Latest CyberSec News by @thecyberpicker

Microsoft has reminded customers today that the last supported editions of Windows 11 22H2 will reach their end of servicing on October 14.

The intrusion comes amid a wave of recent social-engineering attacks targeting the insurance sector and other industries.

10,000 WordPress sites vulnerable to takeover due to critical flaws in HT Contact Form Widget plugin

The project, launched by Carnegie Mellon in collaboration with Anthropic, simulated the 2017 Equifax data breach.

The Internet Archive has become an official U.S. federal depository library, providing online users with access to archived congressional bills, laws, regulations, presidential documents, and other U.S. government documents.

Researchers in California contacted data brokers in their state to exercise their rights under the California Privacy Protection Act. Many didn’t reply, while others threw up barriers.

Officials said thousands of people, typically between 11 and 25 years old, are engaged in a growing and evolving online threat to commit crime for money, retaliation, ideology, sexual gratification and notoriety.

Un hacker affirme détenir des documents sensibles sur Naval Group. Le 26 juillet, il a publié 30 Go de données sur un forum du dark web. Contacté par Numerama, le géant militaire français confirme que les documents proviennent bien de l’entreprise, mais assure qu’aucun n’est classé « secret défense ». L’actualité de

Exposed API documentation is a gift-wrapped roadmap for threat actors. The free Autoswagger tool from Intruder scans for exposed docs and flags endpoints with broken access controls—before attackers find them.

Scattered Spider has targeted VMware vSphere environments, exploiting retail, airline and insurance sectors

CSA’s CCM includes cloud security monitoring and logging controls. Implement effective incident response, audit log security, clock synchronization, and more.

From insider arrests to AI-powered fraud, here’s what mattered in cyber this week—no fluff, just the signal.

Critical vulnerability in Post SMTP plugin risks full site takeover, over 400k sites use it, and nearly half remain unpatched.

Makers of the app for women called Tea are continuing to respond to an intrusion into a "legacy data storage system" that exposed photos of users, including images of driver's licenses.

Xlight FTP 1.1 - Denial Of Service (DOS). CVE-2024-0737 . dos exploit for Multiple platform

Insurance firm Allianz Life said that a threat actor accessed personally identifiable information of the majority of its 1.4 million US customers

L'application Tea, qui permettait à des femmes de s'échanger des informations sur les hommes qu'elles rencontrent, a été victime d'une fuite de données. Des pièces d'identité et des selfies de vérification des utilisatrices ont été exposés, et dérobées par des hackers. Les développeurs de Tea s'en mordent les doigts

Chinese hackers are exploiting a high-severity vulnerability in Microsoft SharePoint to steal data worldwide: The vulnerability, tracked as CVE-2025-53770, carries a severity rating of 9.8 out of a possible 10. It gives unauthenticated remote access to SharePoint Servers exposed to the Internet. Starting Friday, researchers began warning of active exploitation of the vulnerability, which affects SharePoint Servers that infrastructure customers run in-house. Microsoft’s cloud-hosted SharePoint Online and Microsoft 365 are not affected. Here’s...

Overloaded by the latest Network+ certification study materials? This CompTIA Network+ cheat sheet is for you—get your copy now and ace the exam fast.

Minneapolis-based Allianz Life said “a malicious threat actor gained access to a third-party CRM system” earlier in July, breaching data of a large amount of its customers.

Recent global events highlight the need to look at computer networks as an adversary would. AI tools are lowering the bar for hacktivists hoping to wreak havoc.

Legacy email filters miss post-delivery threats in Microsoft 365 and Google Workspace, exposing data. Here's how EDR-style tools change the game.

Despite claims by a hacker, French defense company Naval Group has detected no intrusions into its IT environments at the time of writing

We are pleased to openly share our pledges and the progress we are making in each of the seven core pillars of product security in the Secure by Design framework

Suggestions de code, aide au débogage, automatisation des tâches… la promesse d’Amazon Q Developer est simple : fluidifier le travail des développeurs. Et si cette extension, téléchargée près d’un million de fois, était piratée et se retrouvait programmée pour essayer d’effacer toutes vos données ? C’est le scénario

The tech giant’s model is built around anticompetitive practices, the head of the Coalition for Fair Software Licensing argues.

China-linked group Fire Ant exploits VMware and F5 flaws to stealthily breach secure systems, reports cybersecurity firm Sygnia.

Default-deny, strict controls, and real-time monitoring: how to stop threats before they start.

Arizonan woman sentenced to 102 months for operating laptop farm for North Korean IT workers

Dating app Tea has been compromised by a hacker, resulting in the exposure of 13,000 selfies