Tag: data
-
75,000 MongoDBs Exposed as Attackers Exploit ‘MongoBleed’
Tags: data, data-breach, exploit, flaw, group, Internet, mitigation, ransomware, risk, software, vulnerabilityPatches Issued for MongoBleed as Ransomware Groups Target Flaw to Steal Data. Tens of thousands of internet-exposed MongoDB databases are at risk as attackers actively target a critical vulnerability in the software to steal sensitive data, with ransomware groups having joined the fray, researchers warn. MongoDB has issued patches and mitigation advice. First seen on…
-
New Tech Deployments That Cyber Insurers Recommend for 2026
An analysis of cyber-insurance claims data shows which cyber defenses actually work for policyholders. Here are six technologies that will pay off for companies in 2026. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/cybersecurity-tech-recommended-by-cyber-insurer-claims-data
-
When One Vulnerability Breaks the Internet and Millions of Devices Join In
The final weeks of 2025 did not arrive quietly. A single software flaw rippled across the internet, healthcare providers disclosed deeply personal data exposures, and millions of everyday devices quietly joined large scale attacks. As we step into 2026, the ColorTokens Threat Advisory brief captures the operating conditions security teams are already living in, where breaches are assumed, exploitation is fast,……
-
Coupang recovers smashed laptop that alleged data leaker threw into river
South Korean online retailer Coupang is defending its response to a major data breach by an insider, releasing more details of the investigation, including a MacBook recovered from a river bottom. First seen on therecord.media Jump to article: therecord.media/coupang-recovers-smashed-laptop-data-breach
-
Korean Air data breach exposes data of thousands of employees
Korean Air experienced a data breach affecting thousands of employees after Korean Air Catering & Duty-Free (KC&D), its in-flight catering supplier and former subsidiary, was recently hacked. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/korean-air-data-breach-exposes-data-of-thousands-of-employees/
-
React2Shell: Anatomy of a max-severity flaw that sent shockwaves through the web
What the research quickly agreed on: Across early reports from Wiz, Palo Alto Networks’ Unit 42, Google AWS, and others, there was a strong alignment on the core mechanics of React2Shell. Researchers independently confirmed that the flaw lives inside React’s server-side rendering pipeline and stems from unsafe deserialization in the protocol used to transmit component…
-
MongoDB Vulnerability CVE-2025-14847 Under Active Exploitation Worldwide
A recently disclosed security vulnerability in MongoDB has come under active exploitation in the wild, with over 87,000 potentially susceptible instances identified across the world.The vulnerability in question is CVE-2025-14847 (CVSS score: 8.7), which allows an unauthenticated attacker to remotely leak sensitive data from the MongoDB server memory. It has been codenamed MongoBleed.”A flaw First…
-
Top 5 real-world AI security threats revealed in 2025
Tags: access, ai, api, attack, breach, chatgpt, cloud, control, credentials, cybercrime, data, data-breach, defense, email, exploit, flaw, framework, github, gitlab, google, injection, least-privilege, LLM, malicious, malware, microsoft, nvidia, open-source, openai, rce, remote-code-execution, risk, service, software, supply-chain, theft, threat, tool, vulnerabilityA critical remote code execution (RCE) in open-source AI agent framework Langflow that was also exploited in the wildAn RCE flaw in OpenAI’s Codex CLIVulnerabilities in NVIDIA Triton Inference ServerRCE vulnerabilities in major AI inference server frameworks, including those from Meta, Nvidia, Microsoft, and open-source projects such as vLLM and SGLangVulnerabilities in open-source compute framework…
-
Accused data thief threw MacBook into a river to destroy evidence
Tags: dataFormer staffer of Korean e-tailer Coupang accessed 33 million records but may have done less damage than feared First seen on theregister.com Jump to article: www.theregister.com/2025/12/29/coupang_perpetrator_theft_details/
-
Can AI-driven cloud security assure full data protection
Are You Effectively Managing Non-Human Identities in AI-Driven Cloud Security? Where technology underpins every business function, the security of machine identities”, known as Non-Human Identities (NHIs)”, has become paramount. But how well are organizations managing these NHIs, especially in AI-driven cloud security? Understanding Non-Human Identities Within Cloud Security Non-Human Identities are essentially digital passports issued…
-
How can businesses trust AI to handle sensitive data
Are Businesses Ready to Trust AI with Their Most Sensitive Data? The discussion around trusting AI with sensitive data is both inevitable and essential. With AI systems increasingly integrated into business processes, the question now revolves around how businesses can ensure that these technologies handle sensitive data responsibly and securely. Understanding the Complexity of Non-Human……
-
NDSS 2025 Automated Data Protection For Embedded Systems Via Data Flow Based Compartmentalization
Tags: access, automation, breach, conference, data, exploit, firmware, Hardware, healthcare, Internet, network, tool, vulnerabilityNDSS 2025 – Automated Data Protection For Embedded Systems Via Data Flow Based Compartmentalization Session 7B: Trusted Hardware and Execution Authors, Creators & Presenters: Zelun Kong (University of Texas at Dallas), Minkyung Park (University of Texas at Dallas), Le Guan (University of Georgia), Ning Zhang (Washington University in St. Louis), Chung Hwan Kim (University of…
-
Condé Nast faces major data breach: 2.3M WIRED records leaked, 40M more at risk
Hacker claims Condé Nast breach, leaking 2.3M WIRED subscriber records and threatening to expose up to 40M more from other brands. A hacker known as “Lovely” claims to have leaked personal data of over 2.3 million Wired.com users. The data was allegedly posted on December 20, 2025, on the new Breach Stars hacking forum, with…
-
Security Affairs newsletter Round 556 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. LangChain core vulnerability allows prompt injection and data exposure NPM package with 56,000 downloads compromises WhatsApp…
-
LangChain core vulnerability allows prompt injection and data exposure
A critical flaw in LangChain Core could allow attackers to steal sensitive secrets and manipulate LLM responses via prompt injection. LangChain Core (langchain-core) is a key Python package in the LangChain ecosystem that provides core interfaces and model-agnostic tools for building LLM-based applications. A critical vulnerability, tracked as CVE-2025-68664 (CVSS score of 9.3), affects the…
-
Hacker Leaks 2.3M Wired.com Records, Claims 40M-User Condé Nast Breach
A hacker using the alias >>Lovely
-
What “Verified Identity Data” Means for APIs, and How to Evaluate a Data Partner
If you’re building fraud prevention, risk scoring, or identity enrichment into a product, your outcomes depend on one thing: the quality of your identity data. A lot of identity data on the market is broad but unverified: raw broker feeds, unvalidated dumps, or stale breach lists. That data creates risk, noise, and wasted engineering time….…
-
TDL 012 – The Architect of the Internet on the Future of Trust
Summary In this episode of The Defenders Log, Paul Mockapetris, the architect of DNS, discusses the evolving role of the Domain Name System from a simple directory to a sophisticated security tool. He posits that modern networking requires “making sure DNS doesn’t work when you don’t want it to,” comparing DNS filtering to essential services…
-
Everest Ransomware Group Claims Theft of Over 1TB of Chrysler Data
On December 25, while much of the world was observing Christmas, the Everest ransomware group published a new… First seen on hackread.com Jump to article: hackread.com/everest-ransomware-group-chrysler-data-breach/
-
Infosecurity.US Wishes For Your Merry Christmas And Happy New Year
Tags: dataPermalink First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/infosecurity-us-wishes-for-your-merry-christmas-and-happy-new-year/
-
Best of 2025: New Akira Ransomware Decryptor Leans on Nvidia GPU Power
A software programmer developed a way to use brute force to break the encryption of the notorious Akira ransomware using GPU compute power and enabling some victims of the Linux-focused variant of the malware to regain their encrypted data without having to pay a ransom. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/new-akira-ransomware-decryptor-leans-on-nvidia-gpu-power-2/
-
LastPass 2022 Breach Led to Years-Long Cryptocurrency Thefts, TRM Labs Finds
Tags: backup, blockchain, breach, crypto, cybercrime, data, data-breach, intelligence, password, russia, theftThe encrypted vault backups stolen from the 2022 LastPass data breach have enabled bad actors to take advantage of weak master passwords to crack them open and drain cryptocurrency assets as recently as late 2025, according to new findings from TRM Labs.The blockchain intelligence firm said evidence points to the involvement of Russian cybercriminal actors…
-
LastPass 2022 Breach Led to Years-Long Cryptocurrency Thefts, TRM Labs Finds
Tags: backup, blockchain, breach, crypto, cybercrime, data, data-breach, intelligence, password, russia, theftThe encrypted vault backups stolen from the 2022 LastPass data breach have enabled bad actors to take advantage of weak master passwords to crack them open and drain cryptocurrency assets as recently as late 2025, according to new findings from TRM Labs.The blockchain intelligence firm said evidence points to the involvement of Russian cybercriminal actors…
-
Breach Roundup: Spotify Metadata Dumped Online
Also: SudamericaData Leak, RaccoonO365 Arrest and Nefilim Conspirator Pleads Guilty. This week: Spotify metadata scraped, Nissan disclosed third-party breach, millions of Argentines exposed to data leak, African police arrested hundreds in a cybercrime sweep, Nigeria nabbed a phishing operator, the U.S. DOJ charged ATM jackpotting ring and Nefilim ransomware affiliate pleaded guilty. First seen on…
-
Reducing Cyber, Privacy Risks in Healthcare Sector M&As
Healthcare sector mergers and acquisitions dramatically amplify cybersecurity and data privacy exposure for potential buyers and sellers, said attorney Jonian Rafti of law firm Proskauer. But there are critical steps entities can take to reduce those risks, he said. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/interviews/reducing-cyber-privacy-risks-in-healthcare-sector-mas-i-5513
-
Synthetic Data: A New Frontier for Cyber Deception and Honeypots
First seen on resecurity.com Jump to article: www.resecurity.com/blog/article/synthetic-data-a-new-frontier-for-cyber-deception-and-honeypots
-
Randall Munroe’s XKCD ‘Satellite Imagery’
Tags: datavia the cosmic humor & dry-as-interstellar-space wit of Randall Munroe, creator of XKCD Permalink First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/randall-munroes-xkcd-satellite-imagery/
-
NDSS 2025 LAMP: Lightweight Approaches For Latency Minimization In Mixnets With Practical Deployment Considerations
Session 7A: Network Security 2 Authors, Creators & Presenters: Mahdi Rahimi (KU Leuven), Piyush Kumar Sharma (University of Michigan), Claudia Diaz (KU Leuven) PAPER LAMP: Lightweight Approaches For Latency Minimization In Mixnets With Practical Deployment Considerations Mixnets are a type of anonymous communication system designed to provide network privacy to users. They route client messages…
-
Best of 2025: Ukraine Pwns Russian Drone Maker, Gaskar is ‘Paralyzed’
Ukrainian Cyber Alliance and Black Owl team up to hack manufacturer of Russian military drones, sources”¯”¯say. Gaskar Group, Russian designer of drones plaguing Ukraine’s skies, is in utter disarray. Or, at least, so says Ukrainian military intelligence. Hacker groups teamed up to steal and delete 57″¯TB of critical data and backups, preventing the company from..…