The Register

For the third time in a decade

Streaming platform Plex is warning some users to reset their passwords after suffering yet another breach.…

Ivalo XE handset targets governments and security critical sectors, though Qualcomm silicon keeps it tied to the US

Finnish phone maker HMD Global is launching a business unit called HMD Secure to target governments and other security-critical customers, and has its first device ready to go.…

AI security reviews add new risks, say researchers

App security outfit Checkmarx says automated reviews in Anthropic's Claude Code can catch some bugs but miss others – and sometimes create new risks by executing code while testing it.…

Charities welcome change, but critics warn the law is already too broad

Tech companies will be legally required to prevent content involving self-harm from appearing on their platforms – rather than responding and removing it – in a planned amendment to the UK's controversial Online Safety Act.…

Including messages sent to users, a potential problem for the privacy-conscious

Encrypted messaging app Signal is rolling out a free storage system for its users, with extra space if folks are willing to pay for it.…

Meta shrugs off allegations of improper dismissal, ignoring privacy and security

WhatsApp's former head of security, Attaullah Baig, has filed a lawsuit against its parent company, Meta, alleging that the social media megalith retaliated against him for reporting security failings that violated legal commitments.…

Auditors find federal cybersecurity workforce data messy, incomplete, and unreliable

The US federal government employs tens of thousands of cybersecurity professionals at a cost of billions per year – or at least it thinks it does, as auditors have found the figures are incomplete and unreliable. …

Meanwhile the victim count grows

The Salesloft Drift breach that compromised "hundreds" of companies including Google, Palo Alto Networks, and Cloudflare, all started with miscreants gaining access to the Salesloft GitHub account in March.…

Popular npm packages debug, chalk, and others hijacked in massive supply chain attack

Crims have added backdoors to at least 18 npm packages after developer Josh Junon inadvertently authorized a reset of the two-factor authentication protecting his npm account.…

Plus ties to the Chinese spies who hacked Barracuda email gateways

Security researchers have uncovered dozens of domains used by Chinese espionage crew Salt Typhoon to gain stealthy, long-term access to victim organizations going back as far as 2020.…

Busy lawyers on hold for five hours as staff handhold users into deploying the security measure

US courts have warned of delays as PACER, the system for accessing court documents, struggles to support users enrolling in its mandatory MFA program.…

Plus: Google clears up Gmail concerns, NSA drops SBOM bomb, Texas sues PowerSchool, and more

Infosec in brief  The US Cybersecurity and Infrastructure Security Agency (CISA) has said two flaws in routers made by Chinese networking biz TP-Link are under active attack and need to be fixed – but there's another flaw being exploited as well.…

Fallout from latest political drama sparks a changing of the guard

UK prime minister Sir Keir Starmer cleared out the officials in charge of tech and digital law in a dramatic cabinet reshuffle at the weekend.…

tldr; boffins did it

interview  It all started as an idea for a research paper. …

Pro tip, don't install PowerShell commands without approval

A team of data thieves has doubled down by developing its CastleRAT malware in both Python and C variants. Both versions spread by tricking users into pasting malicious commands through a technique called ClickFix, which uses fake fixes and login prompts.…

9.9-rated flaw on the loose, so patch now

A critical code-injection bug in SAP S/4HANA that allows low-privileged attackers to take over your SAP system is being actively exploited, according to security researchers.…

Affinity Learning Partnership warns staff after Intradev breach

A major UK education trust has warned staff that their personal information may have been compromised following a cyberattack on software developer Intradev in August.…

You cut and pasted the machine key from the official documentation? Ouch

Unknown miscreants are exploiting a configuration vulnerability in multiple Sitecore products to achieve remote code execution via a publicly exposed key and deploy snooping malware on infected machines.…

AI agent system said to have found more than 100 zero-day flaws in production apps

AI models get slammed for producing sloppy bug reports and burdening open source maintainers with hallucinated issues, but they also have the potential to transform application security through automation.…

Defrauding search with custom malware, Potato-family exploits

A new China-aligned cybercrime crew named GhostRedirector has compromised at least 65 Windows servers worldwide - spotted in a June internet scan - using previously undocumented malware to juice gambling sites' rankings in Google search, according to ESET researchers.…