Information Security Magazine

Google API key flaw exposes mobile apps to Gemini AI access, private files and billing risks

Ninja Forms File Upload RCE via unauthenticated arbitrary file upload; update to 3.3.27 immediately

Anthropic launches Project Glasswing, using its Claude Mythos Preview AI to autonomously identify and fix undiscovered vulnerabilities in critical software

The FBI deployed a method to unplug US-based routers compromised by APT28 from the threat actor’s malicious network

Anthropic’s Claude AI has helped researchers find a vulnerability in Apache ActiveMQ Classic

CISA has revealed Iranian attacks causing disruption and financial loss at US critical infrastructure firms

Newly identified malicious campaigns are linked to virtual private servers modified by APT28 to operate as malicious DNS servers

GPUBreach uses GPU Rowhammer on GDDR6 to flip bits, corrupt page tables and escalate to system root

GrafanaGhost chains AI prompt injection and URL flaws to exfiltrate sensitive Grafana data

Cryptocurrency scams alone cost victims over $7 billion, while AI-enabled fraud threats are on the rise, says FBI

Microsoft has released a new report about the Storm-1175 group and its connection to Medusa ransomware

Fortinet has updated its FortiClient EMS product after zero-day attacks surfaced

A large-scale credential theft campaign targeting senior executives has been linked to a previously unknown automated phishing platform called Venom

This modern infostealer adopted server-side decryption of stolen credentials to bypass security controls

The UK’s cybersecurity agency offered advice to “high-risk’ individuals” on how to protect against social engineering and cyber-attacks

iOS/iPadOS 18.7.7 updates expanded to protect older devices from DarkSword web exploit kit

LNK files use GitHub C2, embedded decoders and PowerShell for persistence and data exfiltration

Halcyon says Akira is now capable of carrying out an entire ransomware attack in less than an hour

E2e-assure says 80% of critical infrastructure providers could face millions in downtime from cyber-attacks

Android requires dev identity verification for sideloaded apps; phased global rollout from September