34 casos · pág. 1/2
A TiDB breach is being used to illustrate flawed assumptions about cloud security. The article argues that cloud providers may be storing sensitive customer data without either the provider or the customer knowing it. When such a provider is breached, that hidden data is exposed. The excerpt gives no details on the breach itself, such as …
Security teams are racing to remediate two critical PHP vulnerabilities, collectively dubbed PHP2Shell, after technical details leaked and exploitation attempts were reported. The article excerpt gives no CVE identifiers, affected versions or attribution. The name suggests a path to shell access, but the excerpt does not confirm the impac…
Marvell, Microsoft and Oracle are collaborating to standardize a NIST FIPS 140-3 Level 3 integrated hardware security module (HSM) for cloud and hyperscale data center infrastructure. The article, which is only a short teaser, describes an industry standardization effort rather than a threat, vulnerability or incident. No CVEs, threat act…
A GitHub account belonging to an OVHcloud developer, compromised several months earlier, was used to push malicious code to unsuspecting users. Dark Reading attributes the activity to the GlassWorm threat actors. The available excerpt does not say what the malicious code did, which repositories or packages were affected, how many users we…
A 360 Privacy survey reported by Dark Reading finds that more than 8 in 10 security and wealth professionals believe cybersecurity and physical security can no longer be separated. The research suggests high-profile executives feel "untouchable" even as their digital exposure turns into physical risk. The excerpt available does not descri…
Optiv has launched CyberBOT, a cybersecurity awareness training program offering hands-on sessions to educators, nonprofits and community leaders. The program is meant to provide an accessible resource for year-round cyber awareness and to help build more resilient communities. The article is a product and program announcement. It describ…
A former OpenAI engineer with reported Saudi ties was detained after allegedly planting a secret recording device in a conference room at OpenAI's headquarters. Dark Reading presents the case as an example of a preventable insider threat vector. The available text is only a short teaser, so it gives no detail on the device, how long it wa…
A Dark Reading roundtable, reported by Arielle Waldman, discusses how AI is complicating security across the software development lifecycle (SDLC). Participants found that three measures give CISOs a path forward: closer collaboration between teams, better visibility into identities in development environments, and lower testing costs. Th…
A Chinese-speaking attacker has reportedly compromised hundreds of websites worldwide by abusing Cairn, an AI-driven penetration-testing tool, to automate the attacks. Reported victims include large industrial and consumer brands such as John Deere, SharkNinja and engine manufacturer Cummins, from which the attacker is said to have looted…
ConnectWise has disabled its cloud backup offering amid concern for downstream managed service providers (MSPs) and their customers. Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials. ConnectWise says customer impact remains unconfirmed. The available article text is limited to the headline a…
Researchers infiltrated a large-scale tech support scam operation that impersonates Microsoft. The operation relies on a malicious traffic distribution system (TDS) run by a Russian organization. It also abuses thousands of Cloudflare links to route victims to scam content. The article snippet gives no victim counts, losses or technical i…
Edward Dubrovsky, a longtime cybersecurity executive described by Dark Reading as a prominent ransomware negotiator, was arrested and charged in Pennsylvania last week with conspiracy to extort money. The available article text is a brief summary and does not describe the alleged scheme, the victims, the amounts involved or any link to sp…
Attackers are actively targeting a critical, maximum-severity server-side request forgery (SSRF) vulnerability in SonicWall SMA 1000 appliances. Dark Reading describes this as a familiar and unwelcome position for SonicWall customers, as the vendor's remote access products have repeatedly been targeted. The available excerpt does not give…
Anthropic published research examining the building blocks that could enable future AI-driven worms, combining IoT and network tests to explore autonomous AI self-replication. Per the Dark Reading report, the researchers said that shutting down such self-replicating AI would be "challenging". The article excerpt does not describe a real-w…
North Korea (DPRK) is running simple reply-baiting phishing attacks against Ukrainian targets. The goal is to gain insight into its own war effort in Ukraine. The article is a short teaser, so it gives no information on the specific actor, targets, infrastructure or tooling. Technical Details - The campaign relies on reply-baiting phishin…
Microsoft's October 2026 Patch Tuesday is described as the largest security update the vendor has ever released. According to Dark Reading, it includes zero-day vulnerabilities, among them defense bypass flaws and unauthenticated remote code execution (RCE) bugs. The article excerpt gives no CVE identifiers, affected product lists, exploi…
Organizations are reporting that ransomware operators are escalating extortion with threats of stalking, physical violence and abduction aimed at employees. The article says these claims are difficult to verify. The reports point to a possible shift toward real-world intimidation of staff and their families as pressure during extortion. T…
A Russian influence operation is reportedly targeting Latin America, with schools in Peru and Ecuador among the targets. According to Dark Reading, the operation used AI to support its activity. Its tactics included spoofed emails, fake government documents, and the creation of a local organization to give the campaign a domestic presence…
A flaw dubbed SneakPeek in the preview pane of Anthropic's Claude Code Desktop can let adversaries quietly steal credentials from developers without any user interaction (zero-click). According to the report, exposed secrets include SSH private keys, AWS credentials and Claude OAuth tokens. The article excerpt provides no CVE identifier, …
A cybercrime marketplace tracked as Yam Store supplied cloud infrastructure and phishing kits that helped drive more than 1 billion phishing messages worldwide. The marketplace appears to work as an enabling service, letting other criminals run large-scale phishing campaigns without building their own tooling. The source article is a shor…
