TECHNOLOGY · AI · CYBERSECURITY · THE SYSTEMS SHAPING BUSINESSCredentials, impersonation, fake profiles and the systems that verify who is who.
Google advises organizations to treat any internet-facing appliance that ran a vulnerable version as potentially compromised, then rebuild it and rotate the credentials it held.
An FBI alert lists fake political action committees, bogus investment pools and phony voter-registration pages, with AI-made voices and images making them harder to spot.
The largest U.S. bank says agents that log in with customers' passwords are too risky, while it still supports data sharing through approved open-banking channels.
A Florida court order lets Microsoft and Health-ISAC take over web addresses used by an account marketplace and two phishing kits that Microsoft says earned their operators tens of millions of dollars.
A Joint Economic Committee investigation says some Tinder scam-detection models went years without updates; Match Group calls that claim false and points to new selfie checks.
Researchers say intruders reached root on an up-to-date appliance without leaving a web shell, and Ivanti’s own integrity tool may not spot it.
An Ohio indictment says the scheme placed workers at more than 70 U.S. employers, as the FBI warns facilitators now run smaller, harder-to-spot laptop farms.
A former U.S. acting national cyber director, a Microsoft security executive and three other experts name the risks they think leaders underrate, from indifference to post-quantum delays.
The figures come from one security company's own clients, sit behind a download form and were promoted in sponsored content, but they point to questions dealer boards can ask now.
The company accuses China's Zhipu and Moonshot of feeding on Claude's outputs, and its countermeasures change how developers' integrations work and what blocked requests cost.
The regulator held the ad-tech firm jointly liable for consent it took on trust from the dating app, and based the penalty on Xandr’s revenue rather than Microsoft’s.
Federal officials say staffing losses, unfunded transitions and identity smart cards are the hard parts of replacing cryptography that future quantum computers could break.
A Cologne labor appeals court ruled that a company-paid D&O policy strips the usual limits on employee liability, a question now headed to Germany’s top labor court.
Control of the .gh, .sl and .as registries let attackers rewrite DNS and pass certificate checks for Google domains and several unnamed global brands.
About 1,500 people, mostly Meta employees in the U.S., are being notified because personal data had been stored in code repositories against company policy.
For about two years, converting an account into an organization quietly moved its access keys to a named owner, a gap that could have let attackers push images under trusted names.
The quantum computing company plans to pair Elisity's network access controls with its quantum-resistant encryption products, pitching both to buyers facing a post-quantum deadline.
Organizations that renew web certificates by hand or on fixed schedules have until Feb. 10 to adjust, and test certificates arrive Oct. 14.
Test domains imitating Apple, OpenAI and Okta displayed as ordinary text with valid certificates in Chrome 154, and Gmail showed the fake senders without flagging them.
The subscription service, launched as Reacher and later renamed Stryx, said its records included bank account numbers and that it had handled 3.1 million requests.
New advisory guidance from the card industry's standards body also covers AI inventories, least-agency access, adversarial testing and contracts that bar training on customer data.
Customer names and contact details on third-party platforms were exposed, the retailer said, but it has not disclosed how many people were affected or whether data was taken.
A year of internal messages describes Telegram job ads, forged IDs and flash-drive thefts aimed at about 50 organizations, most of them law firms.