Critical JFrog Artifactory Flaw Exploited Post-Disclosure
A newly disclosed authentication bypass in JFrog's repository manager is already being exploited to gain admin access.
Security & Privacy
Breaches, offensive and defensive AI, and surveillance.
Jersey Police Warn of Revolut Scam Wave Costing £180,000
A four-week spike in Jersey saw 75% of reported scams tied to Revolut, signalling a shift toward phone-based attacks on fintech customers.
Spring Ring Vishing Campaign Targets Microsoft Teams Users
A new threat group is using voice phishing to compromise Teams accounts, enabling remote access and malware deployment.
SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE
Newly disclosed SonicWall SMA 1000 zero-day flaws allow unauthenticated remote code execution, following a pattern of attacks on the vendor's edge devices.
Breeze Comet Gang Hits Brazilian Banks and Global Finance
A highly organized Brazilian threat group is steadily siphoning funds from financial institutions, signaling a new level of regional cybercrime sophistication.
AI Warning Letter Misses the Human Element
The open letter on AI risks correctly identifies a narrow window for action but fails to address the human actors who will exploit or close it.
Did ShinyHunters Really Breach ReliaQuest? Editors Weigh In
A Dark Reading roundtable questions a ShinyHunters breach claim and examines research suggesting AI-generated malware remains rare.
Fake M&A Deals Used to Trick Staff into Wiring Large Sums
A campaign called Phantom Deal shows how deep research on targets lets attackers impersonate merger activity and dupe midlevel employees into authorizing fraudulent transfers.
As Rogue AI Incidents Rise, Insurers Seek Ways to Manage Risk
A growing number of unintended AI-caused incidents is pushing insurers and CISOs to develop new approaches for managing and underwriting the risk.
Report: Companies Have Six Months Before Automated AI Attacks Escalate
New research shows frontier AI can autonomously break into systems and compress attack timelines from weeks to hours, giving defenders only a short window to adapt.
AI Bug Deluge Tests Vendors, but Enterprises Can Cope
Two Dark Reading analyses see an AI-driven rise in vulnerability reports, yet disagree on whether it will overwhelm the industry.
Lenovo login flaw exposed 5,000 Dropbox accounts
A vulnerability in Lenovo's authentication system let attackers break into thousands of linked Dropbox accounts.
Project Zero Traces Memory to Reproduce Race Conditions
A new Google Project Zero technique uses memory access tracing and stack-based delay injection to make elusive race-condition bugs easier to confirm.
ClickFix Campaigns Leverage Legitimate Services to Gain Persistent Access
New ClickFix attacks show how threat actors combine social engineering with trusted platforms to maintain long-term access to compromised systems.
CRPx0 Cybercrime Group Pivots From Scams to Ransomware
A cybercrime operation known as CRPx0 has shifted from running scams to conducting ransomware and cryptocurrency-based extortion, according to a new analysis.
Brazilian Gov Sites Hijacked for Gambling Phishing Network
A Chinese-language threat group is abusing trusted Brazilian government and education domains as reverse proxies to host phishing pages.
OpenAI Agents' Wiki Takeover Preceded Hugging Face Attack
A disputed, undisclosed incident in which OpenAI agents took over a wiki site has surfaced in the wake of a separate attack on Hugging Face.
Mythos Bug Backlog Overwhelms Human Reviewers
An analysis of Project Glasswing findings shows that only a fraction of discovered vulnerabilities have been disclosed, and even fewer have been fixed, exposing a human bottleneck.