Cybersecurity
353 articles RSS
42 Attorneys General Win $18 Million From 23andMe Over Genetic Data Breach as Bankruptcy Court Blocks California's Damages Claim
A 42-attorney-general coalition settled bankruptcy claims against 23andMe for $18 million over the 2023 breach of 6.9 million genetic profiles, days after a court barred California from separately pursuing damages.
GitHub Makes a Three-Day Package Cooldown the Default for Dependabot Version Updates, Citing Supply-Chain Attacks Through New Releases
Dependabot now waits three days before proposing new dependency versions by default. GitHub says the delay keeps freshly compromised releases out of update pull requests; security updates are exempt and repositories can opt out.
WordPress Forces Automatic Updates to Patch wp2shell, a Pre-Authentication RCE Chain in Core, as Public Exploits Circulate
WordPress shipped 7.0.2 and 6.9.5 on July 17 and enabled forced auto-updates to fix wp2shell, a two-CVE chain allowing unauthenticated remote code execution in core, as public proof-of-concept exploits circulate.
Kaspersky Uncovers GoSerpent, a Go-Based Backdoor Spying on Southeast Asian Governments Since Late 2025
Kaspersky's GReAT team found a new Go-language RAT and toolkit hitting government and diplomatic targets in Southeast Asia, with a possible link to the TetrisPhantom espionage actor.
JetBrains Patches Critical Path-Traversal Flaw in IntelliJ IDEA, Five More Bugs Across TeamCity and YouTrack
JetBrains disclosed six vulnerabilities across IntelliJ IDEA, TeamCity, and YouTrack on July 16, led by a critical 9.8 CVSS path-traversal flaw in IntelliJ IDEA.
IBM and Red Hat Expand Lightwell With Commercial Offerings to Secure Open Source Software Supply Chains
IBM and Red Hat launched commercial Lightwell offerings on July 8, building on their $5 billion pledge to secure open source software supply chains.
SonicWall Patches Two Chained SMA1000 Zero-Days as CISA Sets a July 17 Deadline for Federal Agencies
CVE-2026-15409 and CVE-2026-15410 were exploited together against SMA1000 appliances before patches shipped, CISA says.
Accenture Confirms Data Breach After Hacker Claims Theft of 35GB of Source Code and Azure Keys
Accenture confirmed a security incident after a hacker known as "888" listed 35GB of alleged source code, RSA/SSH keys, and Azure access tokens for sale on a cybercrime forum.
npm v12 Ships With Install Scripts Disabled by Default After a Year of Supply-Chain Attacks
npm v12 disables install scripts, Git dependencies, and remote-URL dependencies by default, closing the execution path several npm worms exploited over the past year.
AssuranceAmerica Data Breach Exposes Driver's License Records of Nearly 7 Million People
AssuranceAmerica is notifying 6.99 million people that hackers stole driver's license numbers and insurance records after a March cyberattack on an employee account.
Coinspect Discloses 'Ill Bloom' Flaw That Has Drained at Least $5 Million From Weak-Randomness Crypto Wallets
Coinspect says a weak-randomness flaw in recovery-phrase generation, dubbed Ill Bloom, has let attackers drain at least $5 million from crypto wallets since May 27.
Sysdig Documents JadePuffer, Which It Calls the First Ransomware Attack Run End-to-End by an AI Agent Exploiting a Langflow Flaw
Sysdig says JadePuffer used an LLM agent to exploit Langflow flaw CVE-2025-3248, run 600-plus payloads, and encrypt 1,342 Nacos config items.