All news with #news tag

🔒 The UK National Cyber Security Centre (NCSC) has launched SilentGlass, a plug-and-play hardware device that actively blocks unexpected or malicious signals between HDMI and DisplayPort connections and monitor screens. Unveiled at CYBERUK on April 22 and already deployed on government estates, SilentGlass is approved for high-threat environments and is now available for public purchase. The NCSC partnered with Goldilock Labs and Sony UK to manufacture and commercialize the device globally.

🎉 Google Cloud today announced its 2026 Partner of the Year winners, honoring partners who used Google Cloud technologies to deliver transformative customer outcomes. Winners span global and country-level awards across categories such as Artificial Intelligence, Data, Security, Infrastructure Modernization, Google Workspace, and more. The awards recognize innovation, collaboration, and measurable impact in industries worldwide. Congratulations to the partners driving progress and customer success.

🔍 Grupo Seguritech, a Mexican surveillance company, is moving to expand its operations into the United States after years of supplying cameras, analytics, and integrated security systems domestically. The expansion highlights concerns about the cross-border adoption of pervasive monitoring technology and the governance challenges that follow. Observers point to the firm’s existing government contracts and experience integrating hardware and software as factors likely to shape local procurement and civic surveillance capabilities.

🔒 ESET researchers uncovered a NGate Android campaign that trojanized the HandyPay NFC relay app to steal contactless card data and capture PINs for fraudulent ATM withdrawals. The poisoned app, spread via fake Rio de Prêmios sites and a deceptive Play Store listing, asks to be set as the default payment app and prompts users to enter their card PIN before tapping their card. Artifacts including emoji-laden debug messages suggest parts of the injected code may have been generated or modified with a large language model.

🔒 ESET researchers discovered a new NGate malware variant that trojanized the legitimate HandyPay Android NFC-relay app, with injected code displaying artifacts consistent with GenAI-assisted development. The patched app silently forwards NFC payment card data and captures payment card PINs, exfiltrating them to attacker-controlled C&C infrastructure to enable contactless ATM cash-outs and unauthorized payments. Distribution targeted Android users in Brazil since November 2025 via a fake Rio de Prêmios lottery site and a counterfeit Google Play page; both samples were served from the same domain, indicating a single operator. ESET notified Google and the HandyPay developer; known samples are detected by Google Play Protect and ESET.

⚡Microsoft is rolling out a set of File Explorer enhancements to Windows 11 Insiders that aim to improve launch speed and overall performance. While implementation details are limited, the company earlier tested optional background preloading to accelerate startup times and offers a toggle to disable that behavior. The update also improves reliability around stopping explorer.exe after closing windows and expands fixes for bright white flashes in dark mode. A new full-screen Xbox mode is available as well; changes are arriving for Release Preview Insiders on Builds 26100.8313 and 26200.8313 (KB5083631).

🔎 Operation PowerOFF has notified more than 75,000 suspected users of DDoS-for-hire platforms and taken 53 domains offline as part of a coordinated international law enforcement effort. Supported by Europol and authorities across 21 countries, the action included four arrests, 25 search warrants, and the dismantling of critical booter infrastructure. The operation is now shifting into a prevention phase featuring awareness campaigns, search-engine ad interventions, URL removals, and on-chain payment warnings to deter future abuse.

🔒 At VulnCon26 in April, Lindsey Cerkovnik of CISA urged that AI firms like OpenAI and Anthropic be more directly represented in the CVE program to help manage a surge in reported vulnerabilities. She warned that new AI tools both accelerate discovery of valid flaws and generate lower-value noise, putting pressure on disclosure workflows. Recent vendor developments — Anthropic’s Mythos Preview and OpenAI’s GPT-5.4-Cyber — illustrate how automated research is already changing the threat landscape. Cerkovnik said CVE funding is secure and the program remains a CISA priority.

📅 Bruce Schneier will speak at a series of conferences and virtual events through June 2026. He appears at DemocracyXChange in Toronto on April 18 and at the SANS AI Cybersecurity Summit in Arlington on April 20 at 9:40 AM ET, with other engagements including the Nemertes [Next] Virtual Conference on April 29 and RightsCon in Lusaka on May 6–7. He will deliver a keynote and join a panel for ICTLuxembourg at the University of Luxembourg on May 12, and he will speak at the Potsdam Conference on National Cybersecurity the evening of June 24.

🔍 The Trump administration's proposed 2027 budget trims total civilian federal cybersecurity funding by about $227 million, falling from $12.455 billion in 2026 to $12.228 billion in 2027. The request directs the largest increases to the Department of Justice (+$312M) and State (+$174M) while cutting Department of Homeland Security cyber funding and imposing deep reductions at CISA and the NSF. Enterprises should reassess dependencies on federal cyber support, accelerate private-sector threat intelligence ties, and review compliance assumptions given reduced federal capacity.

🚀 Yael Nardi joins Minimus as Chief Business Officer, leading top-of-funnel growth, strategic operations, and corporate development in a newly created role. She will implement an operational model to scale marketing and strategic alliances and adapt to AI-influenced customer acquisition channels. Nardi brings 15+ years advising startups, investors, and law firms and led major M&A transactions including Twistlock's sale to Palo Alto Networks. Based in New York, she will help expand Minimus's near-zero CVE hardened container image offerings and go-to-market engine.

🔒 In the latest episode of Brass Tacks: Talking Cybersecurity, Joe Robertson interviews Jürgen Stock, former INTERPOL secretary general, about how cybercrime has matured into a scalable, low‑risk, high‑profit industry. They outline an underground economy of specialized services—malware creation, access brokerage, extortion, laundering—often sold with support and guarantees. Stock warns that individuals, businesses, and critical infrastructure are all at risk, and that disciplined cyber hygiene, preparedness, and public–private cooperation remain the most effective defenses.

🔒 The Hacker News is hosting a webinar that examines why identity programs can advance while enterprise risk rises. New Ponemon Institute research finds hundreds of applications remain disconnected from centralized identity, creating an unmanaged dark matter attack surface that AI agents now exploit. Join experts Mike Fitzpatrick and Matt Chiodi for tactical guidance to measure, prioritize, and close identity gaps.

🛡️ The Hacker News highlights that while headline breaches attract investment, recurring credential incidents—account lockouts, reused or exposed passwords, and frequent resets—impose persistent operational costs. Forrester estimates resets can account for up to 30% of helpdesk tickets, at roughly $70 each, and IBM’s 2025 report cites a $4.4M average breach cost. Poorly designed password policies and mandatory periodic resets often make the problem worse by prompting insecure user behavior. Practical measures include user-friendly, robust policies, breached-password screening, and shifting away from arbitrary expiration windows; vendors such as Specops Password Policy are presented as tools that detect exposed credentials and reduce incident volume.

🔒 The White House's new cyber strategy and recent moves by major tech firms mark a clear shift from reactive defense toward proactive cyber, emphasizing disruption of adversaries earlier in the attack chain. Industry leaders frame this as the legal, intelligence-driven use of takedowns, litigation, public exposure of tools, and product hardening to impose cost and friction on attackers. While large platform providers can act at scale, enterprises are urged to focus on fundamentals, share telemetry, and support coordinated disruption rather than conduct offensive operations themselves.

⚡ This week’s incidents include a supply-chain compromise of the popular Axios npm package by actors attributed to North Korea (UNC1069) and an actively exploited Chrome zero-day (CVE-2026-5281) in the Dawn/WebGPU component. Other notable events include active exploitation of Fortinet FortiClient EMS, a TrueConf update-integrity bypass, and an accidental large code leak from Anthropic’s Claude development. Organizations should treat developer tooling, CI/CD, and dependencies as part of the attack surface and apply patches and integrity checks promptly.

🔒 Google announced a plan to complete a transition to post-quantum cryptography across its services by 2029. Security expert Bruce Schneier welcomes the decision, arguing the primary benefit is improved crypto-agility rather than an imminent quantum threat. The timeline allows Google to test implementations, assess performance and interoperability impacts, and coordinate with evolving standards. Early adoption can reduce the risk of retrospective decryption and signals leadership that may accelerate broader industry migration.

🎣 In episode 461 of Smashing Security, host Graham Cluley and guest Danny Palmer discuss a remarkable Bitcoin mystery: an Irishman who converted drug proceeds into BTC in 2011 now allegedly controls $400 million, but the access codes were hidden in a fishing-rod case that disappeared — until one frozen wallet unexpectedly moved $35 million. The episode also covers a major data breach at Ajax Football Club that may have exposed the personal details of around 300,000 supporters, enabling ticket theft and manipulation of stadium ban lists. Additional topics include an Iran-linked compromise of the FBI director’s personal email, reliability differences between Windows and macOS, and a UK court case in which CCTV footage was used in a crypto theft claim.

📘 This PDF synthesizes insights from the Hamburg IT Strategy Days, Germany’s largest IT management congress, where senior CIOs present practical blueprints for digital transformation. Leaders from BMW, E.ON, Deutsche Börse and Kärcher share how they executed complex programs to modernize infrastructure, improve delivery speed and strengthen operational resilience. The document highlights concrete approaches to aligning IT strategy with business goals, governance adjustments, and the cultural changes needed to sustain outcomes. Readers will find pragmatic lessons on balancing innovation, risk management and cost efficiency as organizations prepare operations for future disruption.

🔒 RSA Conference 2026 made clear that AI dominated every conversation, reframing priorities for CISOs and security teams. Sessions and hallway discussions emphasized securing the AI stack, managing rampant shadow AI usage, and governing machine or non-human identities. Speakers warned that AI accelerates both attacks and defensive response, while capital and workforce dynamics are shifting rapidly.