Collecting Cyber-News from over 60 sources

Tag: data

Google Fixes Zero Click Gemini Enterprise Flaw That Exposed Corporate Data

Dec 10, 2025 1:32 PM

Tags: ai, corporate, data, data-breach, exploit, flaw, google

The flaw, dubbed ‘GeminiJack,’ exploits the trust boundary between user-controlled content in data sources and the AI model’s instruction processing First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/google-fixes-gemini-enterprise-flaw/
Rise in Device-Driven Cybercrime and Expanding Ransomware Threats Put India on Alert

Dec 10, 2025 10:32 AM

Tags: crime, cybercrime, data, india, mobile, phone, ransomware, threat

Recent data released by the National Crime Records Bureau (NCRB) paints a troubling picture of the rapid rise in cybercrime in India, particularly cases executed through mobile phones and computers. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cybercrime-in-india-ncrb-report-2023-2025/
Key cybersecurity takeaways from the 2026 NDAA

Dec 10, 2025 8:32 AM

Tags: access, ai, attack, awareness, best-practice, control, cyber, cybersecurity, data, defense, framework, governance, government, group, guide, infrastructure, injection, intelligence, international, malicious, military, ml, mobile, monitoring, network, nist, privacy, resilience, risk, risk-assessment, service, spyware, supply-chain, theft, threat, tool, training, unauthorized, vulnerability

AI and machine learning security and procurement requirements: Recognizing that AI now underpins everything from battlefield planning to intelligence analysis, the bill introduces sweeping requirements to safeguard these systems from emerging digital threats.The NDAA spells out a spate of policy and procurement practices that the military should meet regarding artificial intelligence and machine learning (ML).…
Key cybersecurity takeaways from the 2026 NDAA

Dec 10, 2025 8:32 AM

Tags: access, ai, attack, awareness, best-practice, control, cyber, cybersecurity, data, defense, framework, governance, government, group, guide, infrastructure, injection, intelligence, international, malicious, military, ml, mobile, monitoring, network, nist, privacy, resilience, risk, risk-assessment, service, spyware, supply-chain, theft, threat, tool, training, unauthorized, vulnerability

AI and machine learning security and procurement requirements: Recognizing that AI now underpins everything from battlefield planning to intelligence analysis, the bill introduces sweeping requirements to safeguard these systems from emerging digital threats.The NDAA spells out a spate of policy and procurement practices that the military should meet regarding artificial intelligence and machine learning (ML).…
Euro750 Payout Proposed for 90,000 Victims as HSE Acknowledges Cyberattack Damage

Dec 10, 2025 8:32 AM

Tags: cyberattack, data, finance, service

Four years after the HSE cyberattack that crippled Ireland’s national health service, the Health Service Executive has begun offering financial compensation to individuals whose personal data was compromised in the incident. The payment proposal is the first time the HSE has formally acknowledged the need to compensate those affected by what remains one of the largest recorded…
Euro750 Payout Proposed for 90,000 Victims as HSE Acknowledges Cyberattack Damage

Dec 10, 2025 8:32 AM

Tags: cyberattack, data, finance, service

Four years after the HSE cyberattack that crippled Ireland’s national health service, the Health Service Executive has begun offering financial compensation to individuals whose personal data was compromised in the incident. The payment proposal is the first time the HSE has formally acknowledged the need to compensate those affected by what remains one of the largest recorded…
UTMStack: Open-source unified threat management platform

Dec 10, 2025 7:32 AM

Tags: data, edr, open-source, siem, threat

UTMStack is an open-source unified threat management platform that brings SIEM and XDR features into one system. The project focuses on real time correlation of log data, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/12/10/utmstack-open-source-unified-threat-management-platform/
GOLD BLADE: Custom QWCrypt Locker for Data Exfiltration and Ransomware Deployment

Dec 10, 2025 5:33 AM

Tags: cyber, cyberespionage, data, group, ransomware, theft, threat

Between February 2024 and August 2025, security researchers uncovered a significant campaign orchestrated by the GOLD BLADE threat group, previously known as RedCurl, RedWolf, and Earth Kapre. The investigation of nearly 40 intrusions linked to STAC6565 reveals a sophisticated threat actor that has evolved from traditional cyberespionage into a hybrid operation combining data theft with…
GOLD BLADE: Custom QWCrypt Locker for Data Exfiltration and Ransomware Deployment

Dec 10, 2025 5:33 AM

Tags: cyber, cyberespionage, data, group, ransomware, theft, threat

Between February 2024 and August 2025, security researchers uncovered a significant campaign orchestrated by the GOLD BLADE threat group, previously known as RedCurl, RedWolf, and Earth Kapre. The investigation of nearly 40 intrusions linked to STAC6565 reveals a sophisticated threat actor that has evolved from traditional cyberespionage into a hybrid operation combining data theft with…
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
Zoom Rooms on Windows and macOS Exposed to Privilege Escalation and Data Leakage Flaws

Dec 10, 2025 5:33 AM

Tags: attack, cve, cyber, data, data-breach, flaw, macOS, software, unauthorized, update, vulnerability, windows

Zoom has released security patches addressing two critical vulnerabilities in Zoom Rooms deployments on both Windows and macOS. The vulnerabilities expose users to privilege escalation attacks and unauthorized software manipulation, prompting immediate update recommendations across enterprise environments. The first vulnerability, tracked as CVE-2025-67460, affects Zoom Rooms for Windows with a High severity rating. This flaw…
Zoom Rooms on Windows and macOS Exposed to Privilege Escalation and Data Leakage Flaws

Dec 10, 2025 5:33 AM

Tags: attack, cve, cyber, data, data-breach, flaw, macOS, software, unauthorized, update, vulnerability, windows

Zoom has released security patches addressing two critical vulnerabilities in Zoom Rooms deployments on both Windows and macOS. The vulnerabilities expose users to privilege escalation attacks and unauthorized software manipulation, prompting immediate update recommendations across enterprise environments. The first vulnerability, tracked as CVE-2025-67460, affects Zoom Rooms for Windows with a High severity rating. This flaw…
Zoom Rooms on Windows and macOS Exposed to Privilege Escalation and Data Leakage Flaws

Dec 10, 2025 5:33 AM

Tags: attack, cve, cyber, data, data-breach, flaw, macOS, software, unauthorized, update, vulnerability, windows

Zoom has released security patches addressing two critical vulnerabilities in Zoom Rooms deployments on both Windows and macOS. The vulnerabilities expose users to privilege escalation attacks and unauthorized software manipulation, prompting immediate update recommendations across enterprise environments. The first vulnerability, tracked as CVE-2025-67460, affects Zoom Rooms for Windows with a High severity rating. This flaw…
Zoom Rooms on Windows and macOS Exposed to Privilege Escalation and Data Leakage Flaws

Dec 10, 2025 5:33 AM

Tags: attack, cve, cyber, data, data-breach, flaw, macOS, software, unauthorized, update, vulnerability, windows

Zoom has released security patches addressing two critical vulnerabilities in Zoom Rooms deployments on both Windows and macOS. The vulnerabilities expose users to privilege escalation attacks and unauthorized software manipulation, prompting immediate update recommendations across enterprise environments. The first vulnerability, tracked as CVE-2025-67460, affects Zoom Rooms for Windows with a High severity rating. This flaw…
GOLD BLADE: Custom QWCrypt Locker for Data Exfiltration and Ransomware Deployment

Dec 10, 2025 5:33 AM

Tags: cyber, cyberespionage, data, group, ransomware, theft, threat

Between February 2024 and August 2025, security researchers uncovered a significant campaign orchestrated by the GOLD BLADE threat group, previously known as RedCurl, RedWolf, and Earth Kapre. The investigation of nearly 40 intrusions linked to STAC6565 reveals a sophisticated threat actor that has evolved from traditional cyberespionage into a hybrid operation combining data theft with…
GOLD BLADE: Custom QWCrypt Locker for Data Exfiltration and Ransomware Deployment

Dec 10, 2025 5:33 AM

Tags: cyber, cyberespionage, data, group, ransomware, theft, threat

Between February 2024 and August 2025, security researchers uncovered a significant campaign orchestrated by the GOLD BLADE threat group, previously known as RedCurl, RedWolf, and Earth Kapre. The investigation of nearly 40 intrusions linked to STAC6565 reveals a sophisticated threat actor that has evolved from traditional cyberespionage into a hybrid operation combining data theft with…
Hospice Firm, Eye Care Practice Notifying 520,000 of Hacks

Dec 10, 2025 12:32 AM

Tags: data, hacking, healthcare, service, theft

Data Theft Incidents Are Among the Latest Hacks Against Specialty Medical Providers. Two specialty healthcare providers – a Florida-based firm that provides hospice services in several states and a Pennsylvania-based eye care practice – are notifying nearly 520,000 people that their sensitive health information was compromised in separate hacking incidents. First seen on govinfosecurity.com Jump…
Google Patches AI Flaw That Turned Gemini Into a Spy

Dec 9, 2025 9:33 PM

Tags: ai, corporate, credentials, data, email, flaw, google, malware, spy, vulnerability

Zero-Click Vulnerability Let Attackers Weaponize Enterprise AI Assistant. Google patched a vulnerability in Gemini Enterprise that allowed attackers to steal corporate data through a shared document, calendar invitation or email without any user action or security alerts. No malware was executed, no credentials were phished and no data left through approved channels. First seen on…
Gemini for Chrome gets a second AI agent to watch over it

Dec 9, 2025 6:32 PM

Tags: access, ai, attack, banking, browser, chatgpt, chrome, control, corporate, credentials, data, defense, google, injection, LLM, malicious, openai, password, RedTeam, risk

Google’s two-model defense: To address these risks, Google’s solution splits the work between two AI models. The main Gemini model reads web content and decides what actions to take. The user alignment critic sees only metadata about proposed actions, not the web content that might contain malicious instructions.”This component is architected to see only metadata…
Racks, sprawl and the myth of redundancy: Why your failover isn’t as safe as you think

Dec 9, 2025 6:32 PM

Tags: access, automation, backup, breach, cloud, control, data, data-breach, defense, detection, dns, encryption, firmware, flaw, infrastructure, intelligence, Internet, metric, mobile, network, resilience, software, strategy, supply-chain, tool, update, vulnerability, zero-day

Cloud complexity and policy traps: Networks, however, no longer stay confined to racks. They live in routing tables, BGP sessions, cloud control planes and software-defined overlays. Many organizations rush to multi-region cloud setups, believing geographic distance alone guarantees resilience. It does not. Last year, I oversaw a global e-commerce platform with active-passive failover across two…
Racks, sprawl and the myth of redundancy: Why your failover isn’t as safe as you think

Dec 9, 2025 6:32 PM

Tags: access, automation, backup, breach, cloud, control, data, data-breach, defense, detection, dns, encryption, firmware, flaw, infrastructure, intelligence, Internet, metric, mobile, network, resilience, software, strategy, supply-chain, tool, update, vulnerability, zero-day

Cloud complexity and policy traps: Networks, however, no longer stay confined to racks. They live in routing tables, BGP sessions, cloud control planes and software-defined overlays. Many organizations rush to multi-region cloud setups, believing geographic distance alone guarantees resilience. It does not. Last year, I oversaw a global e-commerce platform with active-passive failover across two…
Spain arrests teen who stole 64 million personal data records

Dec 9, 2025 6:32 PM

Tags: breach, data, hacker

The National Police in Spain have arrested a suspected 19-year-old hacker in Barcelona, for allegedly stealing and attempting to sell 64 million records obtained from breaches at nine companies. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/spain-arrests-teen-who-stole-64-million-personal-data-records/
Malicious VS Code Extensions Deploy Advanced Infostealer

Dec 9, 2025 6:32 PM

Tags: ai, data, malicious

Two malicious Visual Studio Code extensions, Bitcoin Black and Codo AI, have been observed harvesting sensitive user data First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/malicious-vs-code-extensions/
AI-Powered Security Operations: Governance Considerations for Microsoft Sentinel Enterprise Deployments

Dec 9, 2025 6:32 PM

Tags: ai, data, governance, microsoft, threat

The Tech Field Day Exclusive with Microsoft Security (#TFDxMSSec25) spotlighted one of the most aggressive demonstrations of AI-powered security operations to date. Microsoft showcased how Sentinel’s evolving data lake and graph architecture now drive real-time, machine-assisted threat response. The demo of “Attack Disruption” captured the promise”, and the unease”, of a security operations center where…
Seoul cyber investigators seize data, devices from ‘South Korea’s Amazon’ following data breach

Dec 9, 2025 4:32 PM

Tags: breach, country, cyber, data, data-breach, korea

Cyber investigators from the Seoul Metropolitan Police Agency seized devices and data from one of the country’s largest tech firms to find evidence uncovering how the breach took place. First seen on therecord.media Jump to article: therecord.media/seoul-cyber-investigators-seize-data-korea-tech-giant
New GeminiJack 0-Click Flaw in Gemini AI Exposed Users to Data Leaks

Dec 9, 2025 4:32 PM

Tags: ai, data, data-breach, flaw, google, leak

Google AI systems (Gemini Enterprise) had a critical ‘GeminiJack’ security flaw allowing attackers to steal Gmail, Docs, and Calendar data with no clicks. First seen on hackread.com Jump to article: hackread.com/geminijack-0-click-flaw-gemini-ai-data-leaks/
Google Confirms Rising ‘Account Takeovers’”, Users Told to Check Chrome Settings

Dec 9, 2025 4:32 PM

Tags: authentication, browser, chrome, data, google

Google warns Chrome users of rising “account takeovers” and urges stronger authentication to keep accounts and synced data safe. The post Google Confirms Rising ‘Account Takeovers’”, Users Told to Check Chrome Settings appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-google-chrome-account-takeover/
Gemini Enterprise No-Click Flaw Exposes Sensitive Data

Dec 9, 2025 4:32 PM

Tags: corporate, data, flaw, google, malicious, vulnerability

Google has fixed a critical vulnerability that enabled attackers to add malicious instructions to common documents to exfiltrate sensitive corporate information. First seen on darkreading.com Jump to article: www.darkreading.com/remote-workforce/gemini-enterprise-exposes-sensitive-data