Tag: data
-
Cursor-Opus agent snuffs out startup’s production database
Relax, the data’s been recovered. Continue with your vibe coding First seen on theregister.com Jump to article: www.theregister.com/2026/04/27/cursoropus_agent_snuffs_out_pocketos/
-
Critical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCE
Tags: cve, cybersecurity, data, exploit, flaw, github, open-source, rce, remote-code-execution, vulnerabilityCybersecurity researchers have disclosed details of a critical security flaw impacting LeRobot, Hugging Face’s open-source robotics platform with nearly 24,000 GitHub stars, that could be exploited to achieve remote code execution.The vulnerability in question is CVE-2026-25874 (CVSS score: 9.3), which has been described as a case of untrusted data deserialization stemming from the use of…
-
Bridging the EU AI Act Compliance Gap FireTail Blog
Tags: ai, breach, cloud, compliance, control, data, GDPR, governance, infrastructure, monitoring, privacy, risk, risk-management, tool, trainingApr 28, 2026 – Lina Romero – What the EU AI Act demandsThe EU AI Act classifies AI according to risk. Unacceptable risk is prohibited outright. High-risk AI systems are heavily regulated. Limited-risk systems face transparency obligations. The majority of obligations fall on providers, though deployers carry meaningful obligations too. If your organisation builds AI, buys…
-
New Android spyware Morpheus linked to Italian surveillance firm
Osservatorio Nessuno uncovered Morpheus spyware spreading via fake Android apps to steal data, highlighting rising covert surveillance tools. The non-partisan, non-religious, nonprofit organization Osservatorio Nessuno exposed a new spyware called Morpheus, distributed through fake Android apps posing as updates. Once installed, it can steal extensive data from the infected devices. The report shows strong demand…
-
Stopping AiTM attacks: The defenses that actually work after authentication succeeds
Tags: 2fa, access, attack, authentication, awareness, breach, communications, compliance, control, credentials, data, defense, detection, email, finance, framework, identity, incident response, login, mfa, microsoft, monitoring, nist, passkey, phishing, risk, service, threat, tool, trainingThe 3 controls that close the gap: Control #1: Bind sessions to managed devices The most impactful single control for session security is requiring managed, compliant devices as a condition of accessing sensitive resources. When access policies, such as Microsoft Entra Conditional Access, require that the device presenting a session token is enrolled, managed and…
-
French police arrest 21-year-old >>HexDex<< hacker over 100 alleged data breaches
A 21-year-old man suspected of conducting approximately 100 data breaches since late 2025 – including a hack of the French Ministry of National Education that exposed records on almost a quarter of a million employees – has been arrested at his home in western France. First seen on bitdefender.com Jump to article: www.bitdefender.com/en-us/blog/hotforsecurity/french-police-arrest-hexdex-hacker
-
Open-source privacy tool BleachBit 6.0.0 upgrades code signing across Windows and Linux
System cleaning utilities have grown more relevant as web browsers stockpile larger volumes of cached data, tracking artifacts, and site storage on local disks. The … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/28/bleachbit-6-0-0-open-source-privacy-tool/
-
Open-source privacy tool BleachBit 6.0.0 upgrades code signing across Windows and Linux
System cleaning utilities have grown more relevant as web browsers stockpile larger volumes of cached data, tracking artifacts, and site storage on local disks. The … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/28/bleachbit-6-0-0-open-source-privacy-tool/
-
WhatsApp Tests Encrypted Cloud Backup Service for Safer Message Storage
WhatsApp is actively developing an independent, first-party cloud backup service featuring mandatory end-to-end encryption. This upcoming feature aims to reduce users’ reliance on third-party storage providers such as Google Drive and Apple’s iCloud. By bringing backup storage in-house, WhatsApp gives users greater control over their data privacy and device storage limits. All chat histories hosted…
-
ClickUp Security Flaw Exposes 959 Emails Linked to Major Fortune 500 Firms
A major security flaw in the popular productivity platform ClickUp has exposed sensitive data, including 959 email addresses tied to Fortune 500 companies and government agencies. The primary vulnerability stems from a hardcoded Split.io SDK token left inside ClickUp’s production JavaScript bundle. This script loads automatically whenever a user visits the platform’s content delivery network.…
-
Notepad++ Vulnerability Lets Attackers Crash App and Expose Memory Data
A new string injection vulnerability, tracked as CVE-2026-3008, has been discovered in Notepad++ version 8.9.3. This critical flaw allows attackers to crash the application or to instantly and secretly extract sensitive memory information. The Cybersecurity Agency of Singapore (CSA) has issued an urgent advisory urging all users to immediately upgrade to version 8.9.4 to secure…
-
Claude Opus 4.6-Powered AI Coding Agent Wipes Production Database in 9 Seconds
A Claude Opus 4.6-powered AI coding agent operating through the Cursor editor autonomously deleted the production database and backups of SaaS startup PocketOS in just nine seconds. The incident highlights critical security failures in AI guardrails and infrastructure access controls. The Nine-Second Data Breach Jer Crane, founder of automotive software platform PocketOS, reported that the…
-
How Authentication Systems Help Build Trust in Online Education Platforms
Learn how authentication systems help build trust in online education platforms by improving security, protecting data, and ensuring safe access. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/how-authentication-systems-help-build-trust-in-online-education-platforms/
-
The CISOs Protecting Michigan’s Campuses, Classrooms, and Research
Higher education cybersecurity in Michigan runs from flagship research universities handling federally funded science and sensitive health data to community colleges serving working adults with lean security teams and limited budgets. The environments are different in scale but not in consequence. Student records, research data, clinical systems, and the personal information of tens of thousands…The…
-
Chinese national extradited to US for pandemic-era Silk Typhoon attacks
Xu Zewei was allegedly directed by China’s intelligence services to conduct a sweeping espionage campaign to steal data on COVID-19 research and other U.S. policy interests. First seen on cyberscoop.com Jump to article: cyberscoop.com/xu-zewei-extradited-china-national-silk-typhoon-hafnium/
-
Ongoing supply-chain attack ‘explicitly targeting’ security, dev tools
Vendor confirms repo data exposure after Lapsus$ claims source code, secrets dump First seen on theregister.com Jump to article: www.theregister.com/2026/04/27/supply_chain_campaign_targets_security/
-
ADT Breach Exposes Data of 5.5 Million Customers, ShinyHunters Likely Behind Attack
The ShinyHunters extortion group is claiming responsibility for a breach of home and commercial security vendor ADT that exposed the data of 5.5 million customers. attack appears to be part of a larger and ongoing vishing campaign being run by the prolific threat actors. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/adt-breach-exposes-data-of-5-5-million-customers-shinyhunters-likely-behind-attack/
-
Open source package with 1 million monthly downloads stole user credentials
If you’re one of millions using element-data, it’s time to check for compromise. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/04/open-source-package-with-1-million-monthly-downloads-stole-user-credentials/
-
Supreme Court signals location data searches should require a warrant
Privacy advocates had worried that the high court would rule that geofencing does not qualify as a constitutionally protected search, opening the door to much broader use of warrantless reverse searches of all types. First seen on therecord.media Jump to article: therecord.media/supreme-court-signals-location-data-searches-require-warrant
-
82 Chrome Extensions Found Selling User Data, 6.5 Million Users Affected
LayerX research finds 82 Chrome extensions collecting and selling user data, affecting at least 6.5 million users through disclosed but concerning practices. First seen on hackread.com Jump to article: hackread.com/82-chrome-extensions-selling-user-data/
-
Randall Munroe’s XKCD ‘Landscape Features’
Tags: datavia the comic artistry and dry wit of Randall Munroe, creator of XKCD Permalink First seen on securityboulevard.com Jump to article: https://securityboulevard.com/2026/04/randall-munroes-xkcd-landscape-features/
-
AI Red Teaming Is Not Equal to Prompt Injection
Why AI and Traditional Penetration Testing Must Converge As artificial intelligence red teaming evolves beyond prompt injection, security teams must combine data science, model testing and traditional penetration testing to assess risks across the full attack surface. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/blogs/ai-red-teaming-equal-to-prompt-injection-p-4106
-
Senators seek answers about hackers obtaining sensitive student data from ostensibly anonymous tip line
Sens. Maggie Hassan and Jim Banks wrote to Navigate360 after a hacker claimed to compromise the school safety tool. First seen on cyberscoop.com Jump to article: cyberscoop.com/maps360-student-data-breach-senate-investigation/
-
ShinyHunters Leaks Data of Udemy, Zara, 7-Eleven in Salesforce Linked Breach
ShinyHunters has leaked data linked to Udemy, Zara, and 7-Eleven, with claims of exposed Salesforce records and cloud-based systems. First seen on hackread.com Jump to article: hackread.com/shinyhunters-leak-udemy-zara-7-eleven-data-breach/
-
Home Security Firm ADT Breach: 5.5M Customers’ Data Exposed
Prolific ShinyHunters Extortion Group Made ‘Pay or Leak’ Threat to Victim. Home security giant ADT has suffered a data breach that appears to have exposed personally identifiable information tied to 5.5 million customers. Prolific extortionist group ShinyHunters claimed credit for the attack, saying it stole Salesforce data after socially engineering an ADT employee. First seen…
-
PyPI package with 1.1M monthly downloads hacked to push infostealer
An attacker pushed a malicious version of the popular elementary-data package Python Package Index (PyPI) to steal sensitive developer data and cryptocurrency wallets. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/pypi-package-with-11m-monthly-downloads-hacked-to-push-infostealer/
-
Checkmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 Attack
Checkmarx has disclosed that its ongoing investigation tied to the supply chain security incident has revealed that a cybercriminal group published data related to the company on the dark web.”Based on current evidence, we believe this data originated from Checkmarx’s GitHub repository, and that access to that repository was facilitated through the initial supply chain…
-
As the NVD scales back CVE enrichment, here’s what Tenable customers need to know
Tags: access, ai, cisa, cloud, cve, cvss, data, data-breach, exploit, infrastructure, intelligence, kev, metric, mitre, nist, nvd, ransomware, risk, software, strategy, technology, threat, vulnerability, vulnerability-management, zero-dayNIST’s shift toward selective CVE enrichment creates significant visibility gaps for teams relying solely on the National Vulnerability Database. As AI accelerates vulnerability disclosure rates, organizations need independent, high-fidelity intelligence to prioritize risks that the NVD may now overlook. Key takeaways NIST is pivoting to a prioritized enrichment model, focusing only on specific criteria like…