Privacy/Governance Feed
Reports of email phishing attempts impersonating the UK’s HM Revenue & Customs plummeted in the first half of 2025 – Read More –
Author: Joe-W
Attack Feeds
ShinyHunters reportedly hacked Kering, exposing Gucci, Balenciaga and Alexander McQueen customer data, raising risks of scams and spear… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Privacy/Governance Feed
Jaguar Land Rover (JLR) has confirmed that its pause in production will last until at least Wednesday, September 24 – Read More –
Privacy/Governance Feed
Thales claims there were over 40,000 API incidents in the first half of 2025 – Read More –
Privacy/Governance Feed
An insider data breach at FinWise may have impacted 689,000 customers – Read More –
Privacy/Governance Feed
The new digital personal data protection (DPDP) act, 2023, of India is a major shift in the management of… The post Breaking Down the DPDP Act appeared first on JISA Softech Pvt Ltd. – Read More – JISA Softech Pvt Ltd
Attack Feeds
A team of academics from ETH Zürich and Google has discovered a new variant of a RowHammer attack targeting Double Data Rate 5 (DDR5) memory chips from South Korean semiconductor vendor SK Hynix. The RowHammer attack variant, codenamed Phoenix (CVE-2025-6202, CVSS score: 7.1), is capable of bypassing sophisticated protection mechanisms put in place to resist … Read More “Phoenix RowHammer Attack Bypasses Advanced DDR5 Memory Protections in 109 Seconds – The Hacker News” »
Attack Feeds
Cybersecurity researchers have flagged a fresh software supply chain attack targeting the npm registry that has affected more than 40 packages that belong to multiple maintainers. “The compromised versions include a function (NpmModule.updatePackage) that downloads a package tarball, modifies package.json, injects a local script (bundle.js), repacks the archive, and republishes it, enabling – Read More … Read More “40 npm Packages Compromised in Supply Chain Attack Using bundle.js to Steal Credentials – The Hacker News” »
Alert Feeds
Posted by Apple Product Security via Fulldisclosure on Sep 15 APPLE-SA-09-15-2025-10 visionOS 26 visionOS 26 addresses the following issues. Information about the security content is also available at https://support.apple.com/125115. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. AppleMobileFileIntegrity Available for: Apple Vision Pro Impact: An app … Read More “APPLE-SA-09-15-2025-10 visionOS 26 – Full Disclosure” »
Alert Feeds
Posted by Apple Product Security via Fulldisclosure on Sep 15 APPLE-SA-09-15-2025-11 Safari 26 Safari 26 addresses the following issues. Information about the security content is also available at https://support.apple.com/125113. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Safari Available for: macOS Sonoma and macOS Sequoia Impact: … Read More “APPLE-SA-09-15-2025-11 Safari 26 – Full Disclosure” »
Alert Feeds
Posted by Apple Product Security via Fulldisclosure on Sep 15 APPLE-SA-09-15-2025-12 Xcode 26 Xcode 26 addresses the following issues. Information about the security content is also available at https://support.apple.com/125117. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Dev Tools Available for: macOS Sequoia 15.6 and later … Read More “APPLE-SA-09-15-2025-12 Xcode 26 – Full Disclosure” »
Alert Feeds
Posted by Apple Product Security via Fulldisclosure on Sep 15 APPLE-SA-09-15-2025-7 macOS Sonoma 14.8 macOS Sonoma 14.8 addresses the following issues. Information about the security content is also available at https://support.apple.com/125112. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. AMD Available for: macOS Sonoma Impact: An … Read More “APPLE-SA-09-15-2025-7 macOS Sonoma 14.8 – Full Disclosure” »
Alert Feeds
Posted by Apple Product Security via Fulldisclosure on Sep 15 APPLE-SA-09-15-2025-8 tvOS 26 tvOS 26 addresses the following issues. Information about the security content is also available at https://support.apple.com/125114. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Apple Neural Engine Available for: Apple TV 4K (2nd … Read More “APPLE-SA-09-15-2025-8 tvOS 26 – Full Disclosure” »
Alert Feeds
Posted by Apple Product Security via Fulldisclosure on Sep 15 APPLE-SA-09-15-2025-9 watchOS 26 watchOS 26 addresses the following issues. Information about the security content is also available at https://support.apple.com/125116. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Apple Neural Engine Available for: Apple Watch Series 9 … Read More “APPLE-SA-09-15-2025-9 watchOS 26 – Full Disclosure” »
Alert Feeds
Posted by Ron E on Sep 15 Multiple functions in libvips invoke callbacks through incorrectly cast function pointers, resulting in Undefined Behavior (UB). During runtime, callbacks such as search_package, vips_class_map_all, vips_foreign_find_load_sub, vips_object_real_postbuild, and vips_area_free_cb are called through function pointer types that do not match their actual signatures. This is benign on x86-64, where calling … Read More “libvips v8.18.0 Function Pointer Type Confusion in libvips Callback Dispatch – Full Disclosure” »
Alert Feeds
Posted by Ron E on Sep 15 An integer overflow vulnerability exists in the LZX decompression routines of CHMLib (tested in version 0.40, latest release as of 2025). The issue occurs within lzx.c during bitstream parsing (lzx_read_lens and LZXdecompress), where crafted CHM files can supply values that cause left-shift operations to exceed the representable … Read More “CHMLIB 0.40a Integer Overflow in LZX Decompression of CHMLib – Full Disclosure” »
Alert Feeds
Posted by Ron E on Sep 15 A vulnerability exists in CHMLib (latest release 0.40) when parsing malformed CHM (Compiled HTML Help) files. The functions _unmarshal_int32 and _unmarshal_uint32 reconstruct 32-bit values using left shifts on signed integers without proper type casting: *dest = (*pData)[0] | (*pData)[1]<<8 | (*pData)[2]<<16 | (*pData)[3]<<24; If an attacker supplies … Read More “CHMLib 0.40a Integer Overflow in _unmarshal_int32 / _unmarshal_uint32 During CHM Header Parsing – Full Disclosure” »
Alert Feeds
Posted by Ron E on Sep 15 libwmf is vulnerable to an integer overflow / undefined behavior condition in multiple code paths. The affected source files (wmf.c, fig.c, svg.c) use left-shift operations on signed integers that shift into the sign bit (e.g., 1 << 31). According to the C standard, shifting a signed integer … Read More “libwmf v0.2.13 Integer Overflow in libwmf Left-Shift Operations (wmf.c, fig.c, svg.c) – Full Disclosure” »
Alert Feeds
Posted by Apple Product Security via Fulldisclosure on Sep 15 APPLE-SA-09-15-2025-1 iOS 26 and iPadOS 26 iOS 26 and iPadOS 26 addresses the following issues. Information about the security content is also available at https://support.apple.com/125108. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Apple Neural Engine … Read More “APPLE-SA-09-15-2025-1 iOS 26 and iPadOS 26 – Full Disclosure” »
Alert Feeds
Posted by Apple Product Security via Fulldisclosure on Sep 15 APPLE-SA-09-15-2025-2 iOS 18.7 and iPadOS 18.7 iOS 18.7 and iPadOS 18.7 addresses the following issues. Information about the security content is also available at https://support.apple.com/125109. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Audio Available for: … Read More “APPLE-SA-09-15-2025-2 iOS 18.7 and iPadOS 18.7 – Full Disclosure” »
Alert Feeds
Posted by Apple Product Security via Fulldisclosure on Sep 15 APPLE-SA-09-15-2025-3 iOS 16.7.12 and iPadOS 16.7.12 iOS 16.7.12 and iPadOS 16.7.12 addresses the following issues. Information about the security content is also available at https://support.apple.com/125141. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. ImageIO Available for: … Read More “APPLE-SA-09-15-2025-3 iOS 16.7.12 and iPadOS 16.7.12 – Full Disclosure” »
Alert Feeds
Posted by Apple Product Security via Fulldisclosure on Sep 15 APPLE-SA-09-15-2025-4 iOS 15.8.5 and iPadOS 15.8.5 iOS 15.8.5 and iPadOS 15.8.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/125142. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. ImageIO Available for: … Read More “APPLE-SA-09-15-2025-4 iOS 15.8.5 and iPadOS 15.8.5 – Full Disclosure” »
Alert Feeds
Posted by Apple Product Security via Fulldisclosure on Sep 15 APPLE-SA-09-15-2025-5 macOS Tahoe 26 macOS Tahoe 26 addresses the following issues. Information about the security content is also available at https://support.apple.com/125110. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Airport Available for: Mac Studio (2022 and … Read More “APPLE-SA-09-15-2025-5 macOS Tahoe 26 – Full Disclosure” »
Alert Feeds
Posted by Apple Product Security via Fulldisclosure on Sep 15 APPLE-SA-09-15-2025-6 macOS Sequoia 15.7 macOS Sequoia 15.7 addresses the following issues. Information about the security content is also available at https://support.apple.com/125111. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. AMD Available for: macOS Sequoia Impact: An … Read More “APPLE-SA-09-15-2025-6 macOS Sequoia 15.7 – Full Disclosure” »
Attack Feeds
Both OpenAI and Anthropic said earlier this month they are working with the U.S. and U.K. governments to bolster the safety and security of their commercial large language models in order to make them harder to abuse or misuse. In a pair of blogs posted to their websites Friday, the companies said for the past … Read More “Top AI companies have spent months working with US, UK governments on model safety – CyberScoop” »
Attack Feeds
China-linked AI tool Villager, published on PyPI, automates cyberattacks and has got experts worried after 10,000 downloads in… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Mustang Panda Deploys SnakeDisk USB Worm to Deliver Yokai Backdoor on Thailand IPs – The Hacker News
Attack Feeds
The China-aligned threat actor known as Mustang Panda has been observed using an updated version of a backdoor called TONESHELL and a previously undocumented USB worm called SnakeDisk. “The worm only executes on devices with Thailand-based IP addresses and drops the Yokai backdoor,” IBM X-Force researchers Golo Mühr and Joshua Chung said in an analysis … Read More “Mustang Panda Deploys SnakeDisk USB Worm to Deliver Yokai Backdoor on Thailand IPs – The Hacker News” »
Attack Feeds
North Korea’s Kimsuky hackers use AI-generated fake military IDs in a new phishing campaign, GSC warns, marking a… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Privacy/Governance Feed
HybridPetya ransomware mimics Petya/NotPetya, with an added UEFI bootkit and Secure Boot bypass – Read More –
Privacy/Governance Feed
SEO poisoning attack has been observed targeting Chinese Windows users via lookalike domains, installing Hiddengh0st and Winos – Read More –
Attack Feeds
Earlier this week, Aikido Security disclosed what is being described as the largest npm supply chain compromise to date. Attackers successfully injected malicious code into 18 popular npm packages, collectively accounting for more than 2.6 billion weekly downloads. The entire campaign began not with a technical exploit, but with a single, well-trained maintainer clicking on … Read More “When ‘minimal impact’ isn’t reassuring: lessons from the largest npm supply chain compromise – CyberScoop” »
Attack Feeds
New research from Red Canary and Zscaler shows phishing lures now drop RMM tools like ITarian and Atera,… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Attack Feeds
In a world where threats are persistent, the modern CISO’s real job isn’t just to secure technology—it’s to preserve institutional trust and ensure business continuity. This week, we saw a clear pattern: adversaries are targeting the complex relationships that hold businesses together, from supply chains to strategic partnerships. With new regulations and the rise of … Read More “⚡ Weekly Recap: Bootkit Malware, AI-Powered Attacks, Supply Chain Breaches, Zero-Days & More – The Hacker News” »
Attack Feeds
Attacks that target users in their web browsers have seen an unprecedented rise in recent years. In this article, we’ll explore what a “browser-based attack” is, and why they’re proving to be so effective. What is a browser-based attack? First, it’s important to establish what a browser-based attack is. In most scenarios, attackers don’t think … Read More “6 Browser-Based Attacks Security Teams Need to Prepare For Right Now – The Hacker News” »
Privacy/Governance Feed
Genians observed the Kimsuky group impersonate a defense institution in a spear-phishing attack, leveraging ChatGPT to create fake military ID cards – Read More –
Privacy/Governance Feed
US Department of Homeland Security OIG claims CISA mismanaged a key cyber retention incentive program – Read More –
Privacy/Governance Feed
Threat actors are using multiple lures to trick users into installing RMM tools – Read More –
Attack Feeds
A new artificial intelligence (AI)-powered penetration testing tool linked to a China-based company has attracted nearly 11,000 downloads on the Python Package Index (PyPI) repository, raising concerns that it could be repurposed by cybercriminals for malicious purposes. Dubbed Villager, the framework is assessed to be the work of Cyberspike, which has positioned the tools as … Read More “AI-Powered Villager Pen Testing Tool Hits 11,000 PyPI Downloads Amid Abuse Concerns – The Hacker News” »
Privacy/Governance Feed
Artificial Intelligence (AI) has been the buzzword in the fintech industry more than ten years now. However, as the… The post What augmented intelligence really means for fintech leaders appeared first on JISA Softech Pvt Ltd. – Read More – JISA Softech Pvt Ltd
Attack Feeds
Chinese-speaking users are the target of a search engine optimization (SEO) poisoning campaign that uses fake software sites to distribute malware. “The attackers manipulated search rankings with SEO plugins and registered lookalike domains that closely mimicked legitimate software sites,” Fortinet FortiGuard Labs researcher Pei Han Liao said. “By using convincing language and small character – … Read More “HiddenGh0st, Winos and kkRAT Exploit SEO, GitHub Pages in Chinese Malware Attacks – The Hacker News” »
Attack Feeds
Samsung patched CVE-2025-21043, a critical flaw in its Android devices exploited in live attacks. Users urged to install September 2025 update. – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Attack Feeds
Hackers leaked 600 GB of data linked to the Great Firewall of China, exposing documents, code, and operations.… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Attack Feeds
Qrator Labs blocked a record L7 DDoS attack from a 5.76M-device botnet targeting government systems, showing rapid global growth since March. – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Attack Feeds
Gone are the days when cyber criminals sat in a basement with poor attempts at stealing information. Today’s threat actors are organized, sophisticated, and have the latest technologies needed to profit from their thefts. South Africa has been one of the hardest hit when it comes to the newest criminal efforts. “Smishing” now leads the … Read More “Sophisticated “Smishing” hackers Steal Credit Card Information – Da Vinci Cybersecurity: Leading Cyber Security Services in South Africa.” »
Attack Feeds
Okta Threat Intelligence exposes VoidProxy, a new PhaaS platform. Learn how this advanced service uses the Adversary-in-the-Middle technique… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Attack Feeds
The U.S. Federal Bureau of Investigation (FBI) has issued a flash alert to release indicators of compromise (IoCs) associated with two cybercriminal groups tracked as UNC6040 and UNC6395 for a string of data theft and extortion attacks. “Both groups have recently been observed targeting organizations’ Salesforce platforms via different initial access mechanisms,” the FBI said. … Read More “FBI Warns of UNC6040 and UNC6395 Targeting Salesforce Platforms in Data Theft Attacks – The Hacker News” »
Attack Feeds
New SEO poisoning campaign exposed! FortiGuard Labs reveals how attackers trick users with fake websites to deliver Hiddengh0st… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Attack Feeds
Researchers and authorities are warning that Akira ransomware attacks involving exploits of a year-old vulnerability affecting SonicWall firewalls are on the rise. A burst of about 40 attacks linked to CVE-2024-40766 hit SonicWall firewalls between mid-July and early August. Researchers have since observed another wave of ransomware attacks linked to active exploits of the defect, … Read More “SonicWall firewalls targeted by fresh Akira ransomware surge – CyberScoop” »
Attack Feeds
The post DHS watchdog finds mismanagement in critical cyber talent program appeared first on CyberScoop. – Read More – CyberScoop
Attack Feeds
Passengers of the UK’s state-owned London North Eastern Railway (LNER) have been warned to be vigilant after cybercriminals accessed traveller’s contact details and some information about past journeys. Read more in my article on the Hot for Security blog. – Read More – Graham Cluley