News

The CVE system nearly dying shows that someone has lost the plot

Opinion  We almost lost the Common Vulnerabilities and Exposures (CVE) database system, but that's only the tip of the iceberg of what President Trump and company are doing to US cybersecurity efforts.…

Chrome will keep third-party cookies, a win for web giant's ad rivals

After six years of work, Google's Privacy Sandbox, technology for delivering ads while protecting privacy, looks like dust in the wind.…

As cyber-agency faces cuts, makes noises about switching up program

Two top officials have resigned from Uncle Sam's Cybersecurity and Infrastructure Security Agency, aka CISA, furthering fears of a brain drain amid White House cuts to the federal workforce.…

In effect: 'Ha ha – the government is borked and so are you'

Ransomware scumbags - potentially those behind the Fog gang - are channeling their inner Elon Musk with their latest ransom note, spotted by researchers at Trend Micro.…

Security bods can earn up to $10K per report

Ransomware threat hunters can now collect rewards of $10,000 for each piece of intel they file under a new bug bounty that aims to squash extortionists.…

Retailer tight-lipped on details as digital hiccup disrupts customer orders

UK high street mainstay Marks & Spencer told the London Stock Exchange this afternoon it has been managing a "cyber incident" for "the past few days."…

What used to be a serious issue mainly in Southeast Asia is now the world’s problem

Scam call centers are metastasizing worldwide "like a cancer," according to the United Nations, which warns the epidemic has reached a global inflection point as syndicates scale up and spread out.…

10 other certificates 'were mis-issued and have now been revoked'

Certificate issuer SSL.com’s domain validation system had an unfortunate bug that was exploited by miscreants to obtain, without authorization, digital certs for legit websites.…

Erlang? Er, man, no problem. ChatGPT, Claude to go from flaw disclosure to actual attack code in hours

The time from vulnerability disclosure to proof-of-concept (PoC) exploit code can now be as short as a few hours, thanks to generative AI models.…

It's now hitting govt, enterprise targets

On March 11 - Patch Tuesday - Microsoft rolled out its usual buffet of bug fixes. Just eight days later, miscreants had weaponized one of the vulnerabilities, using it against government and private sector targets in Poland and Romania.…

AI-spoofed Mark joins fellow billionaires as the voice of the street – here's how it was probably done

Video  Crosswalk buttons in various US cities were hijacked over the past week or so to – rather than robotically tell people it's safe to walk or wait – instead emit the AI-spoofed voices of Jeff Bezos, Elon Musk, and Mark Zuckerberg.…

Using LLMs to pick programs, people, contracts to cut is bad enough – but doing it with Musk's Grok? Yikes

A group of 48 House Democrats is concerned that Elon Musk's cost-trimmers at DOGE are being careless in their use of AI to help figure out where to slash, creating security risks and giving the oligarch's artificial intelligence lab an inside track to train its models on government info.…

Some in the infosec world definitely want to see Big Red crucified

CISA – the US government's Cybersecurity and Infrastructure Security Agency – has issued an alert for those who missed Oracle grudgingly admitting some customer data was stolen from the database giant's public cloud infrastructure.…

MITRE, EUVD, GCVE … WTF?

Comment  The splintering of the global system for identifying and tracking security bugs in technology products has begun.…

Illegitimi non carborundum? Nice password, Mr Ex-CISA

Chris Krebs, the former head of the US Cybersecurity and Infrastructure Security Agency (CISA) and a longtime Trump target, has resigned from SentinelOne following a recent executive order that targeted him and revoked the security clearances of everybody at the company.…

Truck-mounted demonstration weapon costs 10p a pop, says MOD

British soldiers have successfully taken down drones with a radio-wave weapon.…

Ignored infosec rules, exfiltrated data … then the mysterious login attempts from a Russian IP address began – claim

Democratic lawmakers are calling for an investigation after a tech staffer at the US National Labor Relations Board (NLRB) blew the whistle on the cost-trimming DOGE's activities at the employment watchdog – which the staffer claims included being granted superuser status in contravention of standard operating procedures, exfiltrating data, and seemingly leaking credentials to someone with a Russian IP address.…

Microsoft rewards those who patch early with bricks hurled through its operating system

Keeping with its rich history of updates that break Windows in unexpected ways, Microsoft has warned that two recent patches for Windows 11 24H2 are triggering blue screen crashes.…

Extraordinary rendition of data, or just dropped it out of a helicopter?

CIA Director John Ratcliffe's smartphone has almost no trace left of the infamous Signalgate chat – the one in which he and other top US national security officials discussed a secret upcoming military operation in a group Signal conversation a journalist was inadvertently added to.…

From noise to clarity: Why CISOs are shifting to adversarial exposure validation

Partner content  A vast majority of security teams are overwhelmed by the large number of security alerts and vulnerabilities.…