12+ hour, 6+ min ago   (499+ words) ASOS says attackers used credentials stolen elsewhere to access customer accounts, exposing personal data belonging to an estimated 138,828 people. ASOS says attackers used login credentials obtained outside the company to access customer accounts, exposing personal information belonging to an estimated…...

16+ hour, 26+ min ago   (955+ words) JFrog finds AI development tools are expanding the software supply chain and creating new attack paths for organizations. For most of my career, software supply chain security meant scrutinizing what developers pull in: dependencies, base images, third-party packages. That framing…...

1+ day, 3+ hour ago   (613+ words) Trust is becoming the attack surface. Today’s threats are exploiting everything from forgotten cloud credentials and convincing phishing lures to trusted software and nearby devices. Read past newsletters here. Thousands of Leaked AWS Keys Still Work Thousands of publicly exposed…...

1+ day, 13+ hour ago   (656+ words) ToxicPanda 2.0 now targets 349 financial apps across 16 countries while abusing VPN, Accessibility and Android debugging features for deeper control. ToxicPanda 2.0 is giving attackers deeper remote control over infected Android phones, including a new way to keep Google Play out of the…...

1+ day, 11+ hour ago   (705+ words) Kaspersky uncovered malware spreading via software updates on Android-based car head units, turning infected systems into proxy nodes in a botnet. Your car’s software update is supposed to fix problems, not quietly recruit its infotainment system into a botnet. Kaspersky…...

5+ day, 15+ hour ago   (472+ words) Microsoft patched an Entra ID RCE vulnerability exploited in attacks that required no authentication or user interaction. A maximum-severity vulnerability in Microsoft Entra ID allowed unauthenticated attackers to remotely execute code and was exploited in attacks before Microsoft mitigated the…...

5+ day, 15+ hour ago   (151+ words) Federal courts will report spyware authorizations: Beginning with 2028 data published in 2029, the annual U.S. Wiretap Report will include a category for spyware and hacking. The change will create a public tracking baseline, but it will not identify individual operations, include pre…...

5+ day, 9+ hour ago   (517+ words) Some threats call for patches. Others call for cutting the cable. Today’s news spans over 900 Oracle patches, exposed gateways, evolving infostealers, AI hitting the brakes, and a telecom defense that took “disconnect the threat” quite literally. Read past newsletters here....

5+ day, 17+ hour ago   (604+ words) Alation confirms unauthorized activity in one of its systems, leaving key questions about customer exposure, stolen data, and the attack’s scope. Alation has confirmed unauthorized activity inside its systems, turning an earlier service disruption into a much bigger security question....

6+ day, 9+ hour ago   (636+ words) Researchers used a remote Spectre attack to leak a JWT between co-located Cloudflare Workers. Cloudflare says the technique is now mitigated. A remote Spectre attack successfully pulled a JWT from a co-located Cloudflare Worker, showing how CPU side channels can…...