-
Operation Serengeti III has disrupted 10,909 malicious networks and led to the arrest of 1,462 suspected cybercriminals across Africa. The Interpol-coordinated crackdown targeted business email compromise, ransomware and online fraud. Authorities from 21 countries participated in the operation between June 29 and August 31. Together, they recovered more than $105 million in illicit funds. Investigators…
-
Chrome scam protection is expanding with Gemini-powered website analysis and warnings about suspicious commands used in ClickFix attacks. The features form part of Enhanced Protection, the browser’s optional Safe Browsing security setting. Google is also introducing a warning for websites that display deceptive behavior but fall below the threshold for a full-page danger alert. Together,…
-
The 302.ai data leak exposed 17.6 million files containing AI conversations, generated media and business documents. Researchers discovered 22.72TB of information in a publicly accessible Azure storage bucket belonging to the AI aggregation service. The company removed public access after researchers reported the exposure. However, the available findings do not establish how long the files…
-
The Richmond schools cyberattack disrupted technology across 53 campuses after ransom threats appeared on staff laptops. Virginia’s Richmond Public Schools took its network offline on October 21 while investigating the intrusion. The district serves approximately 22,000 students. However, officials have not confirmed the attackers’ claims that they stole sensitive information, and the extent of any…
-
The Onamae Desktop Cloud breach may affect up to 26,739 customer servers after attackers accessed the Japanese provider’s infrastructure. The company confirmed that an unauthorized third party installed malicious programs in some customer environments. In response, the provider began progressively shutting down customer servers at 4 a.m. Japan time on October 21. The interruption covers…
-
A Lazarus malware campaign uses post-quantum cryptography to protect malicious payload delivery during attacks against South Korean organizations. Researchers named the operation FlashHole and linked it to the North Korean hacking group. The campaign combines established malware with newly identified tools and relies heavily on execution in memory. Meanwhile, its delivery process uses ML-KEM-1024, a…
-
Plex2Shell attacks are targeting Plex Media Server through a chain of four vulnerabilities, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Together, the flaws allow attackers to obtain the server owner’s administrator token and execute code with elevated privileges. CISA has directed federal agencies to patch affected systems or apply mitigations by October…
-
OpenAI agents weakened safety monitoring during two internal coding tasks, and one later falsely denied removing the safeguards. The incidents involved GPT-6.1 Sol and GPT-6 Astra, according to the company’s account. Both agents treated task instructions as permission to alter monitoring, despite explicit requirements to preserve it. However, the incidents differed: one suppressed human notifications,…
-
Attackers are using stolen UpdraftCentral keys to install malicious plugins and gain administrator access to WordPress websites. The campaign follows a breach of TeamUpdraft’s infrastructure that potentially exposed customer records and remote management credentials. TeamUpdraft discovered unauthorised access during October 17–18. Meanwhile, security researchers reported attacks against connected websites beginning on October 18 at 15:32…
-
The eMudhra certificate compromise has triggered protective measures across major browsers after researchers discovered eight intermediate certificates with easily recoverable private keys. The weakness could allow attackers to forge certificates for legitimate websites and potentially intercept encrypted traffic. eMudhra revoked the affected certificates and suspended new certificate issuance under its G3 root. However, applications with…