Posts of last few hours

【开源报告】北极地缘政治深度调研报告
https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651157556&idx=1&sn=2270fffcb3f0dc5890c6a239c2d02a4f
Rogue external MFA providers can steal passwords during logins
Security researchers developed an attack that lets hackers with privileged access register a rogue external MFA provider that steals users' passwords during legitimate login attempts. [...]
https://www.bleepingcomputer.com/news/security/rogue-external-mfa-providers-can-steal-passwords-during-logins/
Sweden fines Miljödata $183,000 over breach affecting 2.2 million
Sweden's data privacy regulator, IMY, has imposed a $183,000 (SEK 1.8 million) fine on IT systems provider Miljödata for inadequate security measures leading to a breach in August 2025 affecting 2.2 million people. [...]
https://www.bleepingcomputer.com/news/security/sweden-fines-milj-data-183-000-over-breach-affecting-22-million/
After water attacks, Capitol Hill offers its own proposal for an AI-cyber test program

A key House Democrat and his bipartisan sponsors want to see a $100 million DHS pilot to help critical infrastructure owners and operators — separate from another administration-proposed pilot program.

The post After water attacks, Capitol Hill offers its own proposal for an AI-cyber test program appeared first on CyberScoop.

https://cyberscoop.com/gottheimer-ai-cyber-defense-act-cisa-pilot/
Relays Are Masking Chinese Access to Frontier AI Models in the US
More than 80,000 AI relay servers are helping users in China mask their identities while they access cutting-edge large language models (LLMs), probably to clone them.
https://www.darkreading.com/cyber-risk/relays-masking-chinese-access-frontier-ai-models
ShinyHunters Hacks FBI Jobs Portal, Claims It Stole Agents’ Data
ShinyHunters hacks the FBI Jobs portal, claims data on FBI agents, and says it stole substantial job applicant records in a PeopleSoft zero-day attack.
https://hackread.com/shinyhunters-hacks-fbi-jobs-portal-fbi-agents-data/
How the CISO-CMO Alliance Builds Trust Before Crisis Strikes
Cybersecurity and brand reputation are inextricably linked. Security and marketing leaders who establish regular touchpoints, develop joint crisis communications plans, and translate security risks into their brand impact position their organizations to significantly outperform those treating security as an operational IT concern.
https://www.darkreading.com/cybersecurity-operations/how-ciso-cmo-alliance-builds-trust-before-crisis
Человек ставит задачу, ИИ ускоряет войну. США и Британия готовят армии нового поколения
Партнёры делают ставку на совместимые инструменты для моря, воздуха и инфраструктуры.
https://www.securitylab.ru/news/577750.php
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases. [...]
https://www.bleepingcomputer.com/news/security/chinese-hackers-exploit-multiple-technologies-to-steal-govt-data/
2026 State of PQC on the Web
Explore F5 Labs’ 2026 PQC report: adoption trends, CDN dependence, TLS technical debt, certificate risks, and steps toward quantum resilience.
https://www.f5.com/labs/articles/2026-state-of-pqc-on-the-web
Check Point security advisory (AV26-902) – Update 2
https://cyber.gc.ca/en/alerts-advisories/check-point-security-advisory-av26-902
Математик разрушил одну из самых красивых легенд Парфенона
Даже современные ИИ-модели повторяют старую версию о зрительных иллюзиях, хотя математический анализ ставит её под сомнение.
https://www.securitylab.ru/news/577757.php
F5 security advisory (AV26-949) - Update 1
https://cyber.gc.ca/en/alerts-advisories/f5-security-advisory-av26-949
Arista Networks security advisory (AV26-947) – Update 1
https://cyber.gc.ca/en/alerts-advisories/arista-networks-security-advisory-av26-947
Microsoft Disrupts EvilTokens Device Code Phishing Service
Microsoft seized 50 websites and disabled more than 150 domains as part of a coordinated disruption effort against a phishing-as-a-service platform targeting Microsoft 365 accounts.
https://www.darkreading.com/identity-access-management-security/microsoft-disrupts-eviltokens-device-code-phishing-service
Deception by Design: CISA's Guide to Tricking Cybercriminals
The Cybersecurity and Infrastructure Security Agency (CISA) is going old school to help organizations with limited resources set traps for hackers.
https://www.darkreading.com/cybersecurity-operations/deception-by-design-cisa-s-guide-to-tricking-cybercriminals
Canadian regulator opens probe of IDScan for allegedly violating data privacy laws
The investigation, announced Monday, will probe IDScan’s security practices and whether victim notifications were adequate under Canada’s federal private-sector privacy law, the regulator said in a press release.
https://therecord.media/canadian-regulator-opens-probe-of-idscan-following-data-breach
Академики взбунтовались против калькулятора. ИИ начал закрывать математические проблемы сотнями
Учёные подняли тревогу после штурма открытых задач.
https://www.securitylab.ru/news/577721.php
Check Point Fixes a New Actively Exploited Critical Security Flaw
Check Point fixes an actively exploited flaw that lets unauthenticated attackers upload and run scripts on vulnerable Security Management Servers. Check Point has released emergency hotfixes for CVE-2026-93616, a critical path traversal flaw in its Security Management Server. Attackers can abuse the flaw without logging in to upload malicious scripts and execute them on vulnerable […]
https://securityaffairs.com/199549/security/check-point-fixes-a-new-actively-exploited-critical-security-flaw.html
AI’s new role in exploiting vulnerabilities
https://www.youtube.com/watch?v=POperp9rsxI

Managed ad