Latest Cybersecurity News and Articles

---

In Other News: iOS 26 Deletes Spyware Evidence, Shadow Escape Attack, Cyber Exec Sold Secrets to Russia

Other noteworthy stories that might have slipped under the radar: Everest group takes credit for Collins Aerospace hack, Maryland launches VDP, gamers targeted with red teaming tool and RAT. The post In Other News: iOS 26 Deletes Spyware Evidence, Shadow Escape Attack, Cyber Exec Sold Secrets to Russia appeared first on SecurityWeek.

---

Protecting And Managing Unstructured Data At Scale

This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 24, 2025 – Watch the YouTube video “We’re facing what can feel like an impossible challenge: Cutting spend while unstructured data continues to grow, reducing risk from ransomware, while enabling high The post Protecting And Managing Unstructured Data At Scale appeared first on Cybercrime Magazine.

---

Toys ‘R’ Us Canada Customer Information Leaked Online

The customer information published on the dark web includes names, addresses, phone numbers, and email addresses. The post Toys ‘R’ Us Canada Customer Information Leaked Online appeared first on SecurityWeek.

---

The Cybersecurity Perception Gap: Why Executives and Practitioners See Risk Differently

Does your organization suffer from a cybersecurity perception gap? Findings from the Bitdefender 2025 Cybersecurity Assessment suggest the answer is probably “yes” — and many leaders may not even realize it. This disconnect matters. Small differences in perception today can evolve into major blind spots tomorrow. After all, perception influences what organizations prioritize, where they

---

3,000 YouTube Videos Exposed as Malware Traps in Massive Ghost Network Operation

A malicious network of YouTube accounts has been observed publishing and promoting videos that lead to malware downloads, essentially abusing the popularity and trust associated with the video hosting platform for propagating malicious payloads. Active since 2021, the network has published more than 3,000 malicious videos to date, with the volume of such videos tripling since the start of the

---

Microsoft Disables Downloaded File Previews to Block NTLM Hash Leaks

In files downloaded from the internet, HTML tags referencing external paths could be used to leak NTLM hashes during file previews. The post Microsoft Disables Downloaded File Previews to Block NTLM Hash Leaks appeared first on SecurityWeek.

---

Pwn2Own WhatsApp Hacker Says Exploit Privately Disclosed to Meta

Questions have been raised over the technical viability of the purported WhatsApp exploit, but the researcher says he wants to keep his identity private. The post Pwn2Own WhatsApp Hacker Says Exploit Privately Disclosed to Meta appeared first on SecurityWeek.

---

Self-Spreading 'GlassWorm' Infects VS Code Extensions in Widespread Supply Chain Attack

Cybersecurity researchers have discovered a self-propagating worm that spreads via Visual Studio Code (VS Code) extensions on the Open VSX Registry and the Microsoft Extension Marketplace, underscoring how developers have become a prime target for attacks. The sophisticated threat, codenamed GlassWorm by Koi Security, is the second such supply chain attack to hit the DevOps space within a span

---

North Korean Hackers Lure Defense Engineers With Fake Jobs to Steal Drone Secrets

Threat actors with ties to North Korea have been attributed to a new wave of attacks targeting European companies active in the defense industry as part of a long-running campaign known as Operation Dream Job. "Some of these [companies' are heavily involved in the unmanned aerial vehicle (UAV) sector, suggesting that the operation may be linked to North Korea's current efforts to scale up its

---

Russian Government Now Actively Managing Cybercrime Groups: Security Firm

The relationship between the Russian government and cybercriminal groups has evolved from passive tolerance. The post Russian Government Now Actively Managing Cybercrime Groups: Security Firm appeared first on SecurityWeek.

---

AI Sidebar Spoofing Puts ChatGPT Atlas, Perplexity Comet and Other Browsers at Risk

SquareX has shown how malicious browser extensions can impersonate AI sidebar interfaces. The post AI Sidebar Spoofing Puts ChatGPT Atlas, Perplexity Comet and Other Browsers at Risk appeared first on SecurityWeek.

---

Africa: Shifting From Cyber ‘Security’ To Cyber ‘Resilience’

This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 23, 2025 – Read the full story in ITWeb Experts who spoke at the Cyber Security Summit 2025, hosted by SNG Grant Thornton this week in Johannesburg, urged a shift in focus The post Africa: Shifting From Cyber ‘Security’ To Cyber ‘Resilience’ appeared first on Cybercrime Magazine.

---

Secure AI at Scale and Speed — Learn the Framework in this Free Webinar

AI is everywhere—and your company wants in. Faster products, smarter systems, fewer bottlenecks. But if you're in security, that excitement often comes with a sinking feeling. Because while everyone else is racing ahead, you're left trying to manage a growing web of AI agents you didn’t create, can’t fully see, and weren’t designed to control. Join our upcoming webinar and learn how to make AI

---

ThreatsDay Bulletin: $176M Crypto Fine, Hacking Formula 1, Chromium Vulns, AI Hijack & More

Criminals don’t need to be clever all the time; they just follow the easiest path in: trick users, exploit stale components, or abuse trusted systems like OAuth and package registries. If your stack or habits make any of those easy, you’re already a target. This week’s ThreatsDay highlights show exactly how those weak points are being exploited — from overlooked

---

Vibe Coding’s Real Problem Isn’t Bugs—It’s Judgment

As AI coding tools flood enterprises with functional but flawed software, researchers urge embedding security checks directly into the AI workflow. The post Vibe Coding’s Real Problem Isn’t Bugs—It’s Judgment appeared first on SecurityWeek.

---

Exploitation of Critical Adobe Commerce Flaw Puts Many eCommerce Sites at Risk

Patched in September, the SessionReaper bug could be exploited without authentication to bypass a security feature. The post Exploitation of Critical Adobe Commerce Flaw Puts Many eCommerce Sites at Risk appeared first on SecurityWeek.

---

Why Organizations Are Abandoning Static Secrets for Managed Identities

As machine identities explode across cloud environments, enterprises report dramatic productivity gains from eliminating static credentials. And only legacy systems remain the weak link. For decades, organizations have relied on static secrets, such as API keys, passwords, and tokens, as unique identifiers for workloads. While this approach provides clear traceability, it creates what security

---

BIND Updates Address High-Severity Cache Poisoning Flaws

The vulnerabilities allow attackers to predict source ports and query IDs BIND will use, and to inject forged records into the cache. The post BIND Updates Address High-Severity Cache Poisoning Flaws appeared first on SecurityWeek.

---

Lanscope Endpoint Manager Zero-Day Exploited in the Wild

The bug has been exploited in the wild as a zero-day and the US cybersecurity agency CISA has added it to its KEV catalog. The post Lanscope Endpoint Manager Zero-Day Exploited in the Wild appeared first on SecurityWeek.

---

Mobile Security: Verizon Says Attacks Soar, AI-Powered Threats Raise Alarm

Verizon’s 2025 Mobile Security Index shows that 85% of organizations believe mobile device attacks are on the rise. The post Mobile Security: Verizon Says Attacks Soar, AI-Powered Threats Raise Alarm appeared first on SecurityWeek.