Sweden Fines Miljödata $183,000 for Breach Affecting 2.2 Million
Sweden's privacy regulator penalized IT provider Miljödata for security failures linked to a breach that exposed 2.2 million people's data.
Security & Privacy
Breaches, offensive and defensive AI, and surveillance.
Google Fined €403 Million by Irish DPC Over Location Data
The penalty targets Google's GDPR breaches in handling user location data and includes a six-month compliance order.
CISA Adds Three Exploited Linux Kernel Flaws to KEV Catalog
The agency's move signals active attacks and pressures federal agencies to patch quickly.
Film Torrents Carry New Malware, Victims Found in Kenya and Uganda
Cybercriminals are using popular movie torrents to distribute fresh malware, with confirmed infections in East Africa.
AI Agent Cost Runaway Risks Enterprises, OWASP Warns
A recognized but underappreciated flaw in LLM applications may let AI agents consume resources without limits, leading to severe financial damage.
BigCommerce Warns Merchants of Breach via Third-Party Ribon Apps
Compromised credentials for third-party Ribon applications allowed attackers to inject malicious scripts into BigCommerce online stores.
Fake LastPass Installers Deploy Kernel-Level EDR Killer and Stealer
A campaign using fake LastPass installers disables endpoint security tools at the kernel level to deliver the Rapuncel infostealer.
Microsoft to Retire Calendar, People, Files Companion Apps in December
Microsoft will retire three Microsoft 365 companion apps on December 16, prompting admins to remove them from managed devices.
TASK#STOMP Backdoor Steals Documents, Wi-Fi Passwords, and More
A newly disclosed PowerShell backdoor campaign, TASK#STOMP, targets Windows hosts to exfiltrate business documents and sensitive credentials.
OpenAI Patches Codex Sandbox Flaws After Researchers Escape Twice
Two sandbox escape techniques from OpenAI Codex, including one that ran commands on a developer's machine, have been patched.
Malicious npm package hides payload in runtime, not install scripts
A new npm campaign shows attackers can bypass supply-chain checks by triggering malicious behavior only when the package runs, not during installation.
BragJack Attack Turns Browser AI Assistants Into Attack Tools
A newly disclosed attack technique, BragJack, exploits built-in browser AI assistants to steal data and execute malicious actions.
Identity Visibility Seen as Foundation for Modern Identity Security
A new analysis argues that organizations cannot secure identities they cannot see, pointing to stolen credentials as a leading breach entry point.
ShinyHunters Breaches Clop's Leak Site, Threatens Extortion
The ShinyHunters extortion group has turned the tables on Clop by hacking and defacing the ransomware gang's own data leak site.
AI Actress 'Talking Tilly' Requires Face Scan for Calls
A viral AI video-call service collects facial and mood data from callers, raising privacy concerns before it shuts down.
Orkes Conductor RCE Flaw CVE-2026-58138 Exploited in the Wild
Attackers are actively exploiting a critical unauthenticated remote code execution vulnerability in Orkes Conductor via inline workflow definitions.
TigerByte Cyber Exits Stealth With $3M and US Government Contracts
The cybersecurity startup has secured over $7 million in contracts with US Space Force, Navy, and DARPA.
AI Deployment Outpaces Governance, EY Survey Finds
A new EY survey of senior AI executives finds that organizations are rolling out autonomous systems faster than they are building the controls to oversee them.