The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
10 stories match. Clear filters
-
Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined. As of today, other…
-
China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP)…
-
Your Mobile Carrier Stores Your Call Logs for Years
Mobile carriers can retain years of call and text metadata, exposing sensitive details about customers' relationships, locations, and daily routines if breached. Cape examines the privacy risks of long-term telecom data retention and how its mobile service reduces exposure by automatically…
-
Survey Finds High-Profile Executives Feel Untouchable as Digital Exposure Turns Into Physical Risk
360 Privacy finds more than 8 in 10 security and wealth professionals say cybersecurity and physical security can no longer be separated.
-
Ireland's Data Protection Commission fines Google €403 million over location data handling
Ireland's DPC fined Google €403 million (roughly $460 million) following an inquiry into how three Google features processed users' location data, finding GDPR violations. This is one of the larger single GDPR penalties of the year and adds to a growing line of location-data enforcement actions…
-
Iran-linked Handala Hack tied to HEAVYGRAM Telegram backdoor
Group-IB attributes a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi loader called CRUDEEXCLUDE to the Iran-linked hacktivist persona Handala Hack. HEAVYGRAM supports remote command execution, discovery, exfiltration including Telegram session files, screenshot capture, DLL…
-
Data Broker Radaris Loses Domains in Privacy Fight
The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up with the company recently in a lawsuit alleging Radaris violated a New Jersey privacy law that…
-
Mantax Otax, an Android strain that combines ransomware, spyware, and victim harassment
Zimperium documented Mantax Otax, an Android malware family linked to Indonesian operators that merges surveillance and ransomware in one package. It records the screen in real time, extracts browser history, lock-screen PINs, contacts, call logs, SMS messages, one-time passcodes, installed…
-
Texas and Florida order removal of license-plate-reader cameras from state infrastructure
Texas Gov. Abbott (Aug 28) barred state agencies from spending public funds on Flock ALPR cameras, timed just ahead of a Texas Tribune investigation showing a state agency had funneled $30M+ into a surveillance network. Florida DOT (Aug 31, announced by Gov. DeSantis) ordered all ALPRs removed…
-
TikTok reaches 400 million dollar COPPA settlement with DOJ
The Department of Justice announced a 400 million dollar settlement with TikTok, ByteDance, and affiliated companies over allegations they violated the Children's Online Privacy Protection Act. TikTok pays 300 million immediately and 100 million more once an order vacates the prior consent decree…