Cloud Security Alliance Issues Top Threats to Cloud Computing | CSA
Latest CyberSec News by @thecyberpicker
SentinelOne Uncovers Chinese Espionage Campaign Targeting Its Infrastructure and Clients
SentinelOne uncovers China-linked PurpleHaze attacks and North Korean infiltration attempts amid rising EDR testing abuses.
Google: 97 zero-days exploited in 2024, over 50% in spyware attacks
Google's Threat Intelligence Group (GTIG) says attackers exploited 75 zero-day vulnerabilities in the wild last year, over 50% of which were linked to spyware attacks.
CISA tags Broadcom Fabric OS, CommVault flaws as exploited in attacks
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is warning of Broadcom Brocade Fabric OS, Commvault web servers, and Qualitia Active! Mail clients vulnerabilities that are actively exploited in attacks.
Digital rampage saw ex-Disney employee remove nut allergy info from menus, dox co-workers, and more
A former Disney employee has been sentenced to three years in prison for computer fraud and identity theft. He must also pay nearly US$688,000 in restitution.
Avec 5629 notifications, les violations de données ont augmenté de 20% en 2024, selon la Cnil
En 2024, la Commission nationale de l'informatique et des libertés a reçu 5629 notifications de violation de données personnelles. Un chiffre...-Cybersécurité
Palo Alto Networks rachète Protect AI pour mieux sécuriser l'intelligence artificielle
La firme américaine met la main sur Protect AI, une start-up spécialisée dans la sécurisation des applications et modèles d'IA. Les solutions...-Cybersécurité
De l'enrôlement à l'usage, Thales lance une offre dédiée à l'identité numérique
Fournisseur d'un tiers des documents d'identité sécurisés dans le monde, Thales ambitionne devenir le partenaire privilégié pour la gestion de...-Cybersécurité
Nova Scotia energy provider takes some servers offline following cyber incident
On Friday, Nova Scotia Power — which provides serves 95% of the power for the region — discovered a cyber incident involving unauthorized access to its systems.
New Gremlin Infostealer Distributed on Telegram
Administrators of a Telegram channel named CoderSharp have been advertising Gremlin Stealer since March 2025
A New Era for Compliance | Compliance Automation | CSA
The Compliance Automation Revolution is a CSA initiative to develop methods to automatically gather compliance evidence, harmonize frameworks, & quantify risk.
Cloud Security Alliance Transforms IT Compliance and Assurance | CSA
Sixth PQC Standardization Conference
F
Google Reports 75 Zero-Days Exploited in 2024 — 44% Targeted Enterprise Security Products
75 zero-days exploited in 2024, with 44% hitting enterprise tools and 34 tied to threat groups.
Product Walkthrough: Securing Microsoft Copilot with Reco
Find out how Reco keeps Microsoft 365 Copilot safe by spotting risky prompts, protecting data, managing user access, and identifying threats.
Applying Security Engineering to Prompt Injection Security - Schneier on Security
This seems like an important advance in LLM security against prompt injection: Google DeepMind has unveiled CaMeL (CApabilities for MachinE Learning), a new approach to stopping prompt-injection attacks that abandons the failed strategy of having AI models police themselves. Instead, CaMeL treats language models as fundamentally untrusted components within a secure software framework, creating clear boundaries between user commands and potentially malicious content. […] To understand CaMeL, you need to understand that prompt injections happen when AI systems can’t distinguish between legitimate user commands and malicious instructions hidden in content they’re processing...
Infostealers Harvest Over 30,000 Australian Banking Credentials
Dvuln researchers highlighted the growing impact of infostealers on the cybercrime landscape, enabling attackers to bypass traditional defenses
Hello 0-Days, My Old Friend: A 2024 Zero-Day Exploitation Analysis
This Google Threat Intelligence Group report presents an analysis of detected 2024 zero-day exploits.
Year in Review: AI based threats
2024 wasn't the year that AI rewrote the cybercrime playbook — but it did turbocharge some of the old tricks. Read this summary of AI-based threats, from Talos' 2024 Year in Review.
What privacy? Perplexity wants your data, builds browser to track you and serve ads
AI search service Perplexity AI doesn't just want you using its app—it wants to take over your web browsing experience too.
When to Hire a GDPR Auditor | CSA
Discover when to engage a GDPR auditor and how platforms streamline compliance with automated tools and expert support.
Zero-Day Exploitation Figure Surges 19% in Two Years
Google claims 19% more zero-day bugs were exploited in 2024 than 2022 as threat actors focus on security products
https://securelist.com/outlaw-botnet/116444/
Finding Minhook in a sideloading attack – and Sweden too
Multifaceted changes in TTPs illustrate what researchers see when they start digging
Zero-day exploitation drops slightly from last year, Google report finds
Google’s threat intelligence team said software vendor security practices are making it harder for hackers to find flaws in some platforms.
Europol Creates “Violence-as-a-Service” Taskforce
Europol has launched a new initiative designed to combat recruitment of youngsters into violent organized crime groups
U.S. CISA adds Qualitia Active! Mail, Broadcom Brocade Fabric OS, and Commvault Web Server flaws to its Known Exploited Vulnerabilities catalog
US CISA adds Qualitia Active! Mail, Broadcom Brocade Fabric OS, and Commvault Web Server flaws to its Known Exploited Vulnerabilities catalog
Malware Attack Targets World Uyghur Congress Leaders via Trojanized UyghurEdit++ Tool
Custom malware hidden in UyghurEdit++ targeted WUC leaders since May 2024, exposing Uyghur diaspora surveillance links to China.
CISA Adds Actively Exploited Broadcom and Commvault Flaws to KEV Database
CISA added Broadcom and Commvault vulnerabilities to KEV after confirming active exploitation.
Cookie-Bite Attack Demoes Extension Exploit To Steal Cookies
Cookie-Bite attack allows stealing session cookies via browser extension, bypassing MFA and other login security checks.