Bitget Exchange Loses $387.5 Million After Attackers Exploit A Zero-Day In Security Software 18 Months In Prison. Wrong Username. OpenInfra Europe’s JFrog Artifactory Breached — Anyone Who Pulled Packages Between August 28 and September 15 Should Assume Compromise CISA Warns A Single Crafted Request Can Give Root On Exposed MikroTik Routers More Than Half A Million GitHub Credentials Were Still Valid Years After Being Posted — Some From 2009

In this issue:

Bitget Exchange Loses $387.5 Million After Attackers Exploit A Zero-Day In Security Software 18 Months In Prison. Wrong Username. OpenInfra Europe’s JFrog Artifactory Breached — Anyone Who Pulled Packages Between August 28 and September 15 Should Assume Compromise CISA Warns A Single Crafted Request Can Give Root On Exposed MikroTik Routers More Than Half A Million GitHub Credentials Were Still Valid Years After Being Posted — Some From 2009

In this issue:

• Citrix’s NetScaler Zero-Days Were Exploited For Weeks Before Anyone Patched
• Apple Patches A Zero-Day Used In An “Extremely Sophisticated” Spyware-Style Attack
• A Pentagon Personnel Database Was Quietly Open For Nine Months
• An AI Agent Broke Into A Vulnerability-Disclosure Nonprofit, And Was Bad At It
• Mark E. Jeftovic: What’s Really Behind The AI Panic

In this issue:

• Citrix’s NetScaler Zero-Days Were Exploited For Weeks Before Anyone Patched
• Apple Patches A Zero-Day Used In An “Extremely Sophisticated” Spyware-Style Attack
• A Pentagon Personnel Database Was Quietly Open For Nine Months
• An AI Agent Broke Into A Vulnerability-Disclosure Nonprofit, And Was Bad At It
• Mark E. Jeftovic: What’s Really Behind The AI Panic

In this issue:

• Google Confirms Gemini Broke Into Three Real Companies During A Security Test
• Cisco Patches Two Actively Exploited Zero-Days In Two Days
• Microsoft Takes Down An AI-Powered Phishing Platform That Hit 12,000 Accounts
• Ireland Fines Google $463 Million Over How It Handled Your Location History
• A Maximum-Severity D-Link Router Bug Has No Patch And A Public Exploit

https://youtu.be/LhHjgNFWLso

In this issue:

• Google Confirms Gemini Broke Into Three Real Companies During A Security Test
• Cisco Patches Two Actively Exploited Zero-Days In Two Days
• Microsoft Takes Down An AI-Powered Phishing Platform That Hit 12,000 Accounts
• Ireland Fines Google $463 Million Over How It Handled Your Location History
• A Maximum-Severity D-Link Router Bug Has No Patch And A Public Exploit

A Compromised HBO Max Account Became A Malware Storefront Iran’s Spyware Playbook: Befriend You On WhatsApp, Then Own Your Laptop Chinese Spies Turned Google’s Own Bug Fixes Into A Working Exploit Google Patches A Zero-Click Pixel Bug That Was Already Being Used On Real Phones A Fake Government Email Got Revolut To Hand Over Passports And Bitcoin Histories

In This Issue:

A Compromised HBO Max Account Became A Malware Storefront Iran’s Spyware Playbook: Befriend You On WhatsApp, Then Own Your Laptop Chinese Spies Turned Google’s Own Bug Fixes Into A Working Exploit Google Patches A Zero-Click Pixel Bug That Was Already Being Used On Real Phones A Fake Government Email Got Revolut To Hand Over Passports And Bitcoin Histories

Your LG TV Is Listening Even When It’s “Off” A Swarm Of OpenAI Agents Secretly Ran A German Wiki As Their Message Board For Three Months Hackers Drain $320 Million From Liquid Network, Then Give Most Of It Back Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days Trezor’s Address Breach Just Went Analog: Scam Letters With Malicious QR Codes Anthropic Employee (for six weeks) Sounds the Alarm on AI Alignment

In this issue:

Your LG TV Is Listening Even When It’s “Off” A Swarm Of OpenAI Agents Secretly Ran A German Wiki As Their Message Board For Three Months Hackers Drain $320 Million From Liquid Network, Then Give Most Of It Back Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days Trezor’s Address Breach Just Went Analog: Scam Letters With Malicious QR Codes Anthropic Employee (for six weeks) Sounds the Alarm on AI Alignment

A dark-web service is selling scans of 153 million U.S. and Canadian driver’s licences, and the trail points at the vendor that scans IDs at rental counters and dispensaries. A cyberattack knocked out Boston Scientific’s order-and-shipping systems worldwide and delayed activation of new pacemaker home monitors. A perfect-storm JFrog Artifactory bug lets anyone mint an admin token, and attackers were forging them within three days of the patch. Researchers spent $535.74 and eight and a half hours getting Claude to port a working exploit to an industrial controller — then it bricked the device. Two more surveillance backdoors turned up in Chinese-made routers sold worldwide under brand names the real manufacturer never prints on the box.

In this issue:

A dark-web service is selling scans of 153 million U.S. and Canadian driver’s licences, and the trail points at the vendor that scans IDs at rental counters and dispensaries. A cyberattack knocked out Boston Scientific’s order-and-shipping systems worldwide and delayed activation of new pacemaker home monitors. A perfect-storm JFrog Artifactory bug lets anyone mint an admin token, and attackers were forging them within three days of the patch. Researchers spent $535.74 and eight and a half hours getting Claude to port a working exploit to an industrial controller — then it bricked the device. Two more surveillance backdoors turned up in Chinese-made routers sold worldwide under brand names the real manufacturer never prints on the box.

In This Issue:

DOJ and FBI Seize Chinese State-Backed Hacking Platforms That Hit NASA, the Fed, and the Senate AI Hallucinates Domains for Your Brand. Criminals Are Already Registering Them. Microsoft Patches a Maximum-Severity Entra ID Flaw — Then Walks Back the “Exploited” Claim DOJ Charges 17 More Iranians in a Decade-Long Campaign That Stole 31 Terabytes From 144 US Universities OpenAI Hits the Brakes on Model Training After Its Own Agent Hacked Hugging Face

In This Issue:

DOJ and FBI Seize Chinese State-Backed Hacking Platforms That Hit NASA, the Fed, and the Senate AI Hallucinates Domains for Your Brand. Criminals Are Already Registering Them. Microsoft Patches a Maximum-Severity Entra ID Flaw — Then Walks Back the “Exploited” Claim DOJ Charges 17 More Iranians in a Decade-Long Campaign That Stole 31 Terabytes From 144 US Universities OpenAI Hits the Brakes on Model Training After Its Own Agent Hacked Hugging Face

Apple’s Spyware Pager Goes Off in 110 Countries A Nation-State Crew Rooted 361 vCenter Servers in 47 Countries — Patch  Was Out Five Days Nine Fortune 500 Names, Millions of Records: The Azure Credential Dump  Nobody’s Calling a Breach GeoServer’s Unpatched Zero-Day Is Getting Probed Right Now, and There’s  No Fix Yet The March Supply-Chain Attack That Keeps Getting Bigger: LiteLLM’s  2,500-Company Hangover

In this issue:

Apple’s Spyware Pager Goes Off in 110 Countries A Nation-State Crew Rooted 361 vCenter Servers in 47 Countries — Patch  Was Out Five Days Nine Fortune 500 Names, Millions of Records: The Azure Credential Dump  Nobody’s Calling a Breach GeoServer’s Unpatched Zero-Day Is Getting Probed Right Now, and There’s  No Fix Yet The March Supply-Chain Attack That Keeps Getting Bigger: LiteLLM’s  2,500-Company Hangover

Facial Recognition Comes to the London Underground, Whether You Signed  Up or Not Google’s Synced Passkeys Have a Master Key — And It Can’t Be Revoked Metabase Zero-Day Bites Framework: Names, Emails, and a Reminder About Vendor Trust Hackers Pivot Through a Private Cell Network Into a Polish Power Plant’s OT Network North Carolina’s Ports Go Manual After a Cyberattack Nobody Wants to Talk About Your Kid’s GPS Watch Was Built on the Same Three Leaky Backends As Everyone Else’s

The npm Worm That Ate The JavaScript Supply Chain 75 Million Revolut Records For Sale, Revolut Says Nothing To See Here Your “Private” Claude Chats Were On Google The Whole Time Cisco’s Firewall Manager Had Hard-Coded Credentials, Guess What Happened VMware’s vCenter Has A “Skip Authentication Entirely” Button Now Brussels Starts Actually Enforcing The AI Act This Week

In this issue:

The npm Worm That Ate The JavaScript Supply Chain 75 Million Revolut Records For Sale, Revolut Says Nothing To See Here Your “Private” Claude Chats Were On Google The Whole Time Cisco’s Firewall Manager Had Hard-Coded Credentials, Guess What Happened VMware’s vCenter Has A “Skip Authentication Entirely” Button Now Brussels Starts Actually Enforcing The AI Act This Week