microsoft urges admins to plug severe Exchange security hole (CVE-2025-53786) - Help Net Security
Microsoft has disclosed a vulnerability (CVE-2025-53786) in Exchange Server and Exchange Online hybrid deployments. This vulnerability allows attackers with …
- Venice Film Festival hacked, attendee data leaked online | TechRadar
The Venice Film Festival confirmed a data breach on July 7, 2025, affecting attendees’ personal information including names, email addresses, and phone …
- BigONE Hack: $27M Vanishes Without Key Leak -
BigONE, a Seychelles-based crypto exchange, suffered a $27 million security breach in July 2025. The attackers exploited internal systems, manipulating risk …
- Hacker Accesses Millions of IMDataCenter Records from Exposed AWS Bucket
A Florida-based data solutions provider, IMDataCenter, exposed a 38GB database containing sensitive personal information of 10,820 individuals. The data, which …
- Air France and KLM confirm customer data stolen in third-party breach | IT Pro
Air France and KLM confirmed a data breach affecting some customers, originating from a third-party supplier. The breach, detected last week, involved customer …
- OpenAI’s new GPT-5 models announced early by GitHub | The Verge
OpenAI’s new GPT-5 models, including gpt-5, gpt-5-mini, gpt-5-nano, and gpt-5-chat, were accidentally announced by GitHub. The models offer improvements in …
- Ukraine claims to have hacked secrets from Russia’s newest nuclear submarine
Ukraine’s Defense Intelligence agency claims to have hacked sensitive information from Russia’s newest nuclear submarine, the “Knyaz Pozharsky.” The leaked …
- Shared secret: EDR killer in the kill chain – Sophos News
Ransomware groups are increasingly using sophisticated tools to disable endpoint security solutions, enabling undetected operations. These tools, often …
- Trend Micro security advisory (AV25-487) - Canadian Centre for Cyber Security
Trend Micro published a security advisory on August 5, 2025, addressing vulnerabilities in Trend Micro Apex One (on-prem) Management Server versions 14039 and …
- Attackers Exploit Critical Trend Micro Apex One Zero-Day Flaw
Two critical zero-day vulnerabilities, CVE-2025-54948 and CVE-2025-54987, affect Trend Micro’s Apex One Management Console, allowing attackers to execute …
- WhatsApp cracks down on 6.8M scam accounts in global takedown
WhatsApp removed 6.8 million accounts linked to scam centers, primarily in Cambodia, in a joint effort with Meta and OpenAI. The scam centers, often fueled by …
- Google and Cisco Report CRM Software Breaches via Vishing
Google and Cisco recently suffered data breaches after attackers socially engineered their employees through voice phishing, or vishing. The breaches involved …
- 200,000 passwords, credit card data and more stolen by this dangerous new malware — how to stay safe | Tom’s Guide
Cybercriminals are using legitimate-looking software and documents to deploy a new info-stealing malware called PXA Stealer. The malware, written in Python, is …
- Leaked ChatGPT Conversations Show People Asking the Bot to Do Some Dirty Work
A design flaw in ChatGPT’s “Share” function accidentally made private conversations publicly accessible and searchable by search engines, exposing deeply …
- National Newswatch | ChatGPT-5 Could Be AI’s “iPhone Moment”: Are You…
An opinion piece speculates that a hypothetical ChatGPT-5 could represent a transformative shift from AI as a tool to AI as a partner, predicting three …
- Cyber Threat Intelligence Report – Aug. 5, 2025
Incident: SonicWall SSL VPN Zero-Day Exploited by Akira Ransomware Date of Incident (ET): Unknown Date of Disclosure/Publication (ET): Aug. 5, 2025 Summary: …
- Hacking group D4rk4rmy claimed the hack of Monte-Carlo Société des Bains de Mer
The cybercrime group D4rk4rmy claimed responsibility for hacking Monte-Carlo Société des Bains de Mer (SBM), Monaco’s premier luxury hospitality group. The …
- NVIDIA Triton Bugs Let Unauthenticated Attackers Execute Code and Hijack AI Servers
Three vulnerabilities in NVIDIA’s Triton Inference Server, CVE-2025-23319, CVE-2025-23320, and CVE-2025-23334, could allow unauthenticated attackers to execute …
- Northwest Radiologists data breach hits 350,000 in Washington
A data breach at Northwest Radiologists in January 2025 exposed the personal information of 350,000 Washington State residents. The breach, which occurred from …
- New JSCEAL Malware Targets Millions via Fake Crypto App Ads
A new cybercrime campaign, JSCEAL, targets cryptocurrency app users through fake ads, leading to malware installation and data theft. The campaign, active …
- Vietnamese Hackers Use PXA Stealer, Hit 4,000 IPs and Steal 200,000 Passwords Globally
Vietnamese hackers are using a Python-based information stealer called PXA Stealer to target over 4,000 IP addresses across 62 countries. The stolen data, …
- US Announces $100 Million for State, Local and Tribal Cybersecurity - SecurityWeek
CISA and FEMA announced over $100 million in cybersecurity grant funding for state, local, and tribal governments, consisting of $91.7 million through the …
- Cybersecurity M&A Roundup: 44 Deals Announced in July 2025 - SecurityWeek
Forty-four cybersecurity M&A deals were announced in July 2025, with the largest being Palo Alto Networks’ $25 billion acquisition of identity security company …
- SonicWall firewalls targeted in ransomware attacks, possibly via zero-day - Help Net Security
SonicWall firewalls are being targeted by Akira ransomware, possibly through a zero-day exploit. The attackers are gaining access through SonicWall SSL VPNs, …
- VIPRE’s Email ThreatTrends Report: Q2 2025 - VIPRE
VIPRE’s Q2 2025 Email Threat Landscape Report highlights a rise in personalized and regionally nuanced email threats, particularly targeting manufacturing, …
- Nation-state group CL-STA-0969 targeted Southeast Asian telecoms in 2024
Nation-state actor CL-STA-0969 targeted Southeast Asian telecoms from February to November 2024, exploiting vulnerabilities and using custom tools for covert …
- Inside Storm-2603: The Ransomware Operator Behind ToolShell’s Shadow
Check Point Research investigated the ransomware operator Storm-2603, linked to the ToolShell exploitation campaign. Storm-2603, active in Latin America and …
- CrowdStrike 2025 Threat Hunting Report: AI Becomes a Weapon and a Target
The CrowdStrike 2025 Threat Hunting Report highlights adversaries’ evolving use of AI, a rise in cloud-focused intrusions, and a “long game” approach to …
- New Linux backdoor Plague bypasses auth via malicious PAM module
A new Linux backdoor, Plague, disguised as a malicious PAM module, bypasses authentication and grants persistent SSH access. It uses advanced obfuscation, …
- Anthropic Filesystem MCP Server: Directory Access Bypass via Improper Path Validation · Embrace The Red
A vulnerability in Anthropic’s Filesystem MCP Server allowed AI access to files and directories beyond the intended scope due to improper path validation. The …
- Lionishackers Threat Actors Exfiltrating and Selling Corporate Databases on Dark Web
Lionishackers, a financially motivated threat actor, breaches database servers using automated SQL injection tools, exfiltrates sensitive data, and sells it on …
- CL-STA-0969 Installs Covert Malware in Telecom Networks During 10-Month Espionage Campaign
A state-sponsored threat actor, CL-STA-0969, targeted telecommunications organizations in Southeast Asia, deploying malware to enable remote control and …
- Critical OAuth2-Proxy Vulnerability (CVE-2025-54576) Lets Attackers Bypass Authentication - SOCRadar® Cyber Intelligence Inc.
A critical vulnerability (CVE-2025-54576) in OAuth2-Proxy allows attackers to bypass authentication by manipulating query parameters in protected URLs. The …
- What Singapore’s First Public Cyber Attribution Tells Us | Royal United Services Institute
Singapore’s Coordinating Minister for National Security publicly attributed cyberattacks on the country’s critical infrastructure to Chinese-linked APT group …
- The State of Ransomware Q2 2025: Decline of Major Groups, Rise of Data-Driven Extortion
The global ransomware ecosystem shifted dramatically in Q2 2025, with the disappearance of several prominent ransomware-as-a-service (RaaS) groups including …
- China Accuses Nvidia of Backdoor in H20 AI Chip Amid Renewed US Export Tensions
China’s Cyberspace Administration has accused Nvidia of embedding a backdoor in its H20 chip, a model designed specifically for the Chinese market under US …
- Google Project Zero Launches 2025 Reporting Transparency Policy to Tackle the Patch Gap
Google Project Zero has announced its 2025 Reporting Transparency policy, aiming to reduce the “upstream patch gap” — the critical delay between when a vendor …
- The Hidden Backbone of the Internet: Why IXPs Must Be Protected as Critical Infrastructure
Internet Exchange Points (IXPs) are the invisible hubs that allow global networks to exchange traffic efficiently, reducing costs, lowering latency, and …