Cheap Fake 5G Base Station Can Track Subscribers, Researchers Show
A low-cost tool built by academic researchers shows that standalone 5G networks remain vulnerable to subscriber tracking through fake base stations.
Security & Privacy
Breaches, offensive and defensive AI, and surveillance.
New ARM64 KVM Flaw Lets Guest VMs Read and Write Host Memory
A newly disclosed Linux kernel vulnerability in ARM64 KVM virtualization could let a guest virtual machine read and rewrite host kernel memory when nested virtualization is enabled.
IDC: European AI Spending to Reach $470B by 2030
A new forecast shows rapid AI investment growth, but the report's focus on spending leaves security and privacy implications unaddressed.
Weekly Threat Roundup: Cisco Zero-Day, AI Agent RCE, ClickFix Surge
This week's attacks show how threat actors are exploiting trusted components like browsers, plugins, and login screens to deliver malware and gain access.
From Developer to Global CISO: Noopur Davis's Unplanned Path
A SecurityWeek interview shows how a developer who never planned a security career became Comcast's global CISO.
Belgian Table Tennis Federation Probes Cyberattack Over Member Data
The federation is investigating a claimed theft of personal data affecting tens of thousands of members.
Flock Camera Teardown: Sensitive ALPR Data Stayed Encrypted
A captured Flock license plate reader camera was reverse-engineered, showing that its most sensitive storage remained encrypted and inaccessible.
FBI CJIS v6.1 Tightens Encryption and Continuous Security Checks
The updated FBI policy pushes state and local agencies toward continuous security monitoring and stronger identity controls.
Microsoft Patches Excel Copy-Paste Breakage From September Updates
A fix is rolling out for all Office users after September 2026 security updates caused copy-and-paste failures in Excel.
LMU Munich cyberattack exposes student enrollment data
The breach at one of Germany's largest universities highlights the persistent risk to sensitive student financial and enrollment records.
Dragos Closes NetRise and runZero Acquisitions After Accenture Deal
The OT security vendor expands its platform with attack surface and exposure management capabilities under Accenture's majority investment.
LinkedIn wins court order to halt mass scraping and force data deletion
A court-approved agreement requires two firms to stop selling scraped LinkedIn data, delete what they took, and stop using fake accounts.
Engineer Sentenced for Insider Extortion Plot Against Industrial Firm
A former engineer's attempt to extort 20 bitcoin from an industrial firm by sabotaging its systems ends in a prison sentence.
NIS2 audit deadline looms: EU leaders face personal liability in 2026
A new guide from Passwork highlights that EU senior management can be held personally accountable for NIS2 compliance gaps as national audits begin in late 2026.
Microsoft: Move Entra ID Users to Passkeys Before SMS Retirement
Microsoft is phasing out SMS first-factor sign-in for Entra ID by February 2027, pushing admins to adopt phishing-resistant methods like passkeys.
Inherited AI Agents Slip Past Identity and Security Controls
Enterprise security built for deliberately adopted AI fails to govern the thousands of agents embedded in third-party products, leaving their reach and permissions unmanaged.
First North Korean Laptop Farm Shuttered in Japan as Allies Detail WaterPlum
A four-nation report exposes the scope of North Korea's WaterPlum campaign as Japan shuts down the first laptop farm.
D-Link warns of unpatched zero-day in legacy DIR-822A routers
D-Link has disclosed a maximum-severity zero-day in its legacy DIR-822A routers, with public exploit code and no fix available.