NewsroomLatest briefings
Every security and AI story SECBORN has published, newest first.
Sweden Fines Miljödata $183,000 Over Breach Hitting 2.2 Million Residents
Swedish regulator IMY says the HR software provider failed to vet new software installs and lacked real time intrusion monitoring ahead of…
TrustSink Attack Lets Rogue Entra MFA Providers Steal Passwords Post-Compromise
Varonis Threat Labs details TrustSink, a technique where attackers with privileged Entra access register a rogue external MFA provider to harvest passwords…
CISA Orders Federal Agencies to Patch Exploited Zyxel Switch Flaw by Thursday
A stack-based buffer overflow in Zyxel GS1900 series switches is being actively exploited to steal data, prompting CISA to add the bug…
New Defender Zero-Day ‘BigDiskBuster’ Freezes Antivirus Updates
Researcher Abdelhamid Naceri has released another unpatched Microsoft Defender exploit, this time a denial-of-service tool that silently blocks signature and platform updates…
BigCommerce Merchants Hit by Data Breach Tied to Compromised Ribon App Keys
Attackers stole credentials for the third-party Ribon apps and used them to inject malicious scripts and access shopper data across multiple BigCommerce…
CISA: Three Linux Kernel Flaws Under Active Attack, One Critical
CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, including a 14-year-old race condition and a critical TLS flaw,…
Viral AI Actress’ Hotline Face-Scans Every Caller to Check Age and Mood
Talking Tilly, the video-call service behind viral AI actress Tilly Norwood, quietly added a mandatory biometric age check and always-on emotion tracking…
New ChainScript RAT Spreads via ClickFix Lures, Uses Polygon for C2
Researchers have identified a previously undocumented RAT called ChainScript that abuses ClickFix-style social engineering and rotates command-and-control infrastructure through the Polygon blockchain.
Researchers Break Out of OpenAI Codex Sandbox to Reach the Host
Two sandbox escapes in OpenAI's Codex coding agent, one triggerable just by asking about a malicious repository, let attackers run unsandboxed commands…
Malicious npm Packages Dodge Install-Script Defenses by Hiding in Runtime Code
A campaign centered on the fake 'indexed-btree' package shows attackers bypassing npm's new lifecycle-script protections by embedding malware inside a library's normal…
North Korean WaterPlum Hackers Hit 30,000 Devices, Stole $10.7M in Crypto
A joint advisory from US, Japanese, Australian, and German authorities details how the Contagious Interview campaign used fake job offers and malicious…
TigerByte Cyber Launches With $3M to Harden Edge and AI Devices
The Hanover, NH startup is bringing hardware-enforced security, including post-quantum encryption, to legacy and mission-critical edge systems across military and commercial sectors.