Tag: data
-
LookOut: Discovering RCE and Internal Access on Looker (Google Cloud On-Prem)
Tenable Research discovered two novel vulnerabilities in Google Looker that could allow an attacker to completely compromise a Looker instance. Google moved swiftly to patch these issues. Organizations running Looker on-prem should verify they have upgraded to the patched versions. Key takeaways Two novel vulnerabilities: Tenable Research discovered a remote code execution (RCE) chain via…
-
Why Moltbook Changes the Enterprise Security Conversation
For several years, enterprise security teams have concentrated on a well-established range of risks, including users clicking potentially harmful links, employees uploading data to SaaS applications, developers inadvertently disclosing credentials on platforms like GitHub, and chatbots revealing sensitive information. However, a notable shift is emerging”, one that operates independently of user actions. Artificial intelligence agents…
-
Big Breach or Smooth Sailing? Mexican Gov’t Faces Leak Allegations
A hacktivist group claims a 2.3-terabyte data breach exposes the information of 36 million Mexicans, but no sensitive accounts are at risk, says government. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/big-breach-or-nada-de-nada-mexican-govt-faces-leak-allegations
-
Big Breach or Nada de Nada? Mexican Gov’t Faces Leak Allegations
A hacktivist group claims a 2.3-terabyte data breach exposes the information of 36 million Mexicans, but no sensitive accounts are at risk, says government. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/big-breach-or-nada-de-nada-mexican-govt-faces-leak-allegations
-
Russian hackers exploited a critical Office bug within days of disclosure
One campaign, two infection paths: ZScaler found that exploitation of CVE-2026-21509 did not lead to a single uniform payload. Instead, the initial RTF-based exploit branched into two distinct infection paths, each serving a different operational purpose. The choice of dropper reportedly determined whether the attackers prioritized near-term intelligence collection or longer-term access to compromised systems.In…
-
Coinbase confirms insider breach linked to leaked support tool screenshots
Coinbase has confirmed an insider breach after a contractor improperly accessed the data of approximately thirty customers, which BleepingComputer has learned is a new incident that occurred in December. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/coinbase-confirms-insider-breach-linked-to-leaked-support-tool-screenshots/
-
AI Governance Explained: How to Control Risk, Stay Compliant, and Scale AI Safely in 2026
Author : Karunakar Goud RGDate Published : February, 04, 2026 AI Governance Explained: How to Control Risk, Stay Compliant, and Scale AI Safely in 2026 Artificial intelligence is no longer experimental. By 2026, AI systems are embedded in customer support, security operations, decision-making, and product development. As AI adoption accelerates, AI governance has become a…The…
-
Wiederherstellbarkeit von Backups automatisiert prüfen und absichern
Der Anbieter von Softwarelösungen für Business-Continuity, IT-Resilienz und Systemwiederherstellung, Cristie Data, präsentiert den <>. Mit der neuen Softwarelösung lassen sich Backup- und Wiederherstellungsprozesse automatisiert überprüfen. Der Cristie-Resilience-Booster scannt Wiederherstellungen kontinuierlich auf Bedrohungen und stellt sicher, dass Daten nicht nur gesichert, sondern im Ernstfall auch zuverlässig und sauber wiederhergestellt werden können. Dabei arbeitet die […] First…
-
Universal £7,500 payout offered to PSNI staff over major data breach
Affected police officers squeezed mental health services, relocated over safety fears First seen on theregister.com Jump to article: www.theregister.com/2026/02/04/psni_breach_compensation/
-
Critical ASUSTOR NAS Security Flaw Enables Complete Device Takeover
A severe vulnerability affecting ASUSTOR Network Attached Storage (NAS) devices has been disclosed, potentially allowing unauthenticated attackers to seize full control of affected systems. Tracked as CVE-2026-24936, this critical flaw carries a CVSS v4.0 base score of 9.5, highlighting the urgency for administrators to apply available updates immediately. The vulnerability resides within the ASUSTOR Data Master (ADM)…
-
Google Looker Bugs Allow Cross-Tenant RCE, Data Exfil
Attackers could even have used one vulnerable Lookout user to gain access to other GCP tenants’ environments. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/google-looker-bugs-cross-tenant-rce-data-exfil
-
Zero trust in practice: A deep technical dive into going fully passwordless in hybrid enterprise environments
Tags: access, attack, authentication, backup, breach, business, cloud, compliance, credentials, cybersecurity, data, endpoint, group, Hardware, identity, infrastructure, lessons-learned, network, password, phishing, phone, risk, service, technology, update, windows, zero-trustArchitecture decisions: Hybrid authentication flows and Windows Hello for Business: Once your prerequisites are in place, you face critical architectural decisions that will shape your deployment for years to come. The primary decision point is whether to use Windows Hello for Business, FIDO2 security keys or phone sign-in as your primary authentication mechanism.In my experience,…
-
Why Zero-Day Downstream Mass Data Extortion Campaigns are Losing Their Bite
Are we seeing the extinction of mass data exfiltration campaigns? The stats demonstrate these attacks are losing their efficacy. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/why-zero-day-downstream-mass-data-extortion-campaigns-are-losing-their-bite/
-
Hackers Exfiltrate NTDS.dit File, Gain Full Control of Active Directory Environments
Active Directory serves as the central repository for an organization’s authentication infrastructure, making it a prime target for sophisticated threat actors. The NTDS.dit database, which stores encrypted password hashes and critical domain configuration data, is the crown jewel of enterprise security. Successful acquisition of this file can lead to complete organizational compromise, enabling attackers to…
-
AI is Supercharging Work…and Your Attack Surface
AI boosts productivity, but weak data governance and shadow AI are expanding the enterprise attack surface. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/ai-is-supercharging-work-and-your-attack-surface/
-
Lakelands Public Health Confirms Cyberattack, Says Sensitive Data Unaffected
Lakelands Public Health has confirmed that it is actively responding to a cyberattack discovered on January 29, 2026, which affected some of its internal systems. The organization is sharing information about the Lakelands Public Health cyberattack incident proactively to maintain transparency and public trust. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/lakelands-public-health-cyberattack/
-
CISA Adds SolarWinds Web Help Desk RCE Flaw to Known Exploited Vulnerabilities List
Tags: cisa, cyber, cybersecurity, data, exploit, flaw, infrastructure, kev, rce, remote-code-execution, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a newly disclosed vulnerability CVE”‘2025″‘40551 affecting SolarWinds Web Help Desk (WHD) to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is rated critical because it enables remote code execution (RCE) and can be exploited without authentication. According to CISA, the issue stems from a deserialization of untrusted data weakness (CWE”‘502), which allows attackers…
-
CISA Adds Actively Exploited SolarWinds Web Help Desk RCE to KEV Catalog
Tags: cisa, cve, cybersecurity, data, exploit, flaw, infrastructure, kev, rce, remote-code-execution, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a critical security flaw impacting SolarWinds Web Help Desk (WHD) to its Known Exploited Vulnerabilities (KEV) catalog, flagging it as actively exploited in attacks.The vulnerability, tracked as CVE-2025-40551 (CVSS score: 9.8), is a untrusted data deserialization vulnerability that could pave the way for remote…
-
Global Threat Map: Open-source real-time situational awareness platform
Global Threat Map is an open-source project offering security teams a live view of reported cyber activity across the globe, pulling together open data feeds into a single … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/04/global-threat-map-open-source-osint/
-
Are your secrets safe from cyber threats
How Do Non-Human Identities Reinforce Data Protection? How does one ensure that machine identities remain secure from cyber threats? This query emerges as organizations navigate the intricate web of digital systems, grappling with data protection complexities. The management of Non-Human Identities (NHIs) stands at the forefront of cybersecurity strategies, offering a robust method to safeguard……
-
What ensures NHI are protected in cloud platforms
What Makes Non-Human Identities Critical for Cloud Security? Have you considered how organizations can effectively secure their digital assets in cloud platforms? While we delve deeper into the digital space, the focus on securing data through robust Non-Human Identity (NHI) management has become paramount. NHIs, which are essentially machine identities, play a pivotal role in……
-
Chinese Money Laundering Jargon via Google’s Gemini
After having a short discussion with Gemini about Chinese Money Laundering, I could tell we weren’t quite connecting on my Mandarin-assistance requests, so I shared an example post from a Telegram “Crime-as-a-Service” group that was part of a Chinese Guarantee Syndicate. For context, these posts were made in the Tudou Guarantee Syndicate’s group dedicated to…
-
DataDome Integrates Bot Protection with Varnish Software’s New Sovereign CDN
DataDome’s AI-powered bot protection now integrates with Varnish CDN’s European infrastructure”, delivering real-time security and full data sovereignty. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/datadome-integrates-bot-protection-with-varnish-softwares-new-sovereign-cdn/
-
Fake Compliance Emails Weaponize Word and PDF Attachments to Steal Sensitive Data
A newly observed phishing campaign is abusing fake “audit/compliance confirmation” emails to target macOS users and steal highly sensitive data. The campaign uses convincing business-themed lures and malicious attachments that masquerade as Word or PDF files to trick employees into executing an AppleScript-based payload. Attackers begin by sending emails asking recipients to “confirm the company’s…
-
NDSS 2025 BinEnhance
Tags: china, conference, data, detection, framework, Internet, network, software, technology, vulnerabilitySession 11B: Binary Analysis Authors, Creators & Presenters: Yongpan Wang (Institute of Information Engineering Chinese Academy of Sciences & University of Chinese Academy of Sciences, China), Hong Li (Institute of Information Engineering Chinese Academy of Sciences & University of Chinese Academy of Sciences, China), Xiaojie Zhu (King Abdullah University of Science and Technology, Thuwal, Saudi…
-
NDSS 2025 Beyond Classification
Session 11B: Binary Analysis Authors, Creators & Presenters: Linxi Jiang (The Ohio State University), Xin Jin (The Ohio State University), Zhiqiang Lin (The Ohio State University) PAPER Beyond Classification: Inferring Function Names in Stripped Binaries via Domain Adapted LLMs Function name inference in stripped binaries is an important yet challenging task for many security applications,…
-
How to mitigate the risk of a data breach in non-production environments
Non-production environments are often overlooked when it comes to data security, but they can be just as vulnerable to breaches as production systems. Learn how to keep them protected. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/how-to-mitigate-the-risk-of-a-data-breach-in-non-production-environments/