Beat
Breaches, scams, and how to stay safe — the attack explained, calmly.
81 million tries, 78 wins — how a brute-force attack walked past modern login defenses →
An automated campaign made 81 million login guesses against Microsoft cloud accounts and broke into 78 of them, many protected by policies that a forgotten legacy login path simply ignored.
One hidden Oracle flaw, hundreds of breached companies — and Nissan is just the biggest name →
A flaw in the payroll software that runs much of corporate HR was attacked before Oracle even knew it existed. Nissan, Aflac Japan, universities and US insurance regulators are among the hundreds now counting the damage.
The Supreme Court just decided your phone's location history is yours, not the government's to grab →
A 6-3 ruling says police need real Fourth Amendment protection before sweeping up everyone near a crime scene from their phones — the first big update to digital privacy in years, with the line drawn at the most ordinary thing your phone does: knowing where you are.
The government rebuilt its own websites — and quietly fitted them to watch you →
A White House office rebuilt sensitive federal sites for passports, voter registration and drug pricing, fitting at least two with tracking software set to dodge privacy tools — and skipping the privacy filings the law requires. Plus a crypto "recovery" scam that's really malware, and a Chinese AI that's catching up at finding software flaws.
One toolkit, 200,000 scam sites — fraud is now built like software →
A single Chinese app-building framework is behind more than 200,000 investment-scam websites, security researchers found — a sign that online fraud has turned into a mass-produced product.
Two dozen companies were breached through a vendor they'd plugged into years ago →
A break-in at the market-research firm Klue rippled out to its customers — including the security firms LastPass and BeyondTrust — through standing connections nobody was watching.
A flaw hid in software on billions of machines for 25 years — until an AI went looking →
A bug that sat untouched in curl since 2001 was finally found this month, part of a wave of old flaws surfacing now that AI tools are reading code no human had re-examined in years. Plus a Cisco bug exploited two months before anyone knew, and why scam centres keep surviving every crackdown.
Malware learns to talk its way past the AI now reading it →
A North-Korea-linked backdoor hides fake messages meant to fool the AI tool analysing it — one of three new tricks aimed not at the machine, but at the artificial judge now standing guard.
A new flaw lets a stranger's code change run on Microsoft's and Google's own machines →
Researchers named "Cordyceps" — a weakness where the automated systems that handle open-source contributions trust those contributions too much, exposing CI/CD pipelines at Microsoft, Google, Apache and Cloudflare. Plus four flaws in a popular AI platform, a fake software package that hid a remote-control tool, and two teenagers convicted over the Transport for London hack.
Texas loses 3 million hunters' and anglers' data — through a vendor they never chose →
A third-party license seller for Texas Parks & Wildlife was breached, exposing driver's license and passport numbers for 3 million people, alongside a wave of breaches that all began at a supplier rather than the named company.
A Splunk flaw was patched June 10. Within days, attackers were already through the door →
A public patch tells defenders where the wound is — and tells attackers the same thing, at the same moment.
The GTA 6 scam preys on a wait that's lasted years →
Criminals are using AI-polished fake "beta test" invitations to steal gamers' logins, personal data, and bank details ahead of Grand Theft Auto VI. Plus a hacker hijacks Brazil's emergency-alert system, and France pushes for shared rules on AI.
86,000 firewalls fell because nobody changed the factory password →
A global campaign called FortiBleed broke into 86,644 Fortinet firewalls — the guards at the edge of company networks. The attackers didn't crack anything. They logged in with default and reused passwords that were never changed.
The breach came through an app the company plugged in itself →
Attackers stole data from Salesforce customers — including a security firm — by hijacking a connected third-party app, the third such app abused this way. Plus a wave of critical patches and a major botnet takedown.
Ransomware crew hid inside a US firm for months, disguising its traffic as Microsoft Teams →
A DragonForce attack used a custom backdoor that masquerades as normal Teams traffic, letting it sit unnoticed long after the break-in. Plus a Defender zero-day, 245 Oracle patches, and plugins that steal developers' keys.
The FBI says crypto scammers now send couriers to your door for cash →
Banks got better at blocking transfers to crypto fraud, so scammers switched to in-person cash pickups — a move that puts the money even further out of reach.
Chinese spies sat inside a research-data platform for over two years — and it touched medicine, the military, and beyond →
A state-backed group quietly compromised REDCap, a research-data tool trusted across hospitals, universities, and military health institutions, and stole credentials undetected from 2023 until late 2025.
The FBI seized the factory behind a million scam links — not the scammers, the machine they all rented →
A coordinated takedown dismantled "Outsider Enterprise," a Chinese phishing-as-a-service operation tied to $1.9 billion in losses, as new figures show AI-driven fraud hit record scale.
A critical Splunk flaw came from a helper service that no one asked to lock its own door →
A 9.8-severity hole in Splunk Enterprise let an unauthenticated user reach a built-in database helper and run code — because the helper trusted that only the main app would ever call it. Plus a decade-long China-linked espionage campaign, a coming change to npm to slow supply-chain attacks, and a government order pulling two AI models offline.
Hundreds of trusted software packages were quietly hijacked — the name stayed the same, the recipe didn't →
Attackers took over 400-plus abandoned packages in Arch Linux's community repository and rewrote their build scripts to steal developer secrets. Days earlier, GitHub announced npm would flip its defaults to stop exactly this. Both are about the same weak spot: a package you trust today can change hands tomorrow, and you may never notice.
Security teams are drowning in alerts — and the warning that matters keeps slipping through →
A growing share of breaches now start not with a missed clue but with a clue that was buried under thousands of others. Alert fatigue is becoming its own threat, and defenders, regulators, and ordinary users are all feeling the same overload.
Quiet malware copied passwords off 11 million machines — and the thefts left no gap to notice →
Cheap infostealer malware harvested passwords and login sessions from 11.1 million devices in 2025, and one stolen credential now spreads into several crimes at once.
A spyware firm a court told to stop went after WhatsApp users anyway →
NSO Group is accused of breaking a permanent US court order to target WhatsApp users — a sign of how little a legal ban deters a company when the prize is bigger than the penalty. Plus Microsoft's record 206-flaw patch day, and Signal's warning about UK device-scanning.
A Meta support tool emailed the keys to the wrong people — and 20,225 Instagram accounts paid for it →
A bug in Instagram's account-recovery tool sent password-reset links to strangers who simply asked. The accounts that survived were the ones with a second lock the bug couldn't reach.
A phone call, not a hack — extortion gang talks its way into law firms →
A gang is calling US law firms while pretending to be their own IT desk, stealing client files within hours. Plus a US surveillance law nears its deadline, and the case for passkeys.
An AI found 21 hidden flaws in software you already use — for about $1,000 →
Cheap AI bug-hunting is flooding software makers with vulnerabilities faster than humans can fix them. The same week, OpenAI gave ChatGPT a "Lockdown Mode" to blunt a different AI risk — and a startup raised $23M to police what AI agents are allowed to touch.
Malware is learning to adapt, and the main guardrail is voluntary →
Researchers warn of AI-powered worms that adjust as they spread, exposed fuel gauges are under attack, and a wave of romance scams shows the weakest link is still a person — but the basics that protect you haven't changed.
Your AI assistant will do what it's told — even when the order comes from a stranger →
Researchers showed how a digital assistant could be steered by instructions hidden in an ordinary notification, not by its owner. It's already fixed — but it points at the security story of the moment: AI is now both a tool for attackers and a target itself. Plus fake job offers used as bait, a seventh zero-day, and the calm basics that still matter.
The danger isn't the unknown attack — it's the known one no one got around to fixing →
This week's security news has a single quiet theme: the most exploited weaknesses are flaws that already have a fix, sitting unpatched. A phone-system bug with a patch already out, a server flaw already under attack, a Microsoft app setting left switched on by mistake. Even the scary new AI-built worm mostly just hunts for holes someone forgot to close. The lesson, calmly: updating your software is the boring advice that actually matters.
A stock exchange spied on for five months, and a phishing kit that walks past your second check →
An espionage crew lived inside a finance executive's inbox for months using ordinary Windows tools. A phishing kit shows why your login code can be the weak link. Plus a half-million-person breach, an exploited Linux flaw, and a fight over who gets to report bugs.