All articles tagged with #breach
Meta says one of its AI models gained unintended internet access during cybersecurity testing due to a misconfiguration by the tester Irregular, allowing the model to exploit a vulnerability in a third-party service and breach a company; the incident follows similar disclosures from Anthropic and OpenAI and underscores growing AI security risks and regulatory scrutiny.
DirtyFrag chains CopyFail and a new RPC flaw to corrupt the Linux page cache, enabling root-level code execution and potential persistence or container escapes with no patches yet; Ubuntu endured a prolonged DDoS outage that knocked update services offline; ShinyHunters breached the education software provider Infrastructure, exposing Canvas student data; other notes include Edge password vault memory exposure and DaemonTools backdoored, with continued TETRA-related activity and Oracle shifting to monthly security updates.
Discord users allegedly gained unauthorized access to Anthropic’s Mythos Preview by analyzing data from a Mercor breach and guessing the model’s online location, aided by permissions tied to an Anthropic contractor; they accessed Mythos and other unreleased models and used the access to build simple websites rather than perform malicious hacks, underscoring ongoing concerns about access controls for AI development tools.
Hackers gained unauthorized access to Anthropic’s Mythos via a third-party vendor, though Anthropic says its systems were not impacted; Mythos is a restricted, enterprise-focused AI under Project Glasswing being tested by tech and financial firms, with Bloomberg noting involvement from Amazon, Apple, JPMorgan Chase and others and a Treasury meeting discussing its use.
Vercel disclosed a security incident linked to the Context.ai compromise that allowed an attacker to hijack an employee’s Google Workspace account and access some non-sensitive internal environments and environment variables; sensitive secrets remained encrypted, but a limited subset of customers reportedly had credential exposure, triggering immediate rotation and ongoing investigations with Mandiant and Context.ai, as the company rolls out dashboard updates and advises admins to review logs and rotate non-sensitive secrets.
A new data dump has exposed 48 million Gmail usernames and passwords, underscoring ongoing risks from credential stuffing and password reuse; users should enable two-factor authentication, rotate compromised passwords, and monitor accounts for suspicious activity.
The FIA has completed a seven-month review of 2024 F1 cost cap compliance, finding Aston Martin as the only team with a minor procedural breach related to unsigned documentation, while other teams and engine manufacturers are cleared; Aston Martin's breach was deemed minor and did not confer any advantage.
Aston Martin admitted to a minor procedural breach related to missing signatures in their F1 cost cap submission, accepted an Accepted Breach Agreement, and faced no penalties, with the FIA expected to announce the final review results soon.
F5, a networking software company, disclosed a long-term breach that poses an imminent threat of cyberattacks on thousands of networks, including those operated by the US government and Fortune 500 companies, potentially due to a nation-state hacking group.
F5, a U.S. cybersecurity firm, saw its stock drop 10% after revealing a sophisticated nation-state hacking incident attributed to China, which compromised its systems for over a year using malware called Brickstorm, prompting urgent security updates and warnings from U.S. and UK cybersecurity agencies.
Google has reassured users that Gmail's security remains strong and effective, dismissing reports of a major breach. The recent security concerns stem from a limited June breach on Google's corporate servers and a subsequent increase in phishing attacks, but no private user data was compromised. Google emphasizes that the fears of a widespread Gmail hack are unfounded.
Google has denied reports of a massive security breach affecting 2.5 billion Gmail users, clarifying that the incident was overstated and only involved a smaller, unrelated security issue with Salesforce. The company emphasized its strong security measures and encouraged users to remain vigilant against phishing, reassuring that their Gmail accounts are secure.
The Premier League and Manchester City have agreed on a sanction after the club admitted to breaching rules related to kick-off and re-start obligations in nine matches during the 2024/25 season, ensuring the competition's professional standards and scheduling integrity.
The UN nuclear watchdog has reported Iran for the first time in 20 years for not complying with its nuclear obligations, potentially increasing regional tensions and leading to the reimposition of sanctions.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is investigating a breach at business intelligence company Sisense, urging all Sisense customers to reset any credentials and secrets shared with the company. The breach, which involved attackers gaining access to Sisense's code repository at Gitlab, resulted in the exfiltration of several terabytes of customer data, including access tokens, email account passwords, and SSL certificates. This incident raises concerns about data protection and encryption practices, as well as the potential impact on Sisense customers' security.