Tabletop exercises need to simulate real business disruption scenarios, not just technical failures, says George Gerchow, CSO at security firm Bedrock and faculty member at IANS Research, a research and advisory firm. “Effective ransomware preparedness begins with practice, not panic,”… Read More "How to create a ransomware playbook that works"
A Google Chrome extension with a “Featured” badge and six million users has been observed silently gathering every prompt entered by users into artificial intelligence (AI)-powered chatbots like OpenAI ChatGPT, Anthropic Claude, Microsoft Copilot, DeepSeek, Google Gemini, xAI Grok, Meta… Read More "Featured Chrome Browser Extension Caught Intercepting Millions of Users’ AI Chats"
Microsoft hat angekündigt, dass sein Bug-Bounty-Programm ausgeweitet werden soll. bluestork – shutterstock.com Cyberangriffe beschränken sich heutzutage nicht auf bestimmte Unternehmen, Produkte oder Dienstleistungen – sie finden dort statt, wo die Schwachstellen sind. Zudem werden die Attacken mit Hilfe von KI-Tools… Read More "Microsoft stellt neue Sicherheitsstrategie vor"
At one global manufacturing client, an AI model flagged a potential breach pattern that turned out to be normal behavior from a test server. The system wasn’t wrong — but the humans stopped questioning it. It took a single analyst… Read More "The 5 power skills every CISO needs to master in the AI era"
A new phishing campaign delivering the Phantom information-stealing malware through a multi-stage attachment chain has been identified by cybersecurity researchers. The activity, observed by Seqrite Labs, reportedly originates from Russia and relies on a fake payment confirmation email to entice… Read More "Russian Phishing Campaign Delivers Phantom Stealer Via ISO Files"
Dec 15, 2025Ravie LakshmananVulnerability / Software Security Multiple security vulnerabilities have been disclosed in the open-source private branch exchange (PBX) platform FreePBX, including a critical flaw that could result in an authentication bypass under certain configurations. The shortcomings, discovered by… Read More "FreePBX Patches Critical SQLi, File-Upload, and AUTHTYPE Bypass Flaws Enabling RCE"
Die Ransomware-Bande Akira hat die Versicherungsgruppe Ideal angegriffen. Who is Danny – shutterstock.com Auf seiner Webseite informiert das Versicherungsunternehmen Ideal aktuell über einen Cyberangriff. Die Systeme seien vorsorglich vom Netz genommen worden und der Geschäftsbetrieb würde nur noch eingeschränkt funktionieren,… Read More "Ransomware-Bande attackiert Ideal Versicherung | CSO Online"
In early December 2025, security researchers exposed a cybercrime campaign that had quietly hijacked popular Chrome and Edge browser extensions on a massive scale. A threat group dubbed ShadyPanda spent seven years playing the long game, publishing or acquiring harmless… Read More "A Browser Extension Risk Guide After the ShadyPanda Campaign"
In my discussions as part of the AMSC, we workshop scenarios constantly. What counts as an incident when the MARSEC (MARitime SECurity) Level needs to be elevated from 1 to 2 for a cybersecurity threat? MARSEC Level 2 requires additional… Read More "No more orange juice? Why one ship reveals America’s maritime cybersecurity crisis"
UK government security experts have called on the country’s businesses to embed best practice security in their supply chains using a new playbook. The National Cyber Security Centre (NCSC) said on Friday that the government’s Cyber Essentials (CE) scheme should be… Read More "NCSC Playbook Embeds Cyber Essentials in Supply Chains"
