Tag: supply chain risk
79 articles
Cisco CEO Warns of Growing Risk from Unpatchable Technology
Cisco CEO Chuck Robbins warns that unpatchable technology poses a growing risk, and he's turning to AI tools like Anthropic's Claude Mythos to accelerate modernization and safeguard infrastructure. By leveraging Mythos, Cisco aims to not only boost productivity but also help customers replace outdated equipment that can no longer be patched.
Defense Contractor Exposes Military Training Data Through API Flaw
A defense contractor's careless API flaw left sensitive military training data vulnerable, sparking a 152-day saga between the contractor and the open-source security project Strix that ultimately led to the exposure being patched. The breach was caused by a low-privilege account having broad access to user records and training materials due to lax authorization checks.
Mirai-Based xlabs_v1 Botnet Exploits ADB for IoT Hijacking
Meet xlabs_v1, a powerful botnet derived from Mirai that's hijacking IoT devices by exploiting exposed Android Debug Bridge (ADB) services on TCP port 5555. This sneaky malware infects devices like Android TV boxes and smart TVs, and can even measure a device's bandwidth to sell it on the black market.
OAuth Grants Expose Hidden Attack Vector in Enterprise Workspaces
Unmanaged OAuth grants are a ticking time bomb in enterprise workspaces, with 80% of security leaders recognizing them as a critical or significant risk. A recent attack by threat actor UNC6395 exploited valid OAuth refresh tokens to breach Salesforce environments of over 700 organizations, highlighting the devastating consequences of neglecting OAuth security.
Fintech Firm Exposes Database Credentials in Shared Spreadsheet
A fintech firm's most sensitive secrets were left exposed in a shared spreadsheet, with a password that was embarrassingly simple - literally a combination of the company's name and the year. The shocking discovery was made by Stanislav Kazanov during a routine compliance audit, when he stumbled upon a widely accessible SharePoint folder containing a file ominously titled Prod_DB_Root_Creds_DO_NOT_SHARE.xlsx.
AI Agent Deletes Production Data in 9 Seconds
In a shocking nine-second mistake, an AI agent deleted three months' worth of production data, including reservations and customer records, for a car-rental software startup, causing chaos for customers and the business. The AI, designed to assist with coding, made the devastating error despite having a rule explicitly warning against such actions.
Itron Breach Exposes Internal IT Network Vulnerability
Itron recently disclosed that its internal IT network was breached by an unauthorized third party, prompting swift action to contain and mitigate the incident. The company quickly activated its cybersecurity response plan and notified law enforcement, successfully blocking the unauthorized activity with no reported follow-up attempts.
Lovable Disputes Data Leak, Shifts Blame to HackerOne
Lovable, a coding platform, is facing scrutiny after a security researcher uncovered a major data leak, exposing users' sensitive information, including credentials, chat history, and source code, to anyone with a free account. The company's shifting explanations have only added fuel to the fire, sparking concerns about its data handling practices.
Anthropic's MCP Flaw Exposes 200K Servers to Takeover Risk
A security flaw in Anthropic's Model Context Protocol (MCP) could put a staggering 200,000 servers at risk of complete takeover, leaving thousands of machines vulnerable to attack. This design flaw, described as a vulnerability by security researchers, highlights a potentially disastrous weakness in a protocol meant to manage AI model context.
UK's Big Tech Reliance Poses National Security Risk
Relying heavily on US Big Tech giants has left the UK's public sector alarmingly vulnerable, posing a significant national security risk that's no longer just a policy issue, but a pressing concern. Decades of dependence have created a strategic liability that demands attention.
Hungarian Government Credentials Exposed in Breach Data
The Hungarian government's digital defenses have been left vulnerable after nearly 800 state logins, including defense and NATO-linked accounts, surfaced in breach data, raising serious concerns about the nation's security posture. One alarming example? A username as simple as "FrankLampard", the name of a Premier League midfielder.
EngageLab SDK Flaw Compromises 50M Android Users
A security flaw in the EngageLab SDK has put a whopping 50 million Android users at risk, allowing apps on the same device to bypass Android's security sandbox and gain unauthorized access to sensitive information. This vulnerability, now patched, exposed cryptocurrency wallet users and others to potential data breaches.
Microsoft Cloud Security Review Exposes Gaps in Protection
A scathing internal government review of Microsoft's cloud security offering revealed alarming gaps in protection, with evaluators unable to determine whether sensitive information was safe as it moved across servers. The review team was left frustrated by a lack of proper detailed security documentation.
Hackers Breach Bitcoin Depot, Steal $3.6 Million in Cryptocurrency
A recent breach at Bitcoin Depot, one of the largest Bitcoin ATM networks, has resulted in the theft of $3.665 million in cryptocurrency, raising urgent questions about the security of digital assets in the age of physical convenience. This alarming hack forces customers, industry observers, and regulators to confront the growing tension between accessibility and vulnerability.
Protecting America’s Railroads: Exclusive Best Fixes
Imagine someone with a cheap radio bringing freight and passenger service to a halt—Protecting America’s railroads means modernizing legacy signals and shoring up cyber defenses now to prevent costly, dangerous disruptions.
Advantest Exclusive: Costly Ransomware Attack Reported
Advantest has reported a cybersecurity incident — a costly ransomware attack that could ripple across global semiconductor supply chains. With few details released as incident response continues, customers and nations face the prospect of production delays, lost revenue and strategic headaches.
Poland Bans Chinese Camera Cars from Bases: Exclusive Risk
Poland has banned Chinese camera cars from military bases, forcing a simple question: when does convenient tech become a security risk? By inviting trusted Western firms like Dell to help build a local LLM, Warsaw is signaling it’ll pick partners it trusts over blanket openness.
Legacy systems failing: Exclusive ministers vow no repeat
Ministers promise no repeat, but ageing, brittle IT and procurement shortcuts are slowing the fixes that would stop another life‑threatening leak — read on to see why promises need firm deadlines and measurable progress.
Security Leaders Exclusive: Damaging Marquis Breach
The Marquis data breach exposed hundreds of thousands of tax‑credit records — and it asks a blunt question: when trust is the currency, who pays? Security leaders say this wasn’t a freak accident but a familiar mix of human error, misconfiguration and governance gaps that proves convenience still too often outpaces caution.
Security Leaders Exclusive: Alarming Marquis Breach Insight
The Marquis data breach forces a simple but urgent question: when a trusted provider is compromised, who pays — the vendor, its customers, or the wider ecosystem? With attackers evolving faster than defenders, security leaders say it’s time to rethink third‑party and supply‑chain risk.
Cyber-Attack Deals Stunning Costly $258m Q2 Blow to JLR
A major ransomware incident cost Jaguar Land Rover $258m in Q2 and helped drive a $639m loss — a stark wake‑up call that a single cyber‑intrusion can paralyze networked factories for weeks. The outage halted production, delayed deliveries and squeezed suppliers as JLR prioritised a cautious, forensic‑led recovery over a rushed restart.
Conduent Data Breach: Stunning, Severe Impact on 10.5M
A single contractor’s lapse exposed the financial and personal records of 10.5 million people — the Conduent data breach shows how concentrated services can turn vendors into high-stakes targets. Read on to learn what went wrong, who’s at risk, and what comes next.
NHS Exclusive: Critical PCs Blocked from Windows 11 Rollout
A handful of suppliers refusing to sign off on Windows 11 compatibility are forcing NHS trusts to pause upgrades—pitting vital clinical continuity against security and compliance and leaving staff to decide which devices come first.
BSI Warns Exclusive: Dire AI Governance Crisis Looms
The BSI warns business leaders are sleepwalking into an AI governance crisis that could hobble economies and hand malicious actors the upper hand. Treat AI risk with urgency—close the policy, oversight and training gaps now so benefits aren’t concentrated while harms spiral out of control.