Tag: data
-
Cisco ISE Vulnerability Enables Access to Sensitive Data
Cisco has disclosed a new XML External Entity (XXE) vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) that could allow authenticated attackers with administrative access to read sensitive data from the underlying operating system. The vulnerability is tracked as CVE-2026-20029 and is rated CVSS 4.9 (medium severity), but its…
-
ChatGPT Health: A New Secure Space for Trusted Health and Medical Conversations
ChatGPT Health is launching as a dedicated health-focused version of ChatGPT that combines personalized health data with strongerprivacy and securitycontrols to supportnotreplaceconversations with clinicians. The new experience isolates health chats, encrypts data withadditionalprotections, and allows users to securely connect medical records and wellness apps so responses are more adapt to their real health history.”‹ WhatChatGPT…
-
Cisco Snort 3 Vulnerability Leading to Sensitive Data Disclosure
Cisco has disclosed two critical vulnerabilities in the Snort 3 detection engine affecting multiple enterprise security products, including firewalls, threat defense systems, and edge platforms. The vulnerabilities, tracked as CVE-2026-20026 and CVE-2026-20027 under advisory cisco-sa-snort3-dcerpc-vulns-J9HNF4tH, could allow unauthenticated remote attackers to leak sensitive information or cause denial-of-service conditions by disrupting packet inspection capabilities. The vulnerabilities…
-
How Attackers Hide Processes by Abusing Kernel Patch Protection
Security researchers have identified a sophisticated technique that allows attackers to hide malicious processes from Windows Task Manager and system monitoring tools, even on systems with Microsoft’s most advanced kernel protections enabled. The bypass leverages legitimate Windows APIs to manipulate core data structures before integrity checks can detect tampering, circumventing both PatchGuard and Hypervisor-Protected Code…
-
New Zero-Click Attack Lets ChatGPT User Steal Data
Researchers at Radware discovered new prompt injection attacks in ChatGPT agentic features First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/new-zeroclick-attack-chatgpt/
-
Discord Controlled NodeCordRAT Steals Chrome Data via NPM Packages
Zscaler ThreatLabz identifies three malicious NPM packages mimicking Bitcoin libraries. The NodeCordRAT virus uses Discord commands to exfiltrate MetaMask data and Chrome passwords. First seen on hackread.com Jump to article: hackread.com/discord-nodecordrat-steal-chrome-data-npm-packages/
-
Zero-Knowledge Compliance: How Privacy-Preserving Verification Is Transforming Regulatory Technology
Traditional compliance often forces companies to expose sensitive information to prove they follow the rules. This approach increases the risk of breaches and raises severe privacy concerns. With rising regulatory pressure and stricter data sovereignty laws, more organizations are exploring zero-knowledge frameworks as a safer alternative. Zero-knowledge proofs (ZKPs) allow businesses to prove adherence without..…
-
ChatGPT falls to new data-pilfering attack as a vicious cycle in AI continues
Will LLMs ever be able to stamp out the root cause of these attacks? Possibly not. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/01/chatgpt-falls-to-new-data-pilfering-attack-as-a-vicious-cycle-in-ai-continues/
-
pcTattletale Founder Bryan Fleming Pleads Guilty in Federal Stalkerware Case
Bryan Fleming, founder of pcTattletale, pleads guilty in a landmark federal spying case. Read how an undercover HSI sting and a data breach ended a decade of illegal stalkerware sales. First seen on hackread.com Jump to article: hackread.com/pctattletale-stalkerware-founder-bryan-fleming-guilty/
-
Turning Data Security into the Defining MSP Opportunity of 2026
CEO perspective on how DSPM gives MSPs continuous data visibility, proves client value, reduces churn, and grows recurring security revenue. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/01/turning-data-security-into-the-defining-msp-opportunity-of-2026/
-
Researchers Poison Stolen Data to Sabotage AI Model Accuracy
A groundbreaking cybersecurity research team has developed a novel defensive technique that renders stolen artificial intelligence databases virtually useless to attackers by deliberately poisoning proprietary knowledge graphs with plausible yet false information.”‹ The research, conducted by scientists from the Institute of Information Engineering at the Chinese Academy of Sciences, National University of Singapore, and Nanyang…
-
OpenAI Launches ChatGPT Health with Isolated, Encrypted Health Data Controls
Artificial intelligence (AI) company OpenAI on Wednesday announced the launch of ChatGPT Health, a dedicated space that allows users to have conversations with the chatbot about their health.To that end, the sandboxed experience offers users the optional ability to securely connect medical records and wellness apps, including Apple Health, Function, MyFitnessPal, Weight Watchers, AllTrails, First…
-
Ransomware Hits a Claims Giant: What the Sedgwick Breach Reveals About Modern Extortion Attacks
A recent breach disclosure reveals that claims management firm Sedgwick was targeted by the TridentLocker ransomware group, with attackers claiming to have exfiltrated sensitive data from systems supporting its government services operations before deploying ransomware, according to Cybersecurity News. While Sedgwick has not disclosed full technical details, the incident follows a well-established ransomware playbook. Attackers…
-
Holes in Veeam Backup suite allow remote code execution, creation of malicious backup config files
Tags: access, backup, credentials, cve, cvss, cybersecurity, data, exploit, jobs, malicious, monitoring, password, ransomware, remote-code-execution, risk, risk-management, sans, threat, update, veeam, vulnerabilityCVE-2025-59470 (with a CVSS score of 9) allows a Backup or Tape Operator to perform remote code execution (RCE) as the Postgres user by sending a malicious interval or order parameter;CVE-2025-59469 (with a severity score of 7.2) allows a Backup or Tape Operator to write files as root;CVE-2025-55125 (with a severity score of 7.2) allows a Backup…
-
How secure is your data with Agentic AI?
Are Non-Human Identities the Key to Unlocking Data Security with Agentic AI? Where data security is paramount, many organizations grapple with the potential vulnerabilities that Agentic AI might introduce if not managed properly. Central to this discussion is the role of Non-Human Identities (NHIs) and Secrets Security Management”, a subject demanding the attention of cybersecurity…
-
Critical jsPDF flaw lets hackers steal secrets via generated PDFs
The jsPDF library for generating PDF documents in JavaScript applications is vulnerable to a critical vulnerability that allows an attacker to steal sensitive data from the local filesystem by including it in generated files. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-jspdf-flaw-lets-hackers-steal-secrets-via-generated-pdfs/
-
Illinois state agency exposed personal data of 700,000 people
The Illinois Department of Human Services exposed personal information belonging to more than 700,000 state residents after inadvertently posting the data on the open internet where it remained for as long as four years before being taken down in September. First seen on therecord.media Jump to article: therecord.media/illinois-agency-exposed-data
-
900,000 Users Hit as Malicious Chrome Extensions Steal ChatGPT, DeepSeek Chats
OX Security reveals how malicious Chrome extensions exposed AI chats from ChatGPT and DeepSeek, silently siphoning sensitive data from 900,000 users. The post 900,000 Users Hit as Malicious Chrome Extensions Steal ChatGPT, DeepSeek Chats appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-900k-users-chrome-extensions-steal-chatgpt-deepseek-chats/
-
ChatGPT is losing market share as Google Gemini gains ground
New data suggests that ChatGPT is losing its market share to Gemini on the web. It’s unclear if Gemini is also gaining ground in the mobile space. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/artificial-intelligence/chatgpt-is-losing-market-share-as-google-gemini-gains-ground/
-
Spanish airline Iberia attributes recent data breach claims to November incident
A spokesperson said the information relates to an incident that came to light in November, when a threat actor demanded $150,000 for allegedly stolen data. First seen on therecord.media Jump to article: therecord.media/spanish-airline-attributes-recent-breach-allegation-to-nov-incident
-
Randall Munroe’s XKCD ‘Fishing’
Tags: datavia the comic artistry and dry wit of Randall Munroe, creator of XKCD Permalink First seen on securityboulevard.com Jump to article: https://securityboulevard.com/2026/01/randall-munroes-xkcd-fishing/
-
Malicious NPM Packages Deliver NodeCordRAT
IntroductionZscaler ThreatLabz regularly monitors the npm database for suspicious packages. In November 2025, ThreatLabz identified three malicious packages: bitcoin-main-lib, bitcoin-lib-js, and bip40. The bitcoin-main-lib and bitcoin-lib-js packages execute a postinstall.cjs script during installation, which installs bip40, the package that contains the malicious payload. This final payload, named NodeCordRAT by ThreatLabz, is a remote access trojan (RAT) with data-stealing capabilities. It is also possible to download bip40…
-
Malicious NPM Packages Deliver NodeCordRAT
IntroductionZscaler ThreatLabz regularly monitors the npm database for suspicious packages. In November 2025, ThreatLabz identified three malicious packages: bitcoin-main-lib, bitcoin-lib-js, and bip40. The bitcoin-main-lib and bitcoin-lib-js packages execute a postinstall.cjs script during installation, which installs bip40, the package that contains the malicious payload. This final payload, named NodeCordRAT by ThreatLabz, is a remote access trojan (RAT) with data-stealing capabilities. It is also possible to download bip40…
-
Critical RCE flaw allows full takeover of n8n AI workflow platform
Tags: ai, api, attack, authentication, cloud, credentials, data, email, exploit, flaw, leak, LLM, password, rce, remote-code-execution, threat, vulnerabilityformWebhook function used by n8n Form nodes to receive data doesn’t validate whether the Content-Type field of the POST request submitted by the user is set to multipart/form-data.Imagine a very common use case in which n8n has been used to build a chat interface that allows users to upload files to the system, for example,…
-
Researchers poison stolen data to make AI systems return wrong results
Wanted: Chief Disinformation Officer to pollute company knowledge graphs First seen on theregister.com Jump to article: www.theregister.com/2026/01/06/ai_data_pollution_defense/