Sam Bowne

Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls

Trump bans CNN, MS NOW, Politico from White House for ‘fake news’

The US president insists media outlets report 'fiction and lies' as he announces new bans on White House access.

ScienceAlert

A 3-Year-Old's Metastatic Cancer Disappeared After Two Doses of Experimental Therapy

A powerful advance in cancer-fighting medicine has achieved an extraordinary new milestone.

CISA Releases Cyber Decoy Guidance to Strengthen Critical Infrastructure Defenses

CISA released guidance on deploying cyber decoys alongside existing Zero Trust models to identify and block malicious activity.

EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts

The EvilTokens platform that compromised more than 12,000 Microsoft accounts at over 10,000 organizations has been disrupted in an effort led by Microsoft's Digital Crimes Unit (DCU).

Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise

The 31 Out-of-this-World Winners of Astronomy Photographer of the Year

Aurorae, galaxies, planets, the Moon, nebulae, and more!

Rogue external MFA providers can steal passwords during logins

Security researchers developed an attack that lets hackers with privileged access register a rogue external MFA provider that steals users' passwords during legitimate login attempts.

Tucker Carlson on his MAGA split and Trump's 'nihilism' | NPR's Newsmakers

China says AI CEOs' call for a slowdown is 'fear mongering'

Chinese state media's reports of the daily press conference also noted that all groups should work together for AI openness and inclusivity.

Futurism

Mathematicians Can't Make Sense of How OpenAI's Agents Solved One of the Toughest Math Problems Because the AI's "Proof" Is Borderline Incomprehensible

Mathematicians say they're still unpacking OpenAI's solution for the Navier-Stokes problems because the AI's proof is nearly incomrehensible.

Placeholder domain used in dev docs now serves ClickFix attacks

The "third-party.com" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands.

CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories

Techdirt

Meta’s AI Agent Muse Launches With Nasty Zero-Day Flaw, Then Gets Blocked By Amazon

After burning $80 billion on the failed metaverse pivot — and billions more on desperate “me too” offerings in the AI space — Meta is looking to leverage its massive ad domi…

Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity

Abdelhamid Naceri is the real identity of the researcher and Microsoft exploit leaker known online as Nightmare Eclipse and Chaotic Eclipse.

LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings

Techdirt

DC Circuit OK’s Hegseth’s Abuse Of A Crummy Statute To Punish AI Vendors Who Won’t Give Him The Deadly Toys He Wants

Pete Hegseth and Trump got a dubious win today: a 2-1 panel of the DC Circuit found that the designation of Anthropic as a supply chain risk was not unlawful. It dismissed Anthropic’s challen…

Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories

Schneier on Security

New Attack Against RSA - Schneier on Security

ArsTechnica is reporting on a “new” attack against RSA, one that bypasses factoring. First, this attack isn’t new. The original research is from 2007. What is new is the implementation. Second, it is a forgery attack. It allows an attacker to forge digital signatures. It does not recover the private key from the public key. Third, the attack only works against pure signatures. That is, signatures without any formatting or padding. This is not generally how we use RSA in practice. Fourth, speed i

Hackers target exposed Vite dev servers to steal AWS, Azure secrets

A mass-scanning campaign targeting internet-exposed Vite development servers is attempting to steal cloud credentials and configurations from AWS and Azure deployments.

IQVIA fined $7.8 million for failing to properly anonymize health data

Italy's Data Protection Authority (GPDP) has fined IQVIA €7 million ($7.8M) over poor data-processing practices that the agency says could have put roughly one million patients at risk of data exposure and de-anonymization.

Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords

Cloudflare Blog

Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)

Automatic Key Exchange probes TLS 1.3-capable customer origins to learn which key agreement algorithms they support. We then lead with the most secure algorithm when connecting to the origin, preferring post-quantum connections wherever the origin supports it.

Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR