Names, offices, contact details and assignments of more than 41,000 U.S. Department of Homeland Security (DHS) employees have been leaked by a hacktivist group calling itself the Department of Peace. The group handed the data to the transparency collective Distributed Denial of Secrets (DDoSecrets) and to Swiss hacker and journalist maia arson crimew. DDoSecrets published the dataset, named Icepick, on October 28. READ MORE...
Volt Typhoon, a China-government backed hacking group that has infiltrated America's critical infrastructure networks for years, has consistently built and dismantled ephemeral malicious infrastructure to burrow into hundreds of sensitive systems undetected, Lumen Technologies' Black Lotus Labs said in a Wednesday report. The covert access operation that researchers call "Silent Train" isn't a standalone network, but rather a series of compromised routers and IoT devices. READ MORE...
More than 8 million people were impacted by a June 2026 data breach at medical equipment provider iRhythm. The company, which specializes in wearable cardiac monitoring technology and is best known for its Zio wearable ECG monitor, disclosed the incident in mid-June. iRhythm said right from the start that sensitive information might have been stolen from certain third-party-hosted business applications and that the hackers attempted to extort a ransom, threatening to leak the compromised data. READ MORE...
Researchers identified at least 83 attacks against 61 public GitHub repositories, including popular open source projects such as Google LangExtract, Trivy, Brave browser, and MLflow, in what they suspect is a coordinated campaign to execute commands in CI/CD environments and steal credentials and access tokens. It all happened very quickly, the Radware threat hunters said in an exclusive interview with The Register. READ MORE...
A new wave of GhostAction attacks has largely failed, but this supply chain campaign operator is well-positioned to cause more chaos down the line. GhostAction, an ongoing campaign in which attackers target GitHub by compromising developer accounts and injecting GitHub Actions workflow files into repositories. Workflows tell GitHub Actions what code to execute when events occur (such as when a commit is pushed or pull request is opened). READ MORE...
The insurance industry is closely monitoring PHP2Shell amid concerns of a systemic event that could overwhelm the sector with billions in cybersecurity risk claims. PHP Foundation and multiple government authorities last week warned about two critical vulnerabilities in the scripting language used in more than 70% of websites. If successfully exploited, those vulnerabilities could enable an attacker to achieve remote code execution. READ MORE...
Attackers have been breaking into business networks through camera management software, according to new research from security firm Huntress, which traced several incidents in September and October back to a compromised application. The company's analysts haven't been able to confidently determine which software it was, and because no logs associated with the application could be found, they also couldn't pinpoint how the attackers compromised it. READ MORE...
A mysterious relay service is installing authentic but unauthorized OpenAI Codex and Anthropic Claude Code tools for enterprise users overseas, and making dangerous configuration changes that put those organizations at risk. The AI relay, first spotted by the Symantec Threat Hunter Team, appears to be designed to bypass regional restrictions that prevent certain countries and regions from using AI tools and platforms of US companies. READ MORE...
Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027. This retirement process applies only to Microsoft Entra ID workforce tenant authentication scenarios and not to Azure AD B2C or Microsoft Entra External ID customer identity scenarios. Admins should ensure all users in their organizations use a phishing-resistant method. READ MORE...
Cisco on Wednesday released fixes for an exploited vulnerability affecting its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Tracked as CVE-2026-76418 and assigned a CVSS score of 8.6, the bug resides in the Remote Access SSL VPN service. Attackers can exploit it remotely, without authenticating, to force the device to restart unexpectedly and disrupt its availability. READ MORE...