TECHNOLOGY · AI · CYBERSECURITY · THE SYSTEMS SHAPING BUSINESSPage 6 of 8: earlier stories.
The platform serves more than 600,000 businesses, and an attacker calling itself Fingerprint claims to hold 6 terabytes of invoices; Poland says its national e-invoicing system was not hit.
The designations target the first fugitive on the FBI's Ten Most Wanted list sought for cybercrime, along with associates, Mexican companies and TRON wallets tied to Tren de Aragua.
The wallet maker says users' funds are not under immediate threat, but its staking arm is pulling Ethereum validators offline while it remediates the incident.
South Korea’s financial watchdog opened an emergency inspection after the lender reported that an outside party bypassed authentication on a loan-broker platform.
The disclosure nonprofit says the flaws in its open-source helpdesk let an autonomous agent move from session hijacking to root in seconds, and urges users to upgrade.
Leaked npm tokens were almost all dead, but more than half of exposed Google Cloud service account keys still worked, the researchers found.
CISA rates CVE-2026-84411 at 9.8 and says no attacks are known yet, but MikroTik routers have been a recurring botnet target.
A URI-encoding trick lets unauthenticated requests slip past an API login check, and CISA has given federal agencies three days to fix it.
GTIG counted 141 exploited flaws in eight months, more than all of 2025, and found AI-discovered bugs are twice as likely to allow remote code execution.
Ukraine’s cyber agency points to the DarkSword iPhone exploit kit and two Android spyware families spread through fake military and air-raid alert apps.
The exchange's post-mortem traces the intrusion back to Aug. 31, more than three weeks before attackers drained its hot and warm wallets.
Attackers used a fresh JFrog Artifactory flaw three days after disclosure, and the break-in went unnoticed for about two weeks.
A default trust_remote_code setting turned a routine metadata check into code execution; the fix shipped in June, but no CVE or advisory was issued.
Anthropic researchers say the Chinese model's refusals can be stripped for about $1,200 in compute, leaving near-frontier exploit skills available to anyone.
Researchers tested 21 vehicles and 30 companion apps with Consumer Reports and found that using a carmaker's app roughly doubles exposure to ad and tracking firms.
Lures posing as Zoom installers, Acrobat updates and DHL notices delivered MSP360 RMM, which then pulled in ScreenConnect as a second remote channel.
A shared backup format means message history can now move between Android, iOS and desktop, protected by a recovery key that attackers are already hunting.
While stationed at Dover Air Force Base, the pair phished employee logins and rerouted payments, including a $1.7 million transfer from an Iowa City victim.
Dozens of organizations in North America and Europe were breached through Citrix gateways at least three weeks before the flaws were disclosed, the firm says.
A merger with Nasdaq-listed Bold Eagle Acquisition would put a commercial spyware vendor under SEC reporting rules, with the deal expected to close around year-end.
The bureau's cyber chief addressed the extortion crew directly in a video, and Director Kash Patel confirmed U.S. agents helped Dutch police make this month's arrest.
The FSB-linked actor ran 13 large campaigns this year using think-tank event lures and a new one-click infection chain called RedFlick that installs a Python backdoor.
The Theori spinout will point its AI bug-finding system at messaging apps such as Signal, from the app code down to the Android kernel.
A Rotterdam court ordered the 24-year-old, a previously convicted hacker working in security, held for at least 90 days as police pursue two separate cases.