The Bureau of Alcohol, Tobacco, Firearms and Explosives insists the cyberattack that it publicly disclosed Wednesday was limited to investigation targets, and has not impacted other agency systems. ATF said it is responding to the breach, which first became public after a prolific ransomware group claimed it accessed the federal agency's network. Qilin, a financially-motivated threat group composed of Russian-speaking operators, claimed responsibility for the attack. READ MORE...
We're intimately familiar with data leaks surrounding Valve's games, hardware, and the workings of Steam itself. But nothing could have prepared us for this weekend's "terarelease" encompassing more than 12TB of content related to seemingly every title available on Steam between 2003 and 2013. What's being sold as an "as-complete-as-possible … content server dump" of Steam's defunct "Steam2" server architecture from that time period is now circulating around via a BitTorrent tracker. READ MORE...
Healthcare giant McKesson Corporation over the weekend confirmed that hackers exfiltrated customer data from its systems, as the ShinyHunters extortion group is threatening to release the stolen information. McKesson delivers roughly one-third of prescription medicines to North American hospitals, pharmacies, and healthcare clinics. It also provides medical supplies, supports cancer treatment and specialty care, and operates the Health Mart pharmacy franchise. READ MORE...
The advanced use of AI has created a generational shift in the balance between the ability to protect information and the risk of those systems being compromised, according to researchers at Palo Alto Networks. The cybersecurity firm, which has conducted extensive research on the use of frontier AI, opened a window into those findings in a Wednesday media briefing here. PAN security testers were able to discover the volume of security vulnerabilities that would normally take a year to unearth. READ MORE...
Russian state hackers are trying to interfere with AI-assisted malware analysis in Ukraine by deliberately setting off AI safety mechanisms, ESET has found. The technique, named GuardBreaker by ESET, appeared in a malicious VBS script tied to UAC-0099, a Russia-aligned group previously observed conducting initial-access operations and handing validated targets to the GRU-linked Sandworm hackers. READ MORE...
Berlin's city administration has confirmed that cybercriminals are attempting to extort the city after the Rhysida ransomware gang listed it on their data leak site. The attack was discovered in mid-August, and the threat actor claimed it publicly last Friday, on August 28. Kai Wergner, the Mayor of Berlin, stated that the city will not pay the attacker, and the State Criminal Police Office, the public prosecutor's office, and federal security agencies are now investigating the incident. READ MORE...
Multiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, and to inject ClickFix lures. Researchers say all 19 malicious modules uncovered in the campaign serve distinct purposes and are designed to be "highly extensible." The operation was uncovered by application security company Socket, and the investigation indicates that it may have been active since early 2024. READ MORE...
There are three statements that sum up the frustrating reality for defenders responding to a cyberattack on operational technology (OT) systems: The attack data is not there. There is no trail to follow. There is no history to sort through. While these dynamics will always be true for OT, defenders are getting help from cyber deception as it matures beyond honeypots to a more sophisticated, proactive cyber-defense tool. READ MORE...
I filed a request with McDonald's earlier this month to access all of the personal data the fast food company collected about me, and I received a stunning 515-page report a few days later that detailed my app interactions in granular detail and predicted I would never stop eating there. Under the California Consumer Privacy Act, I have the legal right to request access to information from large companies that collect personal data. READ MORE...
Anthropic's Claude Code running Opus 5 in Auto Mode can be tricked into executing attacker-controlled code simply by asking the coding agent to summarize a website. The attack works up to 80 percent of the time, according to prompt-injection wizard Johann Rehberger, aka wunderwuzzi. In a blog and video demo, he detailed how to hijack Opus 5 in Auto Mode, which is the default setting for Claude as of mid-August. READ MORE...
Hackers are exploiting a critical-severity Ruby on Rails vulnerability that leads to remote code execution (RCE), VulnCheck warns. Tracked as CVE-2026-66066 (CVSS score of 9.5) and referred to as KindaRails2Shell, the flaw is described as an arbitrary file read leading to secret exposure, RCE, and lateral movement. The security defect was disclosed in late July, when Ruby on Rails rolled out patches for it, urging the immediate patching of all Rails applications that rely on libvips. READ MORE...