Attackers have stolen an API key from AI safety research organization METR and used it for three weeks to consume model credits that would have been worth about $600,000. METR disclosed the incident in a security update published on Aug… Read More "Attackers Steal METR API Key and Burn $600,000 in AI Credits"
FulcrumSec Claims Responsibility for Manchester Airport Group Breach
A threat group claiming responsibility for a breach of the UK’s largest airport group appears to have leaked almost all of the 550GB of data it stole online. FulcrumSec posted the data for download on its leak site, claiming to… Read More "FulcrumSec Claims Responsibility for Manchester Airport Group Breach"
Hackers Chain Two New SonicWall Zero-Day Vulnerabilities
SonicWall has notified customers of two new zero-day vulnerabilities that are being exploited in the wild, one of which is a maximum-severity flaw. A security advisory published by the vendor on September 1 revealed that the bugs affect SMA1000 appliances,… Read More "Hackers Chain Two New SonicWall Zero-Day Vulnerabilities"
Nutex Health Says Patient Data Stolen, Hackers Threaten Leak
US healthcare provider Nutex Health has disclosed that a threat actor has stolen sensitive data, including of patients, and threatened to publish it online. The Texas-based firm, which delivers care through facilities throughout the US, made the notification in an… Read More "Nutex Health Says Patient Data Stolen, Hackers Threaten Leak"
Gambling Goblin Turns Brazilian Government Sites Into SEO Weapons
A Chinese-speaking cybercrime cluster has turned compromised Brazilian government and education websites into infrastructure for a sustained SEO fraud campaign operating since mid-2025. Check Point Research (CPR) dubbed the group Gambling Goblin and assessed with medium-to-high confidence that it is… Read More "Gambling Goblin Turns Brazilian Government Sites Into SEO Weapons"
Russian Man Extradited Over Malware Campaign Targeting Freelancers
A Russian man has been extradited to the US over allegations that he helped distribute malware to approximately 80,000 users of a freelance employment platform between 2016 and 2017. The US Department of Justice (DoJ) said Searzhudin Tamirlanovich Aktulaev, 40,… Read More "Russian Man Extradited Over Malware Campaign Targeting Freelancers"
AI Agent Carries Out Multi-Stage Data Theft Attack
Spain’s data protection agency has reported the country’s first agentic AI-powered personal data breach. Francisco Pérez Bes, president of the Agencia Espanola Proteccion Datos (AEPD), revealed the news in a post on September 14. He said that an agent using… Read More "AI Agent Carries Out Multi-Stage Data Theft Attack"
Cisco Warns of Active Exploitation of Critical ISE Flaw
Cisco has warned customers of the active exploitation of a maximum severity flaw affecting its Cisco Identity Services Engine (ISE) product. The flaw, CVE-2026-76460, is due to insufficient control on an API endpoint. It has a maximum CVSS rating of… Read More "Cisco Warns of Active Exploitation of Critical ISE Flaw"
Cyber Essentials Has Record Year but Takeup Remains Low
The UK government’s flagship cyber certification scheme hit a record high of 61,430 certificates awarded over the past year, but relatively few businesses overall have signed up. The newly published figures show a 20% increase in Cyber Essentials (CE) certifications… Read More "Cyber Essentials Has Record Year but Takeup Remains Low"
Can You Adjust Vendor Security Ratings?
Vendor security ratings cannot be adjusted without modifying the criteria for evaluating a vendor’s security posture. Ratings are one input to a TPRM program, not a substitute for the stages around them. Since the ability to make unmitigated adjustments violates… Read More "Can You Adjust Vendor Security Ratings?"