You have got to be KDDI-ng – Japanese telco exposes 14.2 million managed email credentials
Five ISPs and plenty of users await their fate
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
Hackers Exploiting Cisco Unified CM Vulnerability
Cisco noted that a PoC had been available for CVE-2026-20230 when it announced patches in early June. The post Hackers Exploiting Cisco Unified CM Vulnerability appeared first on S…
Chinese supercomputer using local processors heads TOP500 list
Use of Arm cores and Linux mean Beijing hasn’t broken away from the world
Anthropic’s Mythos Model Found Vulnerabilities in Classified US Government Systems, Official Says
Come vulnerabilities were found within hours, but that does not mean the model was able to exploit them within that time, the official said. The post Anthropic’s Mythos Model Found…
Vulnerability reports are not special anymore
Article URL: https://words.filippo.io/vuln-reports/ Comments URL: https://news.ycombinator.com/item?id=48653216 Points: 387 # Comments: 221
Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks
A high-severity SSRF vulnerability, tracked as CVE-2026-20230, in Cisco Unified Communications Manager Server is now being exploited in attacks. [...]
Tata Electronics confirms cyberattack as hackers leak data
Tata Electronics has confirmed in a statement to BleepingComputer that it was the target of a cyberattack that impacted parts of its IT infrastructure. [...]
Upscale AI readies Skyhammer scale-up networking tech, raises new funding
AI continues to fuel demand for new networking technology and the vendors that build it. Upscale AI, which emerged from stealth in September 2025 with a $100 million seed round,…
OpenAI Codex bombards SSDs with needless write operations, costing millions
Clumsy logging implementation squirrels away data without regard for cost
Scope of Salesforce Attacks Expands as Icarus Leaks Data
More victims have emerged after attackers breached application vendor Klue and used its OAuth tokens to steal customers' Salesforce data.
Windows 11 KB5095093 update rolls out new Point-in-Time restore feature
Microsoft has released the KB5095093 preview cumulative update for Windows 11 24H2 and 25H2, which fixes numerous bugs and begins rolling out new features, including the new Poin…
Anthropic reimagines Claude in Slack as nosy, always-on agentic AI coworker
The Claude in Slack app is dead, long live Claude in Slack
Healthtech firm Xolis suffers data breach impacting 1.4 million people
Healthcare technology company Xsolis says that sensitive data belonging to nearly 1.4 million individuals was compromised in a phishing attack that gave attackers access to its net…
'Cordyceps': Mushrooming Malicious Pull Requests Threaten Developer Workflows
The CI/CD workflow weakness affects Microsoft's Azure Sentinel, Google's AI Agent Development Kit, Apache's Doris analytics database, Cloudflare's Workers SDK, and Python Software …
HS136: How AI Is Changing Enterprise Software Development (Sponsored)
AI can generate working code quickly. Building reliable software to run infrastructure platforms is still a multi-year engineering challenge. In this sponsored episode, BlueCat chi…
New macOS ClickFix attack silently mounts DMGs to push infostealer
A new macOS ClickFix campaign is using Terminal commands to silently download, mount, and launch info-stealing malware from malicious disk image (DMG) files. [...]
FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation
A Russian-speaking initial access broker (IAB) driven by financial gain is assessed to be behind a large-scale credential-harvesting operation known as FortiBleed that has targeted…
Mythos discovers 'Squidbleed,' a memory leak that's gone undetected since Clinton era
Plus more blasts from the past: NetWare, FTP, and HTTP
Dragos Unveils AI for OT Security
Named EmberAI, the new capability is built on Dragos’ massive operational technology cybersecurity dataset. The post Dragos Unveils AI for OT Security appeared first on SecurityWe…
HW082: Employee or Independent Contractor in the Wi-Fi Industry?
Is it better to be an employee or an independent contractor in the Wi-Fi industry? Keith walks us through the good, the bad, and the ugly of both sides of the equation, offering a …
PP115: Palo Alto Networks: Reality of 109 to 1: Securing Machine Identities and AI Agents (Sponsored)
Machine identities now outnumber human identities in the enterprise 109 to 1 — and most of them are running without the governance controls you’d never skip for a human employee. S…
Space Force goes to (pretend) orbital war following record-fast Rocket Lab launch
Less than 17 hours after receiving orders, Rocket Lab put Pioneer in orbit for close-range maneuvers with True Anomaly's Jackal satellite
Scattered Spider Hackers Plead Guilty on Day 1 of Trial
Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from an August 2024 cyberattack that crippled Transport for London, the entity responsible for t…
Rami Rahim’s message for network pros: Legacy networks can’t withstand rigors of AI
Last week’s HPE Discover event in Las Vegas marked the first time the annual user conference included the now-fully-absorbed Juniper Networks. Rami Rahim, former CEO of Juniper Net…
O2 joins UK 2G switch-off with summer 2029 start date
It's not just old phones – many smart meters and telecare alarms still use the ancient technology
Data Exposure Flaws Threaten Dify AI Platform Used by 1 Million Apps
Attackers could abuse Dify's multi-tenant cloud service to read private chats, preview other tenants' documents, and reach internal APIs. The post Data Exposure Flaws Threaten Dify…
Scattered Spider members plead guilty to hacking Transport for London
Two members of the 'Scattered Spider' cybercrime group pleaded guilty to hacking the Transport for London (TfL) systems in 2024. [...]
Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents
Security firm AIR built a fake AI agent skill, pushed it through a popular skill marketplace and an Instagram ad, and says it reached roughly 26,000 agents, including some on corpo…
Trump Order Sets 2030 Deadline for Federal Post-Quantum Crypto Migration
President Trump signed an executive order on June 22 setting hard deadlines for federal agencies to move high-value assets and high-impact systems to post-quantum cryptography. Ke…
Valve opens Steam Machine pre-orders with queue lottery and hefty prices amid AI squeeze
Alternatively, you can install SteamOS 3.8 on your own AMD-powered hardware