News Archive
2287 stories · page 95 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
Weekly Update 505
A significant data breach impacting Instructure, the company behind the Canvas learning management system, appears to have been averted or mitigated shortly after it was discovered. The threat actor group ShinyHunters, which had claimed responsibility for the incident, ceased its activity shortly after the initial reports of the breach.
Lawmakers Demand Answers as CISA Tries to Contain Data Leak
Lawmakers on Capitol Hill are demanding answers from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) following a report that a contractor intentionally exposed a significant amount of sensitive agency data, including AWS GovCloud keys, on a public GitHub account. The breach has prompted an inquiry from both houses of Congress as CISA works to mitigate the fallout and revoke the…
Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada
Canadian authorities have arrested a 23-year-old Ottawa man, Jacob Butler, also known online as "Dort," on charges related to the creation and operation of the Kimwolf botnet. The botnet, which allegedly enslaved millions of Internet of Things devices, was used in a series of massive distributed denial-of-service (DDoS) attacks over the past six months. Butler faces criminal hacking charges in…
Microsoft’s MSHTA Legacy Tool Still Powers Malware Campaigns on Windows
Microsoft's legacy HTML Application Host (MSHTA) utility continues to be a significant tool for cybercriminals to distribute various types of malware on Windows systems, according to recent analysis. Despite being an older component, MSHTA's ability to execute VBScript and JavaScript from both local and remote files makes it a valuable asset for attackers seeking to deploy everything from…
CISA Admin Leaked AWS GovCloud Keys on Github
A contractor for the Cybersecurity & Infrastructure Security Agency (CISA) inadvertently exposed highly privileged credentials for AWS GovCloud accounts and numerous internal CISA systems through a public GitHub repository. Security experts have described the leak as one of the most significant government data exposures in recent history, containing details on CISA's internal software…
Weekly Update 504
The debate surrounding whether to pay ransoms to cybercriminals to prevent data leaks continues to be a significant concern for organizations. In a recent development, Grafana, a popular open-source analytics and monitoring solution, reportedly chose not to pay a ransom demand. This decision comes amidst ongoing discussions about the efficacy and ethical implications of ransom payments in the…
Cyber Breach Impact on Stock Prices Explored
Researchers investigated whether public indicators of cyber breaches can predict market reactions and inform trading strategies. They analyzed data from company filings, blogs, and social media to test a hypothesis suggesting shorting stocks after a breach becomes visible and then going long as the market recovers. The study found mixed results, questioning common assumptions about how the market values cyber failures.
Welcoming the Bahamian Government to Have I Been Pwned
The government of The Bahamas has joined a growing list of public sector entities utilizing the Have I Been Pwned (HIBP) service to enhance its cybersecurity posture. The National Computer Incident Response Team of The Bahamas, known as CIRT-BS, will now have access to HIBP's extensive database to monitor its government domains for potential data breaches.
A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens
Researchers have developed a two-exploit chain that can achieve root access on the Google Pixel 10, starting from a zero-click attack vector. This chain builds upon previous work that demonstrated a similar exploit for the Pixel 9.
Welcoming the Bangladesh Government to Have I Been Pwned
The government of Bangladesh has joined a growing list of nations utilizing the Have I Been Pwned (HIBP) service to enhance its cybersecurity posture. The BGD e-GOV CIRT department has been granted full access to HIBP's free government service, enabling them to monitor their official domains against data breaches.
EtherRat and TukTuk Malware Campaigns Lead to The Gentleman Ransomware
Malware campaigns utilizing EtherRat and TukTuk have culminated in the deployment of The Gentleman ransomware, according to recent analyses. These campaigns demonstrate a sophisticated, multi-stage approach, leveraging various tools and techniques to achieve initial access, maintain persistence, exfiltrate data, and ultimately encrypt systems.
Welcoming the Costa Rican Government to Have I Been Pwned
Costa Rica's government is now utilizing the Have I Been Pwned (HIBP) service to enhance its cybersecurity posture. The nation's Computer Security Incident Response Team (CSIRT) has been onboarded to HIBP's free government service, granting them the ability to monitor government domains against the vast dataset of breached information held by HIBP.
Weekly Update 503
Instructure, the company behind the Canvas learning management system, has not yet publicly addressed a potential data breach, despite a deadline set by a ransomware group known as ShinyHunters. The group had threatened to leak data allegedly stolen from Instructure by November 20th.
Cloud Worm PCPJack Steals Credentials and Evicts TeamPCP Artifacts
A newly identified cloud worm, dubbed PCPJack, is actively targeting exposed cloud infrastructure to steal credentials and remove any artifacts associated with the threat actor group TeamPCP. SentinelLabs researchers discovered the framework, which operates as a credential theft toolset that propagates across cloud environments.
Operation Road Trap: Fake toll and parking texts are spreading worldwide
Scammers are globally targeting drivers with fraudulent text messages impersonating toll operators, parking authorities, and transport agencies, according to a recent analysis by Bitdefender Labs. Since December 2025, researchers have tracked these "smishing" campaigns, which have sent over 79,000 deceptive messages across 12 countries. The active campaigns aim to trick recipients into paying…
AI threats in the wild: The current state of prompt injections on the web
Google's Threat Intelligence teams have been actively monitoring the web for real-world instances of indirect prompt injection (IPI), a significant threat vector targeting AI agents. IPI occurs when an AI system processes external content, such as websites or documents, containing malicious instructions that override the user's original intent. While the potential for IPI is widely discussed,…
Bringing Rust to the Pixel Baseband
Google is implementing a new security measure for its Pixel smartphones by introducing a DNS parser written in the Rust programming language into the firmware of the cellular modem. This development is part of an ongoing effort to bolster the security posture of the devices, particularly in areas prone to complex vulnerabilities.
Protecting Cookies with Device Bound Session Credentials
Google's Chrome browser is introducing a new security feature called Device Bound Session Credentials (DBSC) for Windows users, with support for macOS planned for the near future. This development is designed to significantly enhance protection against session hijacking, a common attack vector where attackers gain unauthorized access to user accounts by stealing session cookies.
Google Workspace’s continuous approach to mitigating indirect prompt injections
Google is detailing its ongoing efforts to combat indirect prompt injection attacks targeting its artificial intelligence features within Google Workspace, such as Gemini. These attacks aim to manipulate AI behavior by embedding malicious instructions within the data or tools that the AI accesses, often without the user's direct knowledge or interaction.
VRP 2025 Year in Review
Google's Vulnerability Rewards Program (VRP) marked its 15th anniversary in 2025 by distributing a record $17 million in rewards to more than 700 security researchers worldwide. This annual figure represents a substantial increase in payouts and researcher participation.
Security for the Quantum Era: Implementing Post-Quantum Cryptography in Android
Google is taking steps to secure Android against the potential threat of quantum computing by integrating post-quantum cryptography (PQC) standards into the operating system. This initiative represents a multi-year effort to safeguard sensitive data and transactions that could be vulnerable to decryption by future quantum computers.
Windsurf IDE Extension Drops Malware via Solana Blockchain
Security researchers have identified a malicious extension for the Windsurf Integrated Development Environment (IDE) that leverages the Solana blockchain to deploy a multi-stage malware payload. The extension, masquerading as a support tool for the R programming language, was designed to steal sensitive data from Chromium-based browsers.
On the Effectiveness of Mutational Grammar Fuzzing
Mutational grammar fuzzing, a technique that uses predefined grammars to guide sample mutation while preserving structural integrity, faces significant challenges that can hinder bug discovery despite its proven effectiveness. While the approach ensures generated samples adhere to structural rules, leading to the discovery of complex issues in areas like XSLT implementations and JIT engines,…
A Deep Dive into the GetProcessHandleFromHwnd API
The GetProcessHandleFromHwnd API, a Windows function that allows an application to obtain a handle to the process owning a specific window handle (HWND), has undergone significant changes since its introduction, with its original documentation containing several inaccuracies. Initially believed to be a convenience function relying on window hooks, its implementation and security properties…