News
What IT leaders are reading, from the sources they trust, plus articles written for this site. Stories from other sites open in a new tab.
-
Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw (opens Security Week in a new tab)
Critical flaws impact the Entity List and Field UI modules, and exploit paths exist with contributed modules. The post Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw appeared first on SecurityWeek.
-
Exploited Vulnerabilities Typically Take Three Months to Patch, Moody’s Finds (opens Infosecurity Magazine in a new tab)
Known exploited vulnerabilities take a median time of 87 days to be patched, according to a new Moody’s report
-
OnlyFans Copyright Takedowns Expose Compromised Websites (opens Dark Reading in a new tab)
Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard's Greg Pollock explains what universities, government websites, and security teams need to think...
-
Conduent Agrees to Pay $80m to Settle Data Breach Class Action (opens Infosecurity Magazine in a new tab)
The 2024 cyber incident affected the healthcare data of 62 million people, who launched a class action lawsuit against the business services firm
-
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More (opens The Hacker News in a new tab)
The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done. This week had plenty of that. Trusted connections became a...
-
The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience (opens Dark Reading in a new tab)
An industry-wide laser focus on vulnerabilities has left cybersecurity teams without enough room to strategize for resilience.
-
Axonius AI Workforce pairs asset intelligence with automated action (opens Help Net Security in a new tab)
Axonius has announced Axonius AI Workforce, the latest expansion of Axonius AI. It enables organizations to deploy teams of Virtual Workers that monitor their environments, identify high-risk exposures and assets that deviate from their expected state, remediate issues, and report progress toward...
-
ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access (opens Help Net Security in a new tab)
American software company ConnectWise is contending with a security incident that has allowed unknown attackers to use its application identities to break into organizations’ Microsoft 365 accounts. The intruders used a compromised credential belonging to the ConnectWise Cloud Backup application...
-
OpenCode Breach Could Affect OpenAI, Anthropic and Google (opens Infosecurity Magazine in a new tab)
A breach affecting the OpenCode Console may lead to the exposure of API keys for Anthropic, OpenAI and Google Gemini users
-
Sweet Security adds one-click protection for vulnerable cloud workloads (opens Help Net Security in a new tab)
Sweet Security has announced the release of Virtual Patching, a new capability that protects running cloud and AI applications from specific vulnerabilities the moment they are identified. Security teams can enforce protection in one click while engineering develops, tests, and deploys a permanent...
-
ConnectWise Suspends Cloud Services in Response to Cyberattack (opens Security Week in a new tab)
The services remain unavailable as the company continues remediation and security validation. The post ConnectWise Suspends Cloud Services in Response to Cyberattack appeared first on SecurityWeek.
-
Human Skills That Will Define the AI Era (opens CTO Magazine in a new tab)
Technology Inclusion and Workforce Participation: This series explores how organizations are working to broaden participation in technology roles and decision-making. Rather than focusing on initiatives alone, it examines outcomes, how inclusion, access, and representation influence innovation...
-
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories (opens The Hacker News in a new tab)
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by...
-
Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure (opens Security Week in a new tab)
Threat actors have been observed delivering cryptocurrency miners and proxy software. The post Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure appeared first on SecurityWeek.
-
Microsoft, Nvidia push provenance checks as open-weight AI adoption accelerates (opens CSO Online in a new tab)
Microsoft and Nvidia are urging enterprises to assess the security of open-weight AI models throughout deployment, warning that changes to model weights and configurations can weaken safeguards even when a model retains its ability to perform assigned tasks. In a joint paper published last week...
-
ConnectWise backup credentials exposed multiple Microsoft 365 tenants (opens CSO Online in a new tab)
ConnectWise has disabled key cloud services and is investigating unauthorized access to customers’ Microsoft 365 environments after a credential tied to its Cloud Backup platform was compromised and used to authenticate into customer tenants, prompting Huntress to identify suspicious sign-ins...
-
One Compromised Login Exposed Millions of California Students’ Records (opens Security Week in a new tab)
Intruders used compromised credentials to access an ETS SFTP server, copying records of California students back to 2006. The post One Compromised Login Exposed Millions of California Students’ Records appeared first on SecurityWeek.
-
Microsoft pulls plug on Essex data center development (opens IT Pro in a new tab)
Planned development in Loughton was set to deliver 50 MW of AI capacity and create 250 permanent jobs
-
From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software (opens The Hacker News in a new tab)
In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer messages into case records; it is how airlines and...
-
Microsoft’s business software practices under scrutiny by UK markets regulator (opens IT Pro in a new tab)
The watchdog is concerned the company makes it too difficult for customers to switch services
