❌

Normal view

There are new articles available, click to refresh the page.

Today — 6 December 2025Main stream

The Register
Death to one-time text codes: Passkeys are the new hotness in MFA 6 December 2025 at 04:11

Death to one-time text codes: Passkeys are the new hotness in MFA

By: Jessica Lyons

6 December 2025 at 04:11

Wanna know a secret?

Whether you're logging into your bank, health insurance, or even your email, most services today do not live by passwords alone. Now commonplace, multifactor authentication (MFA) requires users to enter a second or third proof of identity. However, not all forms of MFA are created equal, and the one-time passwords orgs send to your phone have holes so big you could drive a truck through them.…

Yesterday — 5 December 2025Main stream

The Register
Crims using social media images, videos in 'virtual kidnapping' scams 5 December 2025 at 18:23

Crims using social media images, videos in 'virtual kidnapping' scams

By: Jessica Lyons

5 December 2025 at 18:23

Proof of life? Or an active social media presence?

Criminals are altering social media and other publicly available images of people to use as fake proof of life photos in "virtual kidnapping" and extortion scams, the FBI warned on Friday. …

The Register
Cloudflare blames Friday outage on borked fix for React2shell vuln 5 December 2025 at 16:46

Cloudflare blames Friday outage on borked fix for React2shell vuln

By: Jessica Lyons

5 December 2025 at 16:46

Security community needs to rally and share more info faster, one researcher says

Amid new reports of attackers pummeling a maximum security hole (CVE-2025-55182) in the React JavaScript library, Cloudflare's technology chief said his company took down its own network, forcing a widespread outage early Friday, to patch React2Shell.…

Before yesterdayMain stream

The Register
PRC spies Brickstormed their way into critical US networks and remained hidden for years 4 December 2025 at 17:10

PRC spies Brickstormed their way into critical US networks and remained hidden for years

By: Jessica Lyons

4 December 2025 at 17:10

'Dozens' of US orgs infected

Chinese cyberspies maintained long-term access to critical networks – sometimes for years – and used this access to infect computers with malware and steal data, according to Thursday warnings from government agencies and private security firms.…

The Register
Twins who hacked State Dept hired to work for gov again, now charged with deleting databases 4 December 2025 at 14:48

Twins who hacked State Dept hired to work for gov again, now charged with deleting databases

By: Jessica Lyons

4 December 2025 at 14:48

And then they asked an AI to help cover their tracks

Vetting staff who handle sensitive government systems is wise, and so is cutting off their access the moment they're fired. Prosecutors say a federal contractor learned this the hard way when twin brothers previously convicted of hacking-related offenses allegedly used lingering access to delete nearly 100 government databases, including systems tied to Homeland Security and other agencies, within minutes of being terminated.…

The Register
'Exploitation is imminent' as 39 percent of cloud environs have max-severity React hole 3 December 2025 at 16:55

'Exploitation is imminent' as 39 percent of cloud environs have max-severity React hole

By: Jessica Lyons

3 December 2025 at 16:55

Finish reading this, then patch

A maximum-severity flaw in the widely used JavaScript library React, and several React-based frameworks including Next.js allows unauthenticated, remote attackers to execute malicious code on vulnerable instances. The flaw is easy to abuse, and mass exploitation is "imminent," according to security researchers.…

The Register
Two Android 0-day bugs disclosed and fixed, plus 105 more to patch 2 December 2025 at 13:47

Two Android 0-day bugs disclosed and fixed, plus 105 more to patch

By: Jessica Lyons

2 December 2025 at 13:47

Christmas comes early for attackers this year

Two high-severity Android bugs were exploited as zero-days before Google issued a fix, according to its December Android security bulletin. …

The Register
AWS joins Microsoft, Google in the security AI agent race 2 December 2025 at 11:02

AWS joins Microsoft, Google in the security AI agent race

By: Jessica Lyons

2 December 2025 at 11:02

Preview tool promises quicker reviews and faster flaw-finding for cloud apps

Re:Invent AI agents are key to launching applications more quickly – and making them more secure from the start, Amazon says.…

The Register
Stealthy browser extensions waited years before infecting 4.3M Chrome, Edge users with backdoors and spyware 1 December 2025 at 14:14

Stealthy browser extensions waited years before infecting 4.3M Chrome, Edge users with backdoors and spyware

By: Jessica Lyons

1 December 2025 at 14:14

And some are still active in the Microsoft Edge store

A seven-year malicious browser extension campaign infected 4.3 million Google Chrome and Microsoft Edge users with malware, including backdoors and spyware sending people's data to servers in China. And, according to Koi researchers, five of the extensions with more than 4 million installs are still live in the Edge marketplace.…

The Register
Gainsight CEO downplays breach, says only a 'handful' of customers had data stolen 26 November 2025 at 15:37

Gainsight CEO downplays breach, says only a 'handful' of customers had data stolen

By: Jessica Lyons

26 November 2025 at 15:37

Maybe if your hand has 200+ fingers...

Gainsight CEO Chuck Ganapathi downplayed the victim count related to his company's recent breach, saying he's only aware of "a handful of customers" who had their data affected after Salesforce flagged unusual activity involving Gainsight's connected app.…

The Register
Botnet takes advantage of AWS outage to smack 28 countries 26 November 2025 at 13:44

Botnet takes advantage of AWS outage to smack 28 countries

By: Jessica Lyons

26 November 2025 at 13:44

Even worse, it might have been a 'test run' for future attacks

A Mirai-based botnet named ShadowV2 emerged during last October's widespread AWS outage, infecting IoT devices across industries and continents, likely serving as a "test run" for future attacks, according to Fortinet's FortiGuard Labs.…

The Register
Lifetime access to AI-for-evil WormGPT 4 costs just $220 25 November 2025 at 18:29

Lifetime access to AI-for-evil WormGPT 4 costs just $220

By: Jessica Lyons

25 November 2025 at 18:29

'Ah, I see you're ready to escalate. Let's make digital destruction simple and effective.'

Attackers don't need to trick ChatGPT or Claude Code into writing malware or stealing data. There's a whole class of LLMs built especially for the job.…

The Register
Corporate predators get more than they bargain for when their prey runs SonicWall firewalls 25 November 2025 at 17:38

Corporate predators get more than they bargain for when their prey runs SonicWall firewalls

By: Jessica Lyons

25 November 2025 at 17:38

Acquirers inherit more than staff and systems

Routine mergers and acquisitions are giving extortionists an easy way in, with Akira affiliates reaching parent networks through compromised SonicWall gear inherited in the deal, according to ReliaQuest.…

The Register
Fresh ClickFix attacks use Windows Update trick-pics to steal credentials 24 November 2025 at 17:50

Fresh ClickFix attacks use Windows Update trick-pics to steal credentials

By: Jessica Lyons

24 November 2025 at 17:50

Poisoned PNGs contain malicious code

A fresh wave of ClickFix attacks is using fake Windows update screens to trick victims into downloading infostealer malware.…

The Register
Ex-CISA officials, CISOs dispel 'hacklore,' spread cybersecurity truths 24 November 2025 at 15:01

Ex-CISA officials, CISOs dispel 'hacklore,' spread cybersecurity truths

By: Jessica Lyons

24 November 2025 at 15:01

Don't believe everything you read

Afraid of connecting to public Wi-Fi? Terrified to turn your Bluetooth on? You may be falling for "hacklore," tall tales about cybersecurity that distract you from real dangers. Dozens of chief security officers and ex-CISA officials have launched an effort and website to dispel these myths and show you how not to get hacked for real.…

The Register
Years-old bugs in open source tool left every major cloud open to disruption 24 November 2025 at 10:23

Years-old bugs in open source tool left every major cloud open to disruption

By: Jessica Lyons

24 November 2025 at 10:23

Fluent Bit has 15B+ deployments … and 5 newly assigned CVEs

A series of "trivial-to-exploit" vulnerabilities in Fluent Bit, an open source log collection tool that runs in every major cloud and AI lab, was left open for years, giving attackers an exploit chain to completely disrupt cloud services and alter data.…