-
The US Justice Department has charged 17 Iranian nationals over an alleged hacking campaign that stole academic research, intellectual property and other proprietary data from organisations around the world. Prosecutors allege that the Mabna Institute hackers carried out the operation for years on behalf of Iran’s Islamic Revolutionary Guard Corps, other Iranian government bodies, universities…
-
The alleged BMW motorcycle data leak involves hundreds of dealership and vehicle documents that the Xpl0itrs ransomware group claims to have stolen and published online. Researchers who reviewed the shared material found that some files were already publicly available, while several broader claims remain unverified. BMW motorcycle data leak includes dealership documents Xpl0itrs listed BMW…
-
A data extortion group claims it stole more than 27 million records from 13 organisations through publicly exposed Microsoft Power Pages portals. Researchers at Fortra say the incident does not appear to involve a vulnerability in Microsoft Dynamics 365. Instead, the available evidence points to Power Pages sites that may have granted anonymous visitors access…
-
An autonomous AI security agent from Wiz found and exploited a Snowflake GitHub Actions flaw that exposed a credential for an internal Jira system. The vulnerability allowed unauthenticated users to run commands by submitting a GitHub issue with a specially crafted title. Snowflake fixed the issue and rotated the affected credential after Wiz reported it.…
-
A tracking device hidden inside a rare book reportedly led journalists to an Amazon facility in Las Vegas where workers scan and dismantle books for AI-related purposes. The investigation raises fresh concerns about how technology companies source training material for artificial intelligence. Critics fear that rare or difficult-to-replace books may be destroyed during the digitisation…
-
A custom Java web shell linked to the Clop ransomware gang was built specifically to steal data from PTC Windchill and FlexPLM servers. Researchers say the malware can decrypt application credentials, search file repositories and retrieve files from compromised servers. Its design suggests that the operators understood Windchill’s internal APIs, database structure and storage system…
-
CISA has warned that ransomware gangs are exploiting a high-severity Windows Task Host flaw that lets attackers gain full control of unpatched Windows devices. The vulnerability affects Windows 11 and Windows Server 2025 systems. Microsoft released a security update in November 2025, but organisations that have not installed it remain exposed. Windows Task Host flaw…
-
Microsoft has confirmed a search outage affecting some Microsoft 365 users across Outlook, SharePoint Online and OneDrive. The issue affects Outlook on the web, the Outlook desktop app, SharePoint Online and OneDrive. Microsoft has linked the disruption to a recent deployment that placed extra pressure on affected infrastructure. Microsoft 365 search outage affects several apps…
-
Microsoft has removed the legacy WMIC command-line tool from new Windows 11 installations, taking away a built-in utility that cybercriminals have repeatedly abused during attacks. The change affects Windows 11 versions 24H2 and 25H2, along with this week’s Windows 11 beta releases. While WMIC is disappearing, the underlying Windows Management Instrumentation platform remains available. Microsoft…
-
Security researchers have disclosed a critical Unisoc modem flaw that could let an attacker compromise certain budget Android phones through a malicious video call. The proof of concept reportedly achieved kernel-level access on test devices from Realme, Xiaomi and Motorola. The research used a controlled VoLTE environment. It remains unclear whether the same attack would…