-
Thousands of leaked AWS keys remain active years after appearing in public sources, according to new research from Truffle Security. Hundreds of those credentials reportedly provide full administrative control over corporate Amazon Web Services accounts. The researchers tracked exposed cloud credentials between August 2022 and August 2026. They found that more than 9,300 publicly exposed…
-
LockBit has published a US Bank breach claim on its dark-web leak site and set a September 4 deadline. The ransomware group has not released a data sample, so the alleged incident remains unverified. The post includes a countdown clock, a tactic ransomware groups often use to pressure organisations into paying before they publish stolen…
-
UK cinema smart glasses policies could become stricter as operators consider the privacy and film-piracy risks of camera-enabled wearables. The UK Cinema Association says some venues may introduce restrictions or bans. No major UK cinema chain has confirmed a blanket ban so far. However, the trade body says operators are increasingly aware of the issues…
-
The ClarityCheck facial data leak reportedly exposed a database containing more than nine million facial images. The collection allegedly included photographs of children and teenagers, raising serious privacy and surveillance concerns. Security researcher Jeremiah Fowler said the database held around 450GB of data. He found it online without password protection or encryption, according to his…
-
The CEVA Logistics data breach has exposed personal and employment information belonging to current and former workers, the company has confirmed. The incident had already affected several of the logistics group’s business partners and their customers. CEVA says the compromised data differs between individuals. However, the available information suggests that the attackers accessed a wide…
-
The Philadelphia Casino Data Breach lawsuit has produced a split federal court decision. A judge allowed a negligence claim against Rivers Casino Philadelphia to continue, while dismissing several other legal theories. Current and former employees, along with casino patrons, filed the case after the casino allegedly discovered unauthorised access to its network. The attackers allegedly…
-
The Mabna Institute charges accuse 17 Iranian nationals of taking part in a years-long campaign to steal academic research, intellectual property and email account data. US prosecutors allege that the group targeted organisations in the United States and several other countries. A 14-count superseding indictment states that the Mabna Institute began operating in 2013. Prosecutors…
-
The Arrayref Rust crate was compromised in a supply-chain attack that deployed infostealer malware on developers’ systems during compilation. Attackers also poisoned the append-only-vec and internment crates during the same short attack window. Arrayref is a widely used Rust library with more than 53 million downloads in the past 90 days. It appears in cryptography,…
-
The Elementor Pro RCE flaw could allow attackers to upload malicious files and execute code on vulnerable WordPress servers. The critical vulnerability affects Elementor Pro versions released before 4.2.2. Tracked as CVE-2026-32475, the issue sits in the plugin’s File Upload module. It affects websites that use an Elementor Pro form with a file-upload field and…
-
New NetScaler security flaws have prompted Citrix to urge administrators to update affected appliances as soon as possible. The two vulnerabilities affect NetScaler Gateway remote-access products and NetScaler ADC networking appliances. The more serious issue, CVE-2026-19490, could allow an unauthenticated remote attacker to bypass authentication under certain conditions. A second flaw, CVE-2026-19489, could let an…