Category: Security
-
Over 10,000 Docker Hub images found leaking credentials, auth keys
More than 10,000 Docker Hub container images expose data that should be protected, including live credentials to production systems, CI/CD databases, or LLM model keys. The secrets impact a little over 100 organizations, among them are a Fortune 500 company and a major national bank. […] After scanning container images uploaded to Docker Hub in…
Written by
-
All of Russia’s Porsches Were Bricked By a Satellite Outage
Imagine walking out to your car, pressing the start button, and getting absolutely nothing. No crank, no lights on the dash, nothing. That’s exactly what happened to hundreds of Porsche owners in Russia last week. The issue is with the Vehicle Tracking System, a satellite-based security system that’s supposed to protect against theft. Instead, it…
Written by
-
Kohler Can Access Data and Pictures from Toilet Camera It Describes as “End-to-End Encrypted”
In October Kohler launched Dekota, a $600 (plus monthly subscription) device that attaches to the rim of your toilet and collects images and data from inside, promising to track and provide insights on gut health, hydration, and more. To allay the obvious privacy concerns, the company emphasizes the sensors are only pointed down, into the…
Written by
-
5 ancient bugs in Fluent Bit put major clouds at risk
A series of “trivial-to-exploit” vulnerabilities in Fluent Bit, an open source log collection tool that runs in every major cloud and AI lab, was left open for years, giving attackers an exploit chain to completely disrupt cloud services and alter data. The Oligo Security research team found the five vulnerabilities and – in coordination with…
Written by
-
Copy-paste now exceeds file transfer as top corporate data exfiltration vector, as well as untrustable extensions and not using SSO/MFA
It is now more common for data to leave companies through copying and paste than through file transfers and uploads, LayerX revealed in its Browser Security Report 2025. This shift is largely due to generative AI (genAI), with 77% of employees pasting data into AI prompts, and 32% of all copy-pastes from corporate accounts to…
Written by
-
Post-heist reports reveal the password for the Louvre’s video surveillance was ‘Louvre,’ and suddenly the dumpster-tier opsec of videogame NPCs seems a lot less absurd
The air of criminal mystique has been dispelled somewhat in the weeks following the October 18 heist that saw $102 million of crown jewels stolen from the Louvre in broad daylight. The suspects fumbled an entire crown during their escape, before trying and failing to light their mechanical lift on fire as a diversionary tactic.…
Written by
-
Security bug in India’s income tax portal exposed taxpayers’ sensitive data – by swapping credential numbers 🙁
The Indian government’s tax authority has fixed a security flaw in its income tax filing portal that was exposing sensitive taxpayers’ data, TechCrunch has exclusively learned and confirmed with authorities. The flaw, discovered in September by a pair of security researchers Akshay CS and “Viral,” allowed anyone who was logged into the income tax department’s…
Written by
-
Another Day, Another Age Verification Data Breach: Discord’s Third-Party Partner Leaked Government IDs. That didn’t take long, did it?
Once again, we’re reminded why age verification systems are fundamentally broken when it comes to privacy and security. Discord has disclosed that one of its third-party customer service providers was breached, exposing user data, including government-issued photo IDs, from users who had appealed age determinations. Data potentially accessed by the hack includes things like names,…
Written by
-
Motion sensors in high-performance mice can be used as a microphone to spy on users, thanks to AI — Mic-E-Mouse technique harnesses mouse sensors, converts acoustic vibrations into speech
A group of researchers from the University of California, Irvine, have developed a way to use the sensors in high-quality optical mice to capture subtle vibrations and convert them into audible data. According to the abstract of Mic-E-Mouse (full PDF here), the high polling rate and sensitivity of high-performance optical mice pick up acoustic vibrations…
Written by
-
Unity Real-Time Development Platform Vulnerability Let Attackers Execute Arbitrary Code
Unity Technologies has issued a critical security advisory warning developers about a high-severity vulnerability affecting its widely used game development platform. The flaw, designated CVE-2025-59489, exposes applications built with vulnerable Unity Editor versions to unsafe file loading attacks that could enable local code execution and privilege escalation across multiple operating systems. The vulnerability stems from…
Written by
-
Israeli military company now owns many popular VPN products
Social media users are calling for the mass cancellation of ExpressVPN subscriptions after it was revealed that a cybersecurity firm with Israeli ties owns the popular privacy service. In 2021, The Times of Israel reported that Kape Technologies, a British-Israeli digital security company, acquired ExpressVPN, one of the world’s largest virtual private network (VPN) providers, for nearly $1bn.…
Written by
-
Quantum random number generator combines small size and high speed
Researchers have developed a chip-based quantum random number generator that provides high-speed, high-quality operation on a miniaturized platform. This advance could help move quantum random number generators closer to being built directly into everyday devices, where they could strengthen security without sacrificing speed. True randomness is essential for secure online banking, private messaging, and protecting…
Written by
-
Viral pay to record calls for AI app Neon takes itself down after exposing users’ phone numbers, call recordings, and transcripts to world + dog
A viral app called Neon, which offers to record your phone calls and pay you for the audio so it can sell that data to AI companies, has rapidly risen to the ranks of the top-five free iPhone apps since its launch last week. The app already has thousands of users and was downloaded 75,000…
Written by
-
OpenAI plugs ShadowLeak bug in ChatGPT which allowed anybody access to everybodys gmail emails and any other integrations
ChatGPT’s research assistant sprung a leak – since patched – that let attackers steal Gmail secrets with just a single carefully crafted email. Deep Research, a tool unveiled by OpenAI in February, enables users to ask ChatGPT to browse the internet or their personal email inbox and generate a detailed report on its findings. The…
Written by
-
Entra ID bug granted easy access to every tenant
A security researcher claims to have found a flaw that could have handed him the keys to almost every Entra ID tenant worldwide. Dirk-jan Mollema reported the finding to the Microsoft Security Research Center (MSRC) in July. The issue was fixed and confirmed as mitigated, and a CVE was raised on September 4. It is,…
Written by
-
China: 1-hour deadline on serious cyber incident reporting
Beijing will soon expect Chinese network operators to ‘fess up to serious cyber incidents within an hour of spotting them – or risk penalties for dragging their feet. From November 1, the Cyberspace Administration of China (CAC) will enforce its new National Cybersecurity Incident Reporting Management Measures, a sweeping set of rules that tighten how…
Written by
-
Samsung patches Android WhatsApp vuln exploited in the wild on Apple devices
Samsung has fixed a critical flaw that affects its Android devices – but not before attackers found and exploited the bug, which could allow remote code execution on affected devices. The vulnerability, tracked as CVE-2025-21043, affects Android OS versions 13, 14, 15, and 16. It’s due to an out-of-bounds write vulnerability in libimagecodec.quram.so, a parsing…
Written by
-
Critical, make-me-super-user SAP S/4HANA bug being exploited
A critical code-injection bug in SAP S/4HANA that allows low-privileged attackers to take over your SAP system is being actively exploited, according to security researchers. SAP issued a patch for the 9.9-rated flaw in August. It is tracked as CVE-2025-42957, and it affects both private cloud and on-premises versions. According to SecurityBridge Threat Research Labs,…
Written by
-
18 popular VPNs turn out to belong to 3 different owners – and contain insecurities as well
A new peer-reviewed study alleges that 18 of the 100 most-downloaded virtual private network (VPN) apps on the Google Play Store are secretly connected in three large families, despite claiming to be independent providers. The paper doesn’t indict any of our picks for the best VPN, but the services it investigates are popular, with 700…
Written by
-
US spy chief Gabbard says UK agreed to drop ‘backdoor’ mandate for Apple
U.S. Director of National Intelligence Tulsi Gabbard said on Monday the UK had agreed to drop its mandate for iPhone maker Apple to provide a “backdoor” that would have enabled access to the protected encrypted data of American citizens. Gabbard issued the statement on X saying she had worked for months with Britain, along with…
Written by
-
Phishing training is pretty pointless, researchers find
In a scientific study involving thousands of test subjects, eight months and four different kinds of phishing training, the average improvement rate of falling for phishing scams was a whopping 1.7%. “Is all of this focus on training worth the outcome?” asked researcher Ariana Mirian, a senior security researcher at Censys and recently a Ph.D.…
Written by
-
Google Issues New Update Warning To 3.5 Billion Chrome Users
Google has issued a security update for its Chrome browser which you should apply right now. That’s because Google has fixed six issues in its widely-used browser, half of which are rated as having a high severity. The Chrome Stable channel has been updated to 139.0.7258.127/.128 for Windows, Mac and 139.0.7258.127 for Linux, Google said…
Written by
-
Microsoft Recall can still nab credit cards, passwords, info and share them remotely
Microsoft Recall, the AI app that takes screenshots of what you do on your PC so you can search for it later, has a filter that’s supposed to prevent it from screenshotting sensitive info like credit card numbers. But a The Register test shows that it still fails in many cases, creating a potential treasure…
Written by
-
A Premium Luggage Service’s Web Bugs Exposed the Travel Plans of Every User—Including Diplomats
[…] Airportr, a UK-based luggage service that partners with airlines to let its largely UK- and Europe-based users pay to have their bags picked up, checked, and delivered to their destination. Researchers at the firm CyberX9 found that simple bugs in Airportr’s website allowed them to access virtually all of those users’ personal information, including…
Written by
-
Hackers exploit a blind spot by hiding malware inside DNS records
[…]The practice allows malicious scripts and early-stage malware to fetch binary files without having to download them from suspicious sites or attach them to emails, where they frequently get quarantined by antivirus software. That’s because traffic for DNS lookups often goes largely unmonitored by many security tools. […] Researchers from DomainTools on Tuesday said they…
Written by
