O banco norte americano Community Bank, unidade da CB Financial Services em Carmichaels, estado da Pensilvânia, informou em comunicado à Securities and Exchange Commission (SEC, equivalente da nossa CVM) que um aplicativo de inteligência artificial não autorizado expôs dados sens…
Microsoft says some customers are experiencing issues downloading and installing Office on their Windows 365 devices. [...]
TL;DR: Stop chasing thousands of "toast" alerts. Join experts from Wiz and Okta/GitLab to learn how hackers connect tiny flaws to build a "Lethal Chain" to your data—and how to break it. Register for the Strategic Briefing Here. Most security tools work like a smoke alarm that go…
Grupos ligados ao ecossistema Magecart estão abusando do Google Tag Manager para inserir skimmers de cartão em lojas virtuais comprometidas, usando uma ferramenta legítima e amplamente confiável como ponto de entrega de código malicioso. O Google Tag Manager é usado por milhões d…
Pesquisadores identificaram uma vulnerabilidade na extensão “Claude in Chrome” que poderia permitir a extensões maliciosas sem permissões declaradas controlar o assistente de IA e acessar dados sensíveis do usuário. O problema está relacionado a uma violação de limite de confianç…
Security teams have never had better visibility into their environments and never been worse at confirming what they fix stays fixed. Mandiant's M-Trends 2026 report puts the mean time to exploit at an estimated negative seven days. The Verizon 2025 DBIR puts median time to remed…
Um conjunto de vulnerabilidades em componentes do PHP expõe servidores web a riscos de negação de serviço, vazamento de informações e, no caso mais grave, execução remota de código por meio da extensão SOAP. A principal falha é rastreada como CVE-2026-6722 e afeta a forma como a …
Microsoft on Tuesday released patches for 138 security vulnerabilities spanning its product portfolio, although none of them have been listed as publicly known or under active attack. Of the 138 flaws, 30 are rated Critical, 104 are rated Important, three are rated Moderate, and …
Canadian telecom providers face mounting cyber threats from ransomware, SIM swapping, data breaches, and nation-state attacks targeting critical infrastructure.
Cybersecurity researchers are calling attention to a new campaign dubbed GemStuffer that has targeted the RubyGems repository with more than 150 gems that use the registry as a data exfiltration channel rather than for malware distribution. "The packages do not appear designed fo…
Google on Tuesday unveiled a new opt-in Android feature called Intrusion Logging for storing forensic logs to better analyze sophisticated spyware attacks. Intrusion Logging, available as part of Advanced Protection Mode, enables "persistent and privacy-preserving forensics loggi…
An agreement has been reached between the state of Rhode Island and Deloitte Consulting LLP that will see the professional […] The post Rhode Island Finalizes $12 Million Settlement With Deloitte Consulting Over RIBridges Cyberattack appeared first on The HIPAA Journal.
Cigna Says HIPAA Doesn't Save Website Privacy Suit Law360
Cigna Says HIPAA Doesn't Save Website Privacy Suit Law360
The U.S. House Committee on Homeland Security is calling on Instructure executives to testify about two cyberattacks by the ShinyHunters extortion group that targeted the company's Canvas platform, allowing threat actors to steal student data and disrupt schools during final exam…
A Instructure, empresa proprietária da plataforma de ensino Canvas, admitiu ontem ter feito um acordo com o grupo de hackers ShinyHunters para evitar que fossem despejados na Internet cerca de 3,6 terabytes de dados de alunos e de instituições de ensino clientes da empresa. Os da…
ShinyHunters says its shinyhunte.rs domain was suspended after the Canvas LMS attacks, forcing the group to move fully to its dark web (.onion) site.
Centenas de pacotes nos repositórios npm e PyPI foram comprometidos na campanha Shai-Hulud (TeamPCP), que rouba credenciais de desenvolvedores. O invasor sequestrou tokens OIDC válidos para publicar versões maliciosas com assinaturas legítimas, informou a empresa StepSecurity. O …
It's the first time in two years with no zero-days. But with 137 flaws to patch, including nine critical ones, admins still have plenty of work to do.
The Information Commissioner's Office has fined South Staffordshire Water Plc and parent company South Staffordshire Plc £963,900 ($1.3 million) over a cyberattack that exposed the personal data of 663,887 customers and employees. [...]
