The Register

British intelligence agency misplaced 'thousands' of storage devices, years later still can't say how many

Other agency errors included an unchecked software bug that led to Terrorism Act detentions

In the year AI re-wrote the infosec rulebook, it’s comforting to know crypto exchanges still have bad security

Binance freezes funny money after compromise of engineer’s laptop linked to $6.3 billion of unauthorized trades

Vulnerabilities

Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched

Embedded browsers are at the heart of the problem

Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers

Snoops 'likely still' have access to US government-affiliated network

Belgium's tax agency confirms cyberattack, pulls services offline

Officials confirm this week’s tax deadlines extended to November as a result

Shortlist of age checks for the UK's under-16 social media ban is out, 'some' adults will need verifying

Some adults may not need to prove it, but many will

Vulnerabilities

Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour

'The workflow automatically is triggered within a second, and if the workflow is indeed vulnerable, then the attack is executed successfully'

Admin dropped the F-bomb in a password to show hackers who was really 1337

Cursing in login credentials can help keep the bad guys out, but not when the rest of your security is BS

Zero-day

Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble

Attackers probe another EBS bug, and ShinyHunters' PeopleSoft 0-day turns out to involve three vulns

Ransomware

Serial ransomware crook gets 70 months behind bars for Nefilim, Hive roles

Artem Stryzhak joined both gangs, which targeted businesses and a hospital during the pandemic

Cisco open sources tool for detecting AI agents on hacking sprees

Project Quarry aims to provide a 'shared language' for evaluating agent behavior

Data Breaches

123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus

Company chiefs believe the attackers could be the same as those who used ARTEX to breach South Korea’s financial giants

ICS / OT

AI 'hacker' finds 4 severe bugs in popular industrial control software in under 4 hours

One critical, three high-severity EPICS bugs could disrupt research experiments

Day 2 of canceled classes at University of New Mexico after Health Sciences Center cyberattack

University hospitals once again accepting patients after initial ambulance diversion, but recovery to continue in phases

Vulnerabilities

CISA confirms PHP2Shell under attack as researchers clock successful exploits

Both critical PHP flaws land on the agency’s exploited list as infosec pros confirm hackers are getting working shells

Microsoft releases out-of-band Windows fixes with certificate updates

Did you hear the one about eMudhra and the power of 4? Time to get connected to certificate trust list updates

Data Breaches

Attack on email hosting provider for German far right party AfD exposed 345k accounts

Alternative für Deutschland swats away scandals as reporters swarm leaked email tranche

Cloud & Identity

Japanese virtual desktop cloud hacked so hard it asks to be banned

CEO admits service used for foreign exchange trading had holes company was slow to fix

Malware

Worm armed 42 GitHub repos by hiding a payload too big to fail

Payload blobs measuring 12.9 to 13.7 MB were large enough to evade GitHub code search

Alibaba's Qwen AI caught trying to contact server in China

But there's not much evidence this is anything more than echoes of unsanitized training data

Data Breaches

LiteLLM supply chain attack started with an exposed master key

A 'strong illustration of the risks associated with failing to rotate a potentially exposed key'