Rogue Remote-Access Clients Are Spreading Through IT Providers’ ScreenConnect Panels. ConnectWise Has Switched Off Five Extensions 
Attackers Are Walking Into Xen Orchestra Without a Password and Taking Over XCP-ng Hosts. The Fix Is Out 
N-able Pulls Hosted N-central Offline After a Researcher Publishes 30-Plus Unpatched Flaws With Working Exploit Code 
A Factory-Default ‘admin’ Password Let Researchers Hijack Two Car Brands’ App Accounts, Then Unlock and Start a Test Car 
Singapore Warns That a Perfect-10 Metabase Flaw Is Still Being Used to Take Over Dashboards Without a Login 
Patching the Hacked Website Isn’t the End of It: Microsoft Tracks Attackers Who Stay on Linux Servers Through a Public Relay
Here Is How Layered Defenses Close the Back Door That Patching Leaves Open When a company website gets hacked, the...
Accounting Firm Baker Tilly Tells Clients Their Data Was Taken From an Outside Provider’s Platform; Texas Filing Lists More Than 10,000 Residents
When a business hands its books to an accounting firm, it is trusting that firm with some of the most...
A Critical Apache Web Server Bug Hides in HTTP/2 Support: The Spec Sheet, and a Checklist for Updating or Switching It Off
Apache HTTP Server still runs a large share of the web, including many of the Linux servers behind company websites...
Thousands of Hijacked GitHub Accounts, One Fake ‘Audit Notes’ Pull Request: A Timeline of This Week’s CI Secret-Stealing Wave
If your company writes software, pays a developer, or relies on an outside firm whose code lives on GitHub, this...
Maersk Says Hackers Took Data From a System It Inherited Through an Acquisition. A Ransomware Gang Wants $5 Million: Your Questions Answered
One of the world’s biggest container carriers is dealing with a data theft that started not in its core systems...
Rogue Remote-Access Clients Are Spreading Through IT Providers’ ScreenConnect Panels. ConnectWise Has Switched Off Five Extensions
An active attack campaign is running through one of the tools IT service providers rely on most: the remote support...
One Opened Email File Can Hand Over a Windows Password Hash. Microsoft’s Exploited Outlook Flaw Shows Why Layers Matter
Here Is How Layered Defenses Keep a Single Click From Becoming a Stolen Identity Microsoft’s November security release is enormous...
CISA Gets a Director Nominee After Months Without One: Palantir Security Executive Michael LoSapio, With a Senate Vote in Doubt
For most of this year, the federal agency that warns American businesses about actively exploited software flaws has been run...
Git’s Latest Release Stops Booby-Trapped Repositories From Running Code When You Clone Them: The Spec Sheet and an Update Checklist
Cloning a code repository is one of the most routine things a developer does. A newly fixed flaw in Git...
Fireworks AI’s Breach Turned Out Bigger, and Some Notion Workspaces Are Caught Up in It. Your Questions on the LLMjacking Attack, Answered
When an AI provider first disclosed a break-in in October, the damage sounded contained. An updated notice published Monday tells...