Over Security

Maine has taken its public data breach reporting portal offline after fraudulent breach disclosures were published on the state's website, prompting a review of procedures to prevent abuse in the future.

A 10-year-old authentication bypass vulnerability discovered in the phpBB forum software allows an attacker to log in as any user, including administrators.

The tech giant said a group called "Outsider Enterprise" used AI to scam hundreds of thousands of victims, sending 2.5 million text messages over a span of two weeks.

A Ukrainian national extradited from Ireland to the United States last year has pleaded guilty to conspiracy charges tied to the Conti ransomware operation.

More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware targeting credentials and access tokens.

La Commissione europea vuole che Meta apra Whatsapp a chatbot rivali come ChatGPT, Gemini o Claude. L'apertura dell'app di messaggistica ai chatbot rivali è al centro della contesa Meta-UE e riguarda il futuro dell'IA. Ecco la posta in gioco

GitHub access sales, leaked repositories, and stolen API keys can all become supply-chain attack footholds. Flare explores how underground forums expose early signals tied to software supply-chain risk.

The Cyber Express weekly roundup of cybersecurity stories brings new insights into security updates, Microsoft's record patches, CBSE audit and FIFA scams.

Microsoft has fixed a known issue that caused Windows updates released since May 2025 to fail when installed via the Windows Update Standalone Installer (WUSA) from a network share.

Infrastruttura on-premise complessa, molteplici obblighi normativi e un SOC sommerso dagli alert: queste le sfide di Novomatic Italia. Ecco come la collaborazione con HWG Sababa e l’uso della piattaforma HyperSOC hanno ridefinito detection, risposta e resilienza

Danish pharmaceutical giant Novo Nordisk, the world's largest producer of insulin, disclosed a data breach affecting patient information from some clinical trials.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies to patch an actively exploited Ivanti Sentry flaw within three days, as mandated by the newly issued Binding Operational Directive (BOD) 26-04.

FBI warns of FIFA World Cup 2026 scams using fake domains, phishing sites, and job fraud schemes targeting fans and job seekers.

Thai gambling SEO poisoning campaign exploits abandoned DNS records, compromising 163 organizations across 30+ countries.

Campagna di phishing a tema Polizia Postale. Con l'allarme" di un Sim Swapping i truffatori cercano di rubare carte di credito e dati sensibili degli utenti

The French government revealed that a recent breach of its Tchap encrypted messaging platform affects the accounts of over 73,000 employees in the French public sector.

Il caso del jailbreak a Fable 5, con esposizione delle sue istruzioni segrete, mostra quanto siano fragili i sistemi di sicurezza proprietari davanti ad attacchi distribuiti e agentici. L’incidente diventa un monito sulla nuova fase della cybersecurity legata agli HACCA

Attraverso l'esame dei rischi trasversali che colpiscono la data protection, la cyber security, l'intelligenza artificiale e le risorse umane nella Governance by design, ecco come le moderne normative fungono da preziosi acceleratori per intercettare le vulnerabilità in fase di progettazione e strutturare organizzazioni resilienti

Attraverso l'esame dei rischi trasversali che colpiscono la data protection, la cyber security, l'intelligenza artificiale e le risorse umane nella Governance by design, ecco come le moderne normative fungono da preziosi acceleratori per intercettare le vulnerabilità in fase di progettazione e strutturare organizzazioni resilienti

Cyble's latest analysis exposes 163 organizations compromised via abandoned DNS delegations in a Thai gambling SEO poisoning campaign.

Kyushu Electric Power Co., Inc. has disclosed a physical security incident that affects private data of more than 10 million customers.

In an unusual misinformation campaign, fraudulent data breach disclosures were submitted to Maine's official breach portal and publicly posted before their legitimacy could be verified, prompting companies to deny the claims.

The tech giant warned of a security flaw that a cybercrime gang said it's exploiting as part of a mass-hacking campaign. Google said it notified more than 100 organizations that had potentially vulnerable servers.

Oracle is warning about a critical PeopleSoft Suite zero-day vulnerability tracked as CVE-2026-35273 that allows unauthenticated remote code execution, with the flaw actively exploited in ShinyHunter data theft attacks.

In this week’s newsletter, Amy reminisces on the tech toys of their childhood, inspired by a hilarious lesson about why your digital privacy shouldn't be left on an open channel.