BOFH: Cross-department AI pitches are easier to swallow with a pint in hand
Some ideas need workshopping, others need a warning light
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism
Researchers demonstrate adversarial hallucination squatting against popular AI assistants to achieve remote code execution. The post ‘HalluSquatting’ Turns AI Hallucinations Into B…
Former ransomware negotiator gets 4 years for BlackCat attacks
A former employee of cybersecurity incident response company DigitalMint was sentenced to 70 months in prison for targeting U.S. companies in BlackCat (ALPHV) ransomware attacks. […
Ransomware Negotiator Gets 70 Months in Prison for Aiding BlackCat Attacks
A 41-year-old former ransomware negotiator has been sentenced to nearly six years (i.e., 70 months) in prison in the U.S. for their role in conspiring with the now-defunct BlackCat…
Network of 200 GitHub Repositories Used for Malware Infection
A Go module is used to load PowerShell code that fetches a resolver from public dead drops to execute Windows malware. The post Network of 200 GitHub Repositories Used for Malware …
Datacenter MacGyver saved the biggest football match of the year
Police wanted to call off a grudge game until tech support electrified fevered fans
Red Hat offers RHEL support ‘forever’ for those who need to lock in to legacy tech
Beware the golden screwdriver
Microsoft warns customers AI will mean busier Patch Tuesdays
More patches mean more reasons to buy Redmond’s auto-patching tools
An unnamed US county – perhaps in Ohio – paid $1M extortion demand to cybercriminals
Leaked negotiations spill the tea
OpenMandriva Linux says contributor tried to sabotage the project
The OpenMandriva Linux project announced that it was the target of an attempted act of internal sabotage after a dispute among contributors. [...]
AI slop writing has taken over the internet, particularly LinkedIn and X
One in four long-form social media posts appear entirely AI-generated, with nearly half of those on Microsoft's and Elon's platforms involving AI in some form
Iran's Cyber Crosshairs Focus Beyond Critical Infrastructure
Obscurity isn't a defense. If your company has any Internet-facing vulnerability, you're at risk from multiple threats.
Microsoft Reins in RoguePlanet Zero-Day Threat
The researcher known as "Nightmare-Eclipse" published a proof-of-concept (PoC) exploit for the Windows Defender vulnerability in early June after dropping several other Microsoft z…
Injective SDK on npm infected with cryptocurrency wallet stealer
Hackers compromised the Injective Labs SDK project's GitHub repository and used it to publish a malicious package on the Node Package Manager (npm) that stole cryptocurrency wallet…
_Pattara_Alamy.jpg?width=720&quality=80&disable=upscale)
AI Agents Are a New Kind of Identity — and Most Organizations Aren't Ready
If you're handling AI agents like a service account or API token, consider yourself behind. AI agents need a fundamentally different approach.
Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs
Datadog Security Labs is warning of "several overlapping campaigns" that are systematically enumerating corporate GitHub organizations, repositories, and user accounts through the …
New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware
Microsoft has taken apart a destructive Windows backdoor it calls GigaWiper. What stands out is how it is built: not one tool but three older destructive programs bolted into one, …
AI tool scours the web for job openings, preps your resume and cover letter
Searching for work sucks; AI combs the internet and sucks it all up. Combine the two and let 'er rip with this Python project
OpenMandriva claims disgruntled admin trashed repos after community bust-up
Linux distro accuses former contributor of deleting years of work and pushing a package that could have broken installs
New Helix vishing group emerges in SharePoint data theft attacks
A new data-extortion group called Helix is using identity-focused tactics such as voice phishing (vishing), device code phishing, and multi-factor authentication (MFA) abuse to ste…
Microsoft expects more Windows security updates from AI-discovered flaws
Microsoft says Windows users should expect to see an increase in security updates as the company increasingly relies on artificial intelligence to discover vulnerabilities in its c…
npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk
GitHub has officially announced the release of npm version 12 with install scripts disabled by default, along with deprecating granular access tokens (GATs) designed to bypass two-…
SAP makes it easier for customers to shop for legacy product support, ending EU antitrust probe
Vendor drops reinstatement fees and caps back-maintenance charges ahead of the ECC support cliff
Outlook for Mac bug makes font choice a purely decorative feature
Monospaced code snippets among the reported casualties
EU 'Chat Control' snoopfest returns after vote to kill it falls short
Opponents won the count but missed the 360-seat threshold needed to stop the interim CSAM-scanning rule
ThreatsDay: Cloud Bucket Hijacking, Windows LPE Chain, Global Fraud Bust + 17 More Stories
Most security mess starts as admin work. A link gets clicked. A tool gets trusted. A bucket name gets reused. A setting stays loose because nobody wants to touch it. This week is …
QIZ Security Raises $17 Million for Cryptographic Governance Platform
The Israeli company has developed a cryptographic posture and post-quantum cryptography management platform. The post QIZ Security Raises $17 Million for Cryptographic Governance P…
KDE Plasma users face a dire omen of change: 6.6.6 arrives
6.7 is now current, and in 6.8 you're getting Wayland whether you like it or not
Canonical Managed Kubeflow lands on Azure
PARTNER CONTENT: Why platform teams are swapping DIY Kubeflow for Canonical's managed service
New Forg365 phishing platform uses AI to target Microsoft 365 accounts
A new phishing-as-a-service (PhaaS) operation called Forg365 focuses on stealing Microsoft 365 accounts by combining adversary-in-the-middle (AiTM) and device code methods with AI-…