Cyber

Hacking, breaches, security

Cyber

Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption

The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors.

Source: The Hacker News
BleepingComputer
Cyber

Apple backports CoreGraphics zero-day patches to older iPhones

​Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]

Source: BleepingComputer
Cyber

Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers

A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says.

Source: The Hacker News
BleepingComputer
Cyber

Energy giant ENGIE discloses data breach affecting customers

French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners. [...]

Source: BleepingComputer
Cyber

OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections

OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown.

Source: The Hacker News
BleepingComputer
Cyber

CISA confirms PHP2Shell vulnerabilities now exploited in attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. [...]

Source: BleepingComputer
Cyber

Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses

The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua.

Source: The Hacker News
Cyber

CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities,…

Source: The Hacker News
Cyber

So Many AI Security Benchmarks, But None Tell the Whole Story

Measuring AI model security gets complex, fast, thanks to a growing patchwork of benchmarks targeting different variables in the equation. But none replace testing against your own code and workflows.

Source: Dark Reading
BleepingComputer
Cyber

University of Copenhagen data breach exposes data of 525,000 people

The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. [...]

Source: BleepingComputer
Cyber

Risks & Rewards: How AI Is Redefining the CISO's Role

Nvidia security executive Mark Weatherford says CISOs must help business leaders weigh AI's pros and cons, and ensure those deploying it own the risks.

Source: Dark Reading
BleepingComputer
Cyber

Former pentester used ARTEX AI to steal 8.2 million data records

South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks. [...]

Source: BleepingComputer