Baker Tilly Reports Client Data Breach at Third-Party Provider
Baker Tilly says an attacker obtained client information from an unnamed third-party platform. State filings list 10,456 affected Texas residents and 1,359 in South Carolina.
AntiFox AI Tool Linked to IIS and AWS Intrusions
Arctic Wolf linked AntiFox-hosted systems to IIS intrusions and AWS secret access; Amazon says attackers used credentials stolen from customer apps.
Researchers Find 35,578 Grok Build Apps Open to Anyone
Claroc found 35,578 Grok Build apps open without sign-in, including business records, patient information and employee passwords in some apps.
ScreenConnect Attacks Linked to RMM+ Extension Flaw
Huntress links attacks across 48 organizations to an RMM+ extension flaw that accepted blank access keys; ConnectWise disabled five related extensions.
Node.js Fixes 16 Flaws, Including TLS Memory Exposure
Node.js has released 22.23.5, 24.22.3 and 26.13.1 to fix 16 security flaws, including bugs that can expose TLS memory and crash HTTP/2 servers.
Silent Lynx Used AI Agent in Central Asian Espionage
CloudSEK says Silent Lynx used a DeepSeek-powered Hermes agent to automate reconnaissance and collect government documents across Central Asia, while maintaining access to railway and geospatial systems.
Bitquery Traces $348K From Across Protocol Domain Hijack
Across Protocol regained its domain after a phishing page redirected visitors to a wallet drainer. Bitquery traced about $348,000 in losses from nine wallets.
Maersk Confirms Data Extraction From Legacy System
Maersk confirms unauthorized access and data extraction from a legacy system inherited through an acquisition, while saying it has found no wider customer or partner impact.
AWS Clarifies Qubole Attack Did Not Compromise AWS Services
AWS says attackers abused customer-configured IAM trust relationships tied to Qubole, not a compromise of AWS services themselves.
eMudhra Revokes Eight More Intermediate CAs
eMudhra revoked eight more RSA intermediate CAs after it could not verify their key handling, bringing the certificate incident total to 16.
Windows Active Directory RCE Fixed in November Updates
Microsoft fixed CVE-2026-119948, a high-severity Active Directory buffer overflow that allows an authorized attacker to execute code over a network.
How to Set a Mobile Data Warning and Limit on Android
Set an Android data warning before you run out of mobile data, or add a limit that switches mobile data off at your chosen amount. Includes Pixel, Samsung Galaxy and other Android phones.
Android 17 QPR2 Rolls Out With 166 Pixel Security Fixes
Google's Android 17 QPR2 rollout brings the November security patch, 166 additional Pixel security fixes and 33 functional changes to supported phones.
Loading
