Tag: service
-
Germany Tries, Tries Again With ISP Data Retention Mandate
Berlin Proposes 3 Month Requirement to Store IP Addresses. The German government says it’s unlocked the secret to passing a law that would require internet service providers to keep customer data without running afoul of privacy and security concerns that sunk earlier attempts. Critics say that’s impossible First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/germany-tries-tries-again-isp-data-retention-mandate-a-31496
-
Mythos Is a Wake-Up Call for DDoS Defense
Will Anthropic’s Mythos, with its AI-powered identification of software and infrastructure weaknesses, upset the financial services industry by means of new, AI-developed attacks? Major bank leaders were called to an urgent meeting by Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell, over concerns that the latest AI model released by Anthropic (the developer..…
-
iOS Flaw Let Deleted Notifications Linger, Apple Issues Fix
Apple fixed an iOS flaw that kept deleted notifications on devices, allowing recovery of messages, including from apps like Signal. Apple released updates for iOS and iPadOS to address the vulnerability CVE-2026-28950, a flaw in Notification Services that stored notifications even after deletion. This logging issue could allow recovery of sensitive data, including messages from…
-
Offer customers passkeys by default, UK’s NCSC tells enterprises
How passkeys change the attack model: The NCSC added that passkeys reduce risk by removing reliance on shared secrets and binding authentication to the legitimate service.According to the agency, this prevents credential reuse and relay attacks, as authentication cannot be intercepted and reused by an attacker.Passkeys use cryptographic key pairs stored on a user’s device,…
-
House Republicans unveil data privacy law that would override state protections
The bill, known as the SECURE Data Act, is backed by top Republicans on the House Energy and Commerce and Financial Services committees. First seen on therecord.media Jump to article: therecord.media/house-republicans-unveil-data-privacy-law-override-state-measures
-
UK’s NCSC calls passkeys the default, says passwords are no longer fit for the purpose
How passkeys change the attack model: The NCSC added that passkeys reduce risk by removing reliance on shared secrets and binding authentication to the legitimate service.According to the agency, this prevents credential reuse and relay attacks, as authentication cannot be intercepted and reused by an attacker.Passkeys use cryptographic key pairs stored on a user’s device,…
-
SASE im Browser
Der Spezialist für Secure-Access-Service-Edge (SASE), Versa Networks, stellt den Versa-Secure-Enterprise-Browser vor. Diese Erweiterung der <> setzt direkt im Browser die festgelegten SASE-Richtlinien durch und schützt so Mitarbeitende und Partner effektiv bei der Nutzung von Web-, SaaS- und unternehmensinternen KI-Anwendungen. Der Browser hat sich zur vorherrschenden Umgebung für die Arbeit in Unternehmen entwickelt. […] First seen…
-
SASE im Browser
Der Spezialist für Secure-Access-Service-Edge (SASE), Versa Networks, stellt den Versa-Secure-Enterprise-Browser vor. Diese Erweiterung der <> setzt direkt im Browser die festgelegten SASE-Richtlinien durch und schützt so Mitarbeitende und Partner effektiv bei der Nutzung von Web-, SaaS- und unternehmensinternen KI-Anwendungen. Der Browser hat sich zur vorherrschenden Umgebung für die Arbeit in Unternehmen entwickelt. […] First seen…
-
SASE im Browser
Der Spezialist für Secure-Access-Service-Edge (SASE), Versa Networks, stellt den Versa-Secure-Enterprise-Browser vor. Diese Erweiterung der <> setzt direkt im Browser die festgelegten SASE-Richtlinien durch und schützt so Mitarbeitende und Partner effektiv bei der Nutzung von Web-, SaaS- und unternehmensinternen KI-Anwendungen. Der Browser hat sich zur vorherrschenden Umgebung für die Arbeit in Unternehmen entwickelt. […] First seen…
-
Supply Chain Resilience for UK SMEs: Practical Steps to Reduce Third-Party Risk
For many UK SMEs, supply chain resilience is not a specialist security project. It is a business continuity issue. If a key supplier cannot deliver, a software provider has an outage, or a partner mishandles data, the impact can show up quickly in customer service, cash flow, and reputation. The good news is that you……
-
Supply Chain Resilience for UK SMEs: Practical Steps to Reduce Third-Party Risk
For many UK SMEs, supply chain resilience is not a specialist security project. It is a business continuity issue. If a key supplier cannot deliver, a software provider has an outage, or a partner mishandles data, the impact can show up quickly in customer service, cash flow, and reputation. The good news is that you……
-
Supply Chain Resilience for UK SMEs: Practical Steps to Reduce Third-Party Risk
For many UK SMEs, supply chain resilience is not a specialist security project. It is a business continuity issue. If a key supplier cannot deliver, a software provider has an outage, or a partner mishandles data, the impact can show up quickly in customer service, cash flow, and reputation. The good news is that you……
-
New GopherWhisper APT group abuses Outlook, Slack, Discord for comms
A previously undocumented state-backed threat actor named GopherWhisper is using a Go-based custom toolkit and legitimate services like Microsoft 365 Outlook, Slack, and Discord in attacks against government entities. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-gopherwhisper-apt-group-abuses-outlook-slack-discord-for-comms/
-
New GopherWhisper APT group abuses Outlook, Slack, Discord for comms
A previously undocumented state-backed threat actor named GopherWhisper is using a Go-based custom toolkit and legitimate services like Microsoft 365 Outlook, Slack, and Discord in attacks against government entities. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-gopherwhisper-apt-group-abuses-outlook-slack-discord-for-comms/
-
Apple fixes iPhone bug that let FBI retrieve deleted Signal messages(CVE-2026-28950)
Apple has rolled out security updates for iPhones and iPads that fix CVE-2026-28950, a logging issue in Notification Services that made devices unexpectedly retain … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/23/cve-2026-28950-iphone-vulnerability-notifications-signal/
-
Apple Fixes iOS Flaw That Let FBI Recover Deleted Signal Messages
Apple has rolled out a software fix for iOS and iPadOS to address a Notification Services flaw that stored notifications marked for deletion on the device.The vulnerability, tracked as CVE-2026-28950 (CVSS score: N/A), has been described as a logging issue that has been addressed with improved data redaction.”Notifications marked for deletion could be unexpectedly retained…
-
Apple Patches iOS Flaw That Stored Deleted Signal Notifications in FBI Forensic Case
Apple has rolled out a software fix for iOS and iPadOS to address a Notification Services flaw that stored notifications marked for deletion on the device.The vulnerability, tracked as CVE-2026-28950 (CVSS score: N/A), has been described as a logging issue that has been addressed with improved data redaction.”Notifications marked for deletion could be unexpectedly retained…
-
Apple fixes bug that let the FBI recover deleted Signal messages
Apple has released out-of-band security updates for iPhone and iPad devices to fix a Notification Services flaw that could allow notifications marked for deletion to remain stored on the device. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/apple-fixes-ios-bug-that-retained-deleted-notification-data/
-
Scenario: Open-source framework for automated AI app red-teaming
Enterprises running customer service bots, data analytics agents, and other AI-driven applications in production handle sensitive records and connect to core business systems … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/23/scenario-open-source-framework-for-automated-ai-app-red-teaming/
-
Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener
IntroductionOn March 12, 2026, Zscaler ThreatLabz discovered a malicious ZIP archive containing military-themed document lures targeting Chinese-speaking individuals. Our analysis of this sample uncovered a campaign leveraging a multi-stage attack chain where a trojanized SumatraPDF reader deploys an AdaptixC2 Beacon agent, ultimately leading to the download and abuse of Visual Studio (VS) Code tunnels for…
-
Riddled with flaws, serialEthernet converters endanger critical infrastructure
Tags: access, authentication, control, credentials, data, data-breach, exploit, firmware, flaw, infrastructure, malicious, network, open-source, password, rce, remote-code-execution, risk, service, threat, update, vulnerabilityNew RCE and other vulnerabilities: Aside from all the known vulnerabilities from open-source components, the Forescout researchers also performed manual security analysis and identified previously unknown flaws in the firmware of three specific devices from two vendors: Lantronix EDS3000PS Series, Lantronix EDS5000 Series, and Silex SD330-AC.The web-based management interface of the Lantronix EDS5000 had five…
-
Riddled with flaws, serialEthernet converters endanger critical infrastructure
Tags: access, authentication, control, credentials, data, data-breach, exploit, firmware, flaw, infrastructure, malicious, network, open-source, password, rce, remote-code-execution, risk, service, threat, update, vulnerabilityNew RCE and other vulnerabilities: Aside from all the known vulnerabilities from open-source components, the Forescout researchers also performed manual security analysis and identified previously unknown flaws in the firmware of three specific devices from two vendors: Lantronix EDS3000PS Series, Lantronix EDS5000 Series, and Silex SD330-AC.The web-based management interface of the Lantronix EDS5000 had five…
-
Malicious pgserve, automagik developer tools found in npm registry
Advice to victimized developers: Developers who have downloaded the malicious versions of pgserver and automagik need to act fast, says Tanya Janca, head of Canadian secure coding consultancy SheHacksPurple.”Rotate every credential you can think of, right now, before you do anything else,” she said. “Then harden your CI/CD network egress controls so your build runners…