Brit mathematician lets AI agent loose with credit card – cue password leaks, CAPTCHA chaos and more
Professor Fry's AI experiment shows light and dark sides of agentic tech
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
ShinyHunters claims dump puts 119K Vimeo emails in the wild
Vimeo points finger at analytics supplier Anodot, says no logins or card data were touched More than 119,000 Vimeo users's email addresses were extracted in a breach traced to a th…
Brit mathematician lets AI agent loose with credit card – cue password leaks, CAPTCHA chaos and more
Professor Fry's AI experiment shows light and dark sides of agentic tech British mathematician Professor Hannah Fry has shared a cautionary experiment involving an AI agent, a set …
Critical Remote Code Execution Vulnerability Patched in Android
CVE-2026-0073 affects Android’s System component and it can be exploited without any user interaction. The post Critical Remote Code Execution Vulnerability Patched in Android app…
The Back Door Attackers Know About — and Most Security Teams Still Haven’t Closed
Every AI tool, workflow automation, and productivity app your employees connected to Google or Microsoft this year left something behind: a persistent OAuth token with no expiratio…
How the Story of a USB Penetration Test Went Viral
Two decades ago Dark Reading posted its first blockbuster — a story from a pen tester who sprinkled rigged thumb drives around a credit union parking lot and let curious employees …
How the Story of a USB Penetration Test Went Viral
Two decades ago, pen tester Steve Stasiukonis caused a sensation by sprinkling rigged thumb drives around a credit union parking lot and following what curious employees did next. …
MetInfo CMS CVE-2026-29014 Exploited for Remote Code Execution Attacks
Threat actors are actively exploiting a critical security flaw impacting an open-source content management system (CMS) known as MetInfo, according to new findings from VulnCheck. …
Romance scammers turn sweet talk into £102M payday
Victims losing £280K a day to fake profiles and sob stories Romance fraudsters scammed Britons out of £102 million ($138 million) last year, according to the latest police figures.…
Romance scammers turn sweet talk into £102M payday
Victims losing £280K a day to fake profiles and sob stories
Vodafone dials up full control of joint venture with Three in £4.3B deal
CK Hutchison takes early cash as UK mobile tie-up moves ahead of schedule Vodafone has struck a deal to take full ownership of VodafoneThree, the mobile network formed from last ye…
Vodafone dials up full control of joint venture with Three in £4.3B deal
CK Hutchison takes early cash as UK mobile tie-up moves ahead of schedule
Google now offers up to $1.5 million for some Android exploits
Google overhauls its Android and Chrome vulnerability rewards programs, offering bounties of up to $1.5 million for the most difficult exploits while scaling back payouts for flaws…
Critical, High-Severity Vulnerabilities Patched in Apache MINA, HTTP Server
The most severe of these security defects could allow remote attackers to execute arbitrary code. The post Critical, High-Severity Vulnerabilities Patched in Apache MINA, HTTP Serv…
Karakurt Ransomware Negotiator Sentenced to Prison
Deniss Zolotarjovs was directly involved in extortion strategies and in negotiations with victim companies. The post Karakurt Ransomware Negotiator Sentenced to Prison appeared fir…
DarkSword Malware
DarkSword is a sophisticated piece of malware—probably government designed—that targets iOS. Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit tha…
We Scanned 1 Million Exposed AI Services. Here's How Bad the Security Actually Is
While the software industry has made genuine strides over the past few decades to deliver products securely, the furious pace of AI adoption is putting that progress at risk. Busin…
Karakurt extortion gang ‘cold case’ negotiator gets 8.5 years in prison
A Latvian national extradited to the United States was sentenced to 8.5 years in prison for his "cold case" negotiator role in the Russian Karakurt ransomware group. [...]
CloudZ malware abuses Microsoft Phone Link to steal SMS and OTPs
A new version of the CloudZ remote access tool (RAT) is deploying a previously unseen malicious plugin called Pheno that hijacks the Microsoft Phone Link connection to steal sensit…
Unexpected item in Windows' bagging area
Activating Windows will cost more than a couple of cheap carrier bags Bork!Bork!Bork! Things must be tough for UK grocery retailer Sainsbury's, judging by the state of Windows Acti…
Unexpected item in Windows' bagging area
Activating Windows will cost more than a couple of cheap carrier bags
MetInfo, Weaver E-cology Vulnerabilities in Attackers’ Crosshairs
The security defects allow unauthenticated, remote attackers to execute arbitrary code through crafted requests. The post MetInfo, Weaver E-cology Vulnerabilities in Attackers’ Cro…
NHS to close-source hundreds of GitHub repos over AI, security concerns
Healthcare giant's maintainers handed May deadline to enact the change The UK's National Health Service (NHS) is ordering all of its technology leaders to temporarily wall off the …
NHS to close-source hundreds of GitHub repos over AI, security concerns
Healthcare giant's maintainers handed May deadline to enact the change
ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows
The North Korea-aligned state-sponsored hacking group known as ScarCruft has compromised a video game platform in a supply chain espionage attack, trojanizing its components with a…
ScarCruft hackers push BirdCall Android malware via game platform
The North Korean hacker group APT37 has been delivering an Android version of a backdoor called BirdCall in a supply-chain attack through a video game platform. [...]
WhatsApp Discloses File Spoofing, Arbitrary URL Scheme Vulnerabilities
The vulnerabilities were reported to Meta through its bug bounty program and were patched with updates released earlier this year. The post WhatsApp Discloses File Spoofing, Arbitr…
Microsoft's bad obsession is showing up in shabby services and slipshod software. Here's proof
If you can't bother to keep GitHub running, why should we bother with you?
Microsoft's bad obsession is showing up in shabby services and slipshod software. Here's proof
If you can't bother to keep GitHub running, why should we bother with you? Opinion It's been another shabby week for Microsoft, and a shabbier one for its users. We learnt that Win…
Weaver E-cology RCE Flaw CVE-2026-22679 Actively Exploited via Debug API
A critical security vulnerability in Weaver (Fanwei) E-cology, an enterprise office automation (OA) and collaboration platform, has come under active exploitation in the wild. The …