Infosecurity News
Defense Contractor Boss Pleads Guilty to Selling Zero-Day Exploits to Russia
The former general manager of defense contractor Trenchant has admitted selling zero-days to Russian broker
Chrome to Make HTTPS Mandatory by Default in 2026
Google Chrome will enhance security with enforced HTTPS connections from version 154, set for release in October 2026
Npm Malware Uses Invisible Dependencies to Infect Dozens of Packages
The ongoing ‘PhantomRaven’ malicious campaign has infected 126 npm packages to date, representing 86,000 downloads
PHP Servers and IoT Devices Face Growing Cyber-Attack Risks
A rise in attacks on PHP servers, IoT devices and cloud gateways is linked to botnets exploiting flaws, according to new research published by Qualys
New Atroposia RAT Surfaces on Dark Web
Atroposia is a newly discovered modular RAT that uses encrypted channels and advanced theft capabilities to target credentials and crypto wallets
Open Source “b3” Benchmark to Boost LLM Security for Agents
The backbone breaker benchmark (b3) has been launched to enhance the security of LLMs within AI agents
BSI Warns of Looming AI Governance Crisis
The British Standards Institution claims business leaders aren’t focused enough on managing AI risk
Investment Scams Spread Across Asia With International Reach
A surge in fake investment platforms targeting cryptocurrency and forex markets has been driving a new wave of financial crime in Asia
Chrome Zero-Day Actively Exploited in Attacks by Mem3nt0 mori
A zero-day flaw in Chrome has been exploited by Mem3nt0 mori in Operation ForumTroll as part of a targeted espionage campaign
Nation-State Cyber Ecosystems Weakened by Sanctions, Report Reveals
Cyber-related economic sanctions can alter adversary behavior, forcing underground networks to distance themselves from named actors
A Quarter of Scam Victims Have Considered Self-Harm
ITRC report charts shocking rise of identity fraud victims driven to thoughts of self-harm
Actively Exploited WSUS Bug Added to CISA KEV List
Sysadmins are urged to patch WSUS vulnerability CVE-2025-59287 as soon as possible, with federal agencies required to update by November 14
Qilin Ransomware Group Publishes Over 40 Cases Monthly
Qilin ransomware activity has surged in late 2025, threatening data leaks via double extortion tactics
Europol Warns of Rising Threat From Caller ID Spoofing Attacks
Europol called for action against caller ID spoofing, linking attacks to significant online fraud
Tata Consultancy Services Refutes Losing M&S Contract After Cyber-Attack
The IT outsourcing giant said its service desk contract with Marks & Spencer was terminated long before the hack
UK Fraud Cases Surge 17% Annually
UK Finance reveals a 3% increase in the value and 17% increase in the volume of fraud in H1 2025
Critical WordPress Plugin Bugs Exploited En Masse
Wordfence says threat actors are trying to exploit three critical vulnerabilities from 2024
New LockBit Ransomware Victims Identified by Security Researchers
Check Point has identified a dozen attacks in September that bore the LockBit stamp, with half of them attributed to the group’s new ransomware version
Blitz Spear Phishing Campaign Targets NGOs Supporting Ukraine
A spear phishing campaign dubbed PhantomCaptcha targeted Ukraine’s war relief efforts and regional government administrations for a single day in October
Threat Actors Ramp Up Public App Exploits as ToolShell Gains Traction
ToolShell exploit activity surged last quarter, appearing in over 60% of Cisco Talos IR cases and driving a sharp rise in public-facing application attacks
