61
Security
Attackers Exploit SSHole OpenSSH Flaw That Bypasses Password Checks
Systems running OpenSSH with musl and without PAM are most exposed, and administrators should upgrade to 10.6p2 or disable password logins now.
62
Security
Apple ships macOS Golden Gate 27.2.1 to close eMudhra certificate gap in command-line tools
Tools such as curl and git kept accepting the weak certificates after Apple's October block, and this update finally stops them.
63
Security
Russian hosting firm Beget rebuilds cloud after data-wiping attack
Recovery is slow: over a week on, only part of its shared hosting and dedicated servers are back, with about 1,000 servers still awaiting manual checks.
64
Security
Attacker used Qubole's trusted AWS access to breach customer accounts and steal data
Organizations that left unused Qubole cross-account roles in place were exposed, and the researchers have not yet said how the attacker obtained the credentials.
65
Security
Malicious Builds of Ethersphere's bee-js and Swarm Desktop Targeted Wallet Keys
Anyone who installed or ran the affected builds should assume their node key, password and funds are exposed and rotate them.
66
Security
Claude Code approvals leak secrets into public GitHub repositories
Thousands of credentials have surfaced because a local settings file, meant to stay private, sometimes gets committed to public projects.
67
Security
Binance denies breach after alleged 335 million record sale
Binance says the listing is likely a scam built from malware on users' own devices, not a compromise of its systems.
68
Security
Revolve Says 1,515,073 People Were Affected by Data Breach
Affected shoppers are those who had saved a payment method to their accounts, and the company has not yet explained how the intruder got in.
69
Security
Cloudflare Builds Public Certificate Authority for Post-Quantum Web Security
Cloudflare's Merkle Tree Certificate tests point to a way to keep post-quantum handshakes from becoming much heavier.
70
Security
Plex2Shell flaw chain under active attack against QNAP NAS owners running Plex
Owners of internet-exposed QNAP devices running Plex Media Server should update now and assume a possible compromise.
71
Security
Italy's Foreign Minister Says His Personal Data Is Being Sold on the Dark Web
Tajani says the threat to him and his family is ongoing, and Meloni has blamed pro-Russian hackers for the leak.
72
Security
Sleep headband makers are training AI on users' brain-wave data
Several companies have not clearly told customers their recordings feed AI models, and corporate data transfers often need no consent.
73
Security
Web3Auth Flaw Leads to Keplr Wallet Key Exposure, Funds Moved to Recovery Wallets
Users who signed in to Keplr with Google or Apple should avoid sending new funds and move unstaked balances to recovery-phrase or hardware wallets.
74
Security
Frontline Education breach exposed records of 3,085,266 people
Affected adults in the US get two years of free credit monitoring, while the company has not yet named the flawed third-party product or identified the attackers.
75
Security
Single Taiwan-Based Attacker Used AI Agents Against Hundreds of Organizations
The campaign reached about ten victims in Taiwan, Mexico and Thailand, and the agents' false findings show limits to automated intrusion.
76
Security
CISA Adds SonicWall SonicOS MFA Bypass Flaw to Exploited Vulnerabilities List
Organisations running SonicOS should patch quickly, since the flaw may already be in use against systems that rely on SAML-based multi-factor authentication.
77
Security
Iris Ohyama data breach may have exposed records of 7.7 million people
Customers of Iris Plaza and related services now face a higher risk of phishing and unwanted contact, though no misuse has been reported so far.
78
Security
French bank Crédit Mutuel Arkéa hit by cyberattack via third-party provider
Customer assets are reported unaffected, but the bank's corporate account was used to move funds, and customers should expect more phishing attempts.
79
Security
Claude Code's approval file exposes passwords and keys in 1,122 public GitHub repositories
Deleting the file does not fix the leak, because older commits and forks keep the saved secrets, so affected credentials need rotating first.
80
Security
SonicWall patches SAML authentication bypass flaw already reported exploited
Organisations running SonicOS SSL VPN with SAML login should upgrade now, since the flaw can skip SAML-enforced MFA and has no workaround.