All news with #news tag

🚨 U.S. Senator Ron Wyden requested that the FTC investigate Microsoft for what he describes as “gross cybersecurity negligence” after product weaknesses tied to Kerberos and legacy RC4 usage contributed to ransomware incidents, including the May 2024 Ascension Health breach that exposed data for 5.6 million patients. Wyden says his office alerted Microsoft in July 2024 and urged setting stronger ciphers like AES as defaults; he criticized an October Microsoft blog as too technical to warn corporate decision-makers. Microsoft replied that RC4 accounts for under 0.1% of traffic, that full removal risks breaking legacy systems, and that deprecation is on its roadmap.

🔔 Apple warned customers that their accounts were targeted in a series of mercenary spyware attacks, according to France's CERT‑FR. Notifications were issued on March 5, April 29, June 25 and September 3 and appear at the top of account.apple.com and via the email or phone linked to users' Apple IDs. The alerts indicate highly sophisticated campaigns often using zero‑day and zero‑click techniques, meaning at least one device tied to the account may be compromised. Apple recommends enabling Lockdown Mode and seeking rapid-response assistance through Access Now.

🔒 The Panama Ministry of Economy and Finance (MEF) says a workstation may have been infected with malicious software; established security protocols were activated immediately and the incident has been contained. The ministry asserted that central systems and platforms remain unaffected, and that personal and institutional data are protected while preventive measures were reinforced. However, the INC Ransom group added MEF to its leak site on September 5, claiming to have stolen more than 1.5 TB of emails, financial records and budgeting files; MEF had not responded to requests for comment by publication.

🔁 In May 2025 the EU sanctioned Moldova-based PQ Hosting and its owners, the Neculiti brothers, for alleged links to Kremlin hybrid warfare. Recorded Future and KrebsOnSecurity reporting show Stark Industries quickly rebranded to the[.]hosting under Dutch WorkTitans BV on 24 June 2025 while key address space and assets moved to PQ Hosting Plus S.R.L. Netherlands-based MIRhosting appears to host and manage the new entities, suggesting the sanctions achieved little lasting disruption.

🎉 Microsoft announced that, starting today, individual Windows developers can publish applications to the Microsoft Store without paying registration fees. The policy covers Win32 (including .NET WPF and WinForms), UWP, PWA, .NET MAUI, and Electron apps; Microsoft will host MSIX-packaged binaries, sign apps for free, and pay for distribution so developers don't need their own CDN. Developers of non-gaming apps may also implement their own in-app payment systems and retain all revenue. To publish, creators sign in with a personal Microsoft account and must verify identity with a government ID and a selfie; no credit card is required.

🛑 Calcio, a major illegal sports-streaming platform that drew over 123 million visits in the past year across 134 domains, has been shut down after coordinated action by ACE and DAZN. The Moldova-based operator agreed to cease operations and transferred domains to ACE, which now redirects them to its Watch Legally site. The service had been especially popular in Italy, accounting for more than 80% of traffic.

🎓 Microsoft is offering a free 12-month subscription to Microsoft 365 Personal for U.S. college students, including community college attendees, with the offer available through October 31, 2025. The subscription includes Word, Excel, PowerPoint, OneNote, and Outlook with the Copilot AI assistant, plus 1 TB of OneDrive storage and ransomware protection. Students must verify enrollment via a school email or documentation, and a 50% discount is available if they keep the plan after the first year. Microsoft also announced educator grants, community college certifications, AI training, and expanded Copilot access for U.S. schools.

📣 Sendmarc has appointed Rob Bowker as North American Region Lead to drive regional expansion and deepen MSP and VAR partnerships. Bowker brings over two decades of experience in email infrastructure, deliverability, and security, including implementation of DMARC, SPF, and DKIM. He will focus on accelerating DMARC adoption across enterprise and mid-market customers, empowering MSPs to protect SMBs, and executing a partner-first growth strategy. The move aims to broaden Sendmarc’s enterprise footprint and support faster DMARC compliance.

🔒 Chess.com disclosed a data breach after threat actors gained unauthorized access to a third-party file transfer application used by the platform. The intrusion persisted from June 5 to June 18, 2025, and was discovered on June 19, prompting an investigation and engagement of outside experts. Chess.com says its own infrastructure and member accounts were not affected; just over 4,500 users may have had names and other PII accessed. No financial information appears exposed, and affected members are being offered 1–2 years of free identity theft and credit monitoring.

🔔 CISA announced the appointment of Nicholas Andersen as Executive Assistant Director for Cybersecurity, naming him to lead efforts to address major cyber threats and bolster critical infrastructure resilience. Andersen brings extensive public- and private-sector experience, including senior roles at Invictus and Lumen Technologies Public Sector, and prior service at the Department of Energy. He began at CISA on September 2, 2025; Chris Butera will assume the role of Acting Deputy Executive Assistant Director.

🏆 With only 12 days until the 12 September 2025 nomination deadline, the CSO30 ASEAN Awards invite senior security leaders to submit entries that demonstrate outstanding leadership, innovation, and measurable business value. Categories include Business Value, Leadership, and Public‑Private Partnership. Winners will be honoured at an in‑person ceremony in Singapore and join a global community of top CISOs and security executives.

🔍 Microsoft says its August 2025 security update, KB5063878, is not connected to recent reports of SSD and HDD failures. After internal testing and telemetry analysis, Redmond said it could not reproduce the corruption or drive losses and found no increase in disk failures following the Windows 11 24H2 update. Microsoft is working with storage partners and controller vendors and will continue to monitor customer feedback while investigating any new reports.

📅 CSO's editors compile a curated calendar of leading and niche cybersecurity conferences worldwide, spanning September 2025 through April 2026. The list identifies event names, dates and locations, and notes in-person, virtual and hybrid formats as well as events run by CSO’s parent company, Foundry. Use this guide to prioritize training, vendor demos and networking opportunities tailored to your region and role.

🔗 The latest Threat Source newsletter reflects on the value of the cybersecurity community after Black Hat USA 2025 and DEF CON 33, encouraging practitioners to seek local, affordable alternatives like Bsides, student clubs and hackathons. It summarizes Talos telemetry showing a 1.4× surge in ransomware activity in Japan during H1 2025, with Qilin most active and the new actor Kawa4096 emerging. The edition also highlights major headlines such as an exploited Git vulnerability, updated CISA SBOM guidance, and early reports of an AI-powered ransomware project called PromptLock.

🔍 The US Director of National Intelligence reports that the UK government is dropping a proposed mandate requiring a backdoor into the Apple iPhone, a development attributed in early accounts to reporting by Tulsi Gabbard. If accurate, the announcement would mark a significant retreat from proposals that would compel vendors to weaken device security. The decision is described as provisional and underscores continuing tensions between privacy advocates, technology vendors, and law enforcement over access to encrypted communications.

🔒 In the August 2025 edition, ESET Chief Security Evangelist Tony Anscombe highlights major global developments that affect defenders and users alike. Key items include WhatsApp's takedown of 6.8 million scam-linked accounts in H1 2025, the UK government's reversal on an Apple cloud decryption demand, attacks on water facilities in Norway and Poland, and Nigeria's deportation of over 100 foreign nationals tied to a large cybercrime syndicate. He also notes auctions of active police and government email credentials on criminal forums and underscores lessons for resilience, encryption policy, and international cooperation.

🛡️ The federal government plans to present a draft bill by year-end aimed at strengthening cyber defense across Germany. The proposal would expand cyber-defense powers for security agencies and deepen cooperation between civilian and military bodies, with joint exercises planned between the Interior Ministry and the Ministry of Defence. It also calls for the development of a Cyber-Dome, an automated system to detect and respond to online attacks, as Interior Minister Alexander Dobrindt warned of daily cyberattacks and rising hybrid threats.

🔒 CISA and public- and private-sector partners are assisting Nevada following an August 24 cyber attack, focusing on restoring networks that support lifesaving and critical services. At the state's request, CISA Threat Hunting teams are actively examining systems to determine the full scope of impact and mitigate threats. The agency also advised on FEMA emergency response grants, and the FBI is supporting the investigation.

🦑 The short entry presents the bobtail squid’s natural history—its bioluminescent symbiosis, nocturnal habits, and adaptive camouflage—in a crisp, approachable summary. As with other 'squid blogging' posts, the author invites readers to use the item as a forum for current security stories and news that the blog has not yet covered. The post also reiterates the blog's moderation policy to guide constructive discussion.

🔐 Jim Sanborn is auctioning the original solution to Part Four (K4) of his Kryptos sculpture, with RR Auction estimating a winning bid of $300,000–$500,000 for the lot. The sale, scheduled for Nov. 20, includes the handwritten plaintext, related papers, and a 12-by-18-inch copper proof-of-concept plate with 1,800 hand-cut letters. Sanborn hopes the buyer will preserve the secret and assume verification duties, potentially by implementing an automated review process.