Your daily source for the latest security threats, vulnerabilities, and data breaches.
Equifax's CISO for Continental Europe, Javier Checa, details the company's extensive cybersecurity overhaul and $3 billion cloud migration since its 2017 breach. This transformation, driven by leadership commitment, aimed to fortify security, regain trust, and establish Equifax as a security leader.
The US Treasury Department removed three individuals linked to the Intellexa Consortium, maker of Predator spyware, from a sanctions list. This decision reverses previous Biden administration designations, sparking concerns among digital freedom advocates about accountability.
Enterprises struggle with passwordless authentication, with 90% reporting deployment issues due to legacy systems, complex environments, and security concerns. This hinders adoption as a primary method, leaving organizations vulnerable to credential theft.
Cybercrime has evolved into a highly industrialized, global shadow economy, operating with sophisticated structures like legitimate corporations, offering "as-a-service" models, and posing a significant threat to global stability.
CSO Online outlines a four-step External Attack Surface Management (EASM) strategy crucial for protecting internet-facing assets. This iterative process involves identifying, detecting, assessing, and prioritizing risks to minimize an organization's external cyber exposure.
A structured post-incident review process is critical for organizations to learn from security incidents, even minor ones, and continuously improve their defenses. These reviews analyze what went well, what didn't, and how to enhance future performance.
A new cybercrime service, ErrTraffic, automates ClickFix social engineering attacks by generating fake browser glitches on compromised websites. It lures users into downloading various info-stealers and trojans, boasting high conversion rates and OS-specific payload delivery.
South KoreaSouth Korean e-commerce giant Coupang will provide $1.17 billion in vouchers to 33.7 million users affected by a data breach. The breach, attributed to a former employee, exposed personal information like names and addresses over five months.
Two former cybersecurity experts, Ryan Clifford Goldberg and Kevin Tyler Martin, pleaded guilty to conducting **BlackCat (ALPHV) ransomware** attacks against U.S. companies between May and November 2023, leveraging their professional skills for extortion.
A maximum-severity vulnerability (**CVE-2025-52691**) in **SmarterTools SmarterMail** email software allows unauthenticated remote code execution via arbitrary file upload. This flaw, with a CVSS score of 10.0, impacts versions Build 9406 and earlier.
The European Space Agency (ESA) confirmed a breach of its external servers, including JIRA and Bitbucket, where a threat actor claimed to have stolen over 200GB of data, including source code and credentials. ESA states the impacted servers held "unclassified" engineering information.
A China-linked APT, DarkSpectre, is using 18 malicious browser extensions, dubbed Zoom Stealer, to harvest corporate meeting intelligence from 2.2 million Chrome, Firefox, and Edge users. This data includes sensitive meeting details and embedded passwords, exfiltrated in real-time for espionage.
