More than 100 water systems were hit in July cyberattacks
'These are test runs for a larger-scale attack'
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
New GPUThor attack defeats NVIDIA ECC protection for root access
A newly disclosed Rowhammer attack called GPUThor can bypass error-correcting code (ECC) protections on NVIDIA GPUs, enabling denial-of-service (DoS) and root-level privilege escal…
GitHub Actions was down yet again
Another outage puts last week's promises to an early test
Android Malware Hijacks Update System for Car Head Units
Threat actors behind a notorious click-fraud botnet have set their sights on vehicle infotainment modules and are abusing legitimate functionality to spread infections.
D2DO311: Code Review Is Dead – Long Live Peer Review
Traditional peer review processes are breaking down in the new AI era. Dylan Ratcliffe, founder and CEO of Overmind Technology, joins Ned and Kyler to discuss the importance of tre…
MNT follows up its open hardware portables with a desktop case
Upgrade the portable, give its old mainboard another job
FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations
The U.S. Department of Justice (DoJ) on Wednesday announced the disruption of two hacking platforms named QScan and QTRouter operated by Chinese threat actors to target critical in…
Meta agrees to $18 billion settlement over teen social media harms
Meta has reached a proposed settlement worth up to approximately $18 billion with a bipartisan coalition of 52 attorneys generals over allegations that Facebook and Instagram were …
Meta's proposed $18B settlement in teen harm case throws YouTube and TikTok under the bus, too
Zuckercorp ties $5.3B of its payout to rivals playing along
Memory crunch: Cloud operators may be pushed to splurge 68% of capex on DRAM and NAND
Rising costs of new kit due to soaring memory prices likely to feed into cloud service bills
Boston Scientific discloses 'global disruption' in ongoing cyberattack
No timeline to restore IT systems as probe remains ongoing
Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler
Cybersecurity researchers have discovered additional infrastructure and previously undocumented malware associated with Nimbus Manticore, an Iranian state-sponsored hacking group a…
AI Speeds Up Malware Development, Not Its Success Rate: Analysis
Palo Alto Networks Unit 42 analyzed 405 AI-linked malware samples and found only 12 reached production endpoints. The post AI Speeds Up Malware Development, Not Its Success Rate: A…
Boston Scientific says cyberattack disrupted operations globally
Medical technology company Boston Scientific has been targeted in a cyberattack that disrupted some of its IT systems, causing operational disruptions globally. [...]
Carhartt data breach affects 12.9M, half of what ShinyHunters claimed
One AI and two trained eyes delved into the heavily padded leaks
CIOs are on notice – vSphere 8 times out in October 2027
SPONSORED FEATURE: How do you plan for AI and virtualization when the clock is ticking this loudly?
Hackers target Microsoft SharePoint RCE chain with PoC exploit
Attackers are now targeting a chain of two Microsoft SharePoint vulnerabilities that can allow them to execute arbitrary code on unpatched servers, according to threat intelligence…
Microsoft sketches out a Whiteboard extension
Users have a little more time to migrate from Azure storage to OneDrive
FBI disrupts proxy network enabling Chinese espionage operations
The FBI has disrupted infrastructure associated with a technical "quartermaster" that provided reconnaissance, proxy management, and operational routing capabilities for Chinese cy…
Snowflake ends service-account passwords. Now comes the hard part
Snowflake is ending password authentication for legacy service accounts, forcing organizations to migrate them to passwordless methods. Token Security explains why the harder chall…
NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions
Cybersecurity researchers have disclosed details of a new adversary-in-the-middle (AitM) phishing toolkit called NovaCookies that's used as a proxy to redirect Microsoft 365 sign-i…
AWS buys DuckLabs, the people behind the popular in-process OLAP database
Cloud giant expresses love for DuckDB by buying its main support and development company
Ubiquiti patches three max severity security vulnerabilities
Ubiquiti has released security patches for three new maximum-severity vulnerabilities that threat actors can exploit remotely without privileges. [...]
Gates warns society faces an AI-pocalypse unless we get more socialist
AI and robots are advancing faster than you think, and we're not prepared for a world where the majority may be out of work
CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published the results of two red team assessments it conducted simultaneously against two critical infrastructu…
Adobe and Nvidia Patch Dozens of Vulnerabilities
Adobe and Nvidia each published several advisories, including ones that address critical vulnerabilities in their products. The post Adobe and Nvidia Patch Dozens of Vulnerabilitie…
Nitter no more? X sends in the lawyers to shut down open source project
Cease and desist letters from firm headed by free speech absolutist
Microsoft tests new privacy controls for Windows 11 desktop apps
Microsoft has begun testing new privacy controls that will let Windows 11 users choose which desktop applications can access their camera, microphone, and precise location. [...]
Spyware for Babies
The New York Times has a long article (alt link) on surveillance systems aimed at babies. They are increasingly using AI. Nanit and its rivals want to own 24/7 health tracking for …
Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code
The CERT Coordination Center (CERT/CC) has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library that allow a remote, unauthenticated attacker to read arb…