The roller coaster works, but the Six Flags kiosk has gone off the rails
Would you like an error with your terror?
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments
Cybersecurity researchers have flagged fresh malicious cyber activity by a threat actor with ties to East Asia targeting government entities in the Middle East. The intrusions hav…
GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption
GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a release is published before opening a pull request. "The cooldow…
Google goes it alone with a new cybercrime crew taxonomy
So much for Microsoft and CrowdStrike’s plans for consistent names across the industry
Manager showed off his DOS prowess – with a command that wiped data
Never believe a suit who says they're handy with tech
MCBS Data Breach Affects 1.2 Million Individuals
The PEAR ransomware group claimed to have stolen 3 TB of information from the medical business management company. The post MCBS Data Breach Affects 1.2 Million Individuals appeare…
SpaceX just about nails Starship test flight 13
Super Heavy booster had a super heavy landing, but other reusability tech did the trick
Foxconn drops VMware, adopts hyperconverged upstart Arcfra for workloads including AI
PLUS: New CEO for Infosys; China fines Trip.com; India demands GitHub remove Jack Dorsey's distributed social network; And more!
GitHub, PyPI add time-based defenses against supply chain attacks
GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management tool to protect against supply-chain attacks and to limit thei…
Trump expands voluntary pledge to keep datacenter costs off household power bills
Pinkie promise gains 200-plus new participants and precisely zero enforcement
The last Space Shuttle returned to Earth 15 years ago
So, how are those commercial replacements working out for you, NASA?
Steam forum ClickFix attacks infect gamers with XMRig cryptominers
Steam discussion forums are being abused in ClickFix attacks that pretend to be fixes for game and computer problems but actually infect devices with cryptominers. [...]
Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
A malvertising operation dubbed SourTrade is making victims' browsers build the final Windows executable themselves, using a legitimate Bun runtime as its base instead of serving o…
Malicious sites use JavaScript to build malware in browser memory
A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs browsers to assemble malware directly in memory. [...]
ShinyHunters data leaks fuel $2,000 sextortion email scam
Threat actors are using email addresses exposed in data breaches leaked by the ShinyHunters extortion group to send sextortion emails demanding $2,000 in Bitcoin. [...]
How AI drove Shopify back to clean code
Turns out, agents just want the same things as humans: easily-readable code, explicit contracts, and helpful feedback
Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available
Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JS…
Anti-AI open source has an enemy in common, but almost nothing else
Building bot-free alternatives may require lefties, libertarians, and culture warriors to share code
CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking
For years, phishing campaigns targeting financial institutions followed the same playbook. Victims were tricked into entering usernames and passwords, attackers collected the crede…
Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
Threat actors linked to the Cl0p (aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexP…
DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
The operators of the DevMan ransomware-as-a-service (RaaS) scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, a…
OpenAI confirms ChatGPT is down worldwide
ChatGPT, the famous artificial intelligence chatbot that allows users to converse with various personalities and topics, has connectivity issues worldwide. [...]
Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs commands as git on any sel…
Rockwell Patches Code Execution Flaws in Arena Simulation Software
A researcher has explained how an attacker could exploit these vulnerabilities to target industrial organizations. The post Rockwell Patches Code Execution Flaws in Arena Simulatio…
BOFH: This printer engineer knows every trick in the book
But so does this customer
Anthropic debuts Opus 5 at half the price of its Fable sibling
And as a bonus, it doesn't require data retention
Pope's official prayer app commits cardinal sin, leaks 700K+ users' info
(Security) hole-ier than thou
AMD vibe codes its way past the CUDA moat with ROCm.AI
Hey Claude, optimize this model for me
CISOs vs. Boards: Myth or Misunderstanding?
Escalating threats are forcing boards to prioritize security, but communication gaps persist. Boards and security teams each say they need more support to bridge the divide.