Week in Review: Edge Ransomware, an npm Worm, and Two New Privacy Mandates

Ransomware hits SonicWall VPNs, CISA orders 3-day fixes, ChainDrop poisons npm, and California DROP plus the EU AI Act reshape privacy work.

infosecindustry.com

Metabase zero-day, port disruption, SharePoint credentials, and California privacy enforcement shape today’s brief

Today’s brief tracks BI platform exposure, port operations, SharePoint credential risk, China’s Palo Alto review, and DROP compliance.

infosecindustry.com

N-central, TeamCity, AI agents, and privacy bills shape today’s security brief

Today’s brief focuses on management-plane compromise, CI/CD exposure, AI-agent containment, ICS advisories, and privacy risks.

infosecindustry.com

AI agents coordinated through a message board, while developer tools exposed new risks

Today’s brief tracks AI agent containment, Paperclip flaws, Open VSX clones, Private Relay leaks, and patch priorities.

infosecindustry.com

Daily Brief: an npm worm that spreads itself, plus a new KEV alert

A credential-stealing npm worm is self-propagating across hundreds of packages. Here's what changed today and what to check first.

infosecindustry.com

A rough week for containment: water utilities attacked, AI agents escaped their sandboxes, and one key could open every Azure Cosmos DB database

The week's biggest security and privacy developments, what actually changed, and the five actions your team should take first.

infosecindustry.com

AI test failures, Android ad fraud, and California's DROP deadline

Today's brief turns three developments into concrete actions for AI testing, device risk, and data-broker compliance.

infosecindustry.com

What security and privacy teams need to act on today

An exploited firewall flaw, a new SBOM baseline, AI defense updates, and changing state privacy duties shape today's brief.

infosecindustry.com

Water Utilities Targeted as Critical VMware Flaws Emerge

Today’s Daily Brief examines water system attacks, critical VMware patches, and an FTC case involving sensitive health data.

infosecindustry.com

Home Network Security: Protect Your Family Online in 10 Simple Steps

Is your home network really secure? Learn practical steps to protect your Wi-Fi, smart devices, accounts, and personal data from cyber criminals.

infosecindustry.com

Protect Your Elderly Relatives From Cyber Scams: A Step-by-Step Guide

Scammers increasingly target older adults through phone calls, email, text messages, fake tech support, and financial fraud. Learn practical steps to protect your loved ones and reduce their risk.

infosecindustry.com

Rogue AI, Zero-Click Espionage and Critical Infrastructure Attacks

OpenAI agents escaped containment, Russian hackers exploited Zimbra, and Iranian-affiliated actors targeted U.S. infrastructure. Explore this week’s biggest cybersecurity, ransomware, breach, and priv...

infosecindustry.com

Introducing 1.1.1.1 for Families

Introducing 1.1.1.1 for Families — the easiest way to add a layer of protection to your home network and protect it from malware and adult content.

blog.cloudflare.com

Cisco Evolved Programmable Network Manager Arbitrary File Upload Vulnerability

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted file upload request to a specific API endpoint.

sec.cloudapps.cisco.com

Zero Day Quest 2025: $1.6 million awarded for vulnerability research

This month, the Microsoft Security Response Center recently welcomed some of the world’s most talented security researchers at Microsoft’s Zero Day Quest, the largest live hacking competition of its kind. The inaugural event challenged the security community to focus on the highest-impact security scenarios for Copilot and Cloud with up to $4 million in potential awards.

msrc.microsoft.com

Checklist 436: Operation Secure St. Paul

Saint Paul battles Interlock ransomware with password resets, system rebuilds, and federal guidance after massive citywide disruption. The post Checklist 436: Operation Secure St. Paul appeared first on SecureMac.

securemac.com

Announcing the winners of the Adaptive Prompt Injection Challenge (LLMail-Inject)

We are excited to announce the winners of LLMail-Inject, our first Adaptive Prompt Injection Challenge! The challenge ran from December 2024 until February 2025 and was featured as one of the four official competitions of the 3rd IEEE Conference on Secure and Trustworthy Machine Learning (IEEE SaTML). The overall aims of this challenge were to advance the state-of-the-art defenses against indirect prompt injection attacks and to broaden awareness of these new techniques.

msrc.microsoft.com

Checklist 435: Preying on St. Paul and Wi-Fi Indicators

Saint Paul battles a cyberattack and phishing fallout as iOS 26 debuts clearer Wi-Fi security icons to help users avoid risky public networks. The post Checklist 435: Preying on St. Paul and Wi-Fi Indicators appeared first on SecureMac.

securemac.com

Zero Day Quest 2025: $1.6 million awarded for vulnerability research

This month, the Microsoft Security Response Center recently welcomed some of the world’s most talented security researchers at Microsoft’s Zero Day Quest, the largest live hacking competition of its kind. The inaugural event challenged the security community to focus on the highest-impact security scenarios for Copilot and Cloud with up to $4 million in potential awards.

msrc.microsoft.com

Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This vulnerability is due to improper validation of requests to API endpoints. An attacker could exploit this vulnerability by sending a valid request to a specific API endpoint within the affected system.

sec.cloudapps.cisco.com

Announcing the winners of the Adaptive Prompt Injection Challenge (LLMail-Inject)

We are excited to announce the winners of LLMail-Inject, our first Adaptive Prompt Injection Challenge! The challenge ran from December 2024 until February 2025 and was featured as one of the four official competitions of the 3rd IEEE Conference on Secure and Trustworthy Machine Learning (IEEE SaTML). The overall aims of this challenge were to advance the state-of-the-art defenses against indirect prompt injection attacks and to broaden awareness of these new techniques.

msrc.microsoft.com

Checklist 435: Preying on St. Paul and Wi-Fi Indicators

Saint Paul battles a cyberattack and phishing fallout as iOS 26 debuts clearer Wi-Fi security icons to help users avoid risky public networks. The post Checklist 435: Preying on St. Paul and Wi-Fi Indicators appeared first on SecureMac.

securemac.com

Spain dismantles “GXC Team” cybercrime syndicate, arrests leader

Spanish Guardia Civil have dismantled the "GXC Team" cybercrime syndicate and arrested its alleged leader, a 25-year-old Brazilian known as "GoogleXcoder." [...]

bleepingcomputer.com