Latest Cybersecurity News and Articles

---

Google Fined $379 Million by French Regulator for Cookie Consent Violations

The French data protection authority has fined Google and Chinese e-commerce giant Shein $379 million (€325 million) and $175 million (€150 million), respectively, for violating cookie rules. Both companies set advertising cookies on users' browsers without securing their consent, the National Commission on Informatics and Liberty (CNIL) said. Shein has since updated its systems to comply with

---

CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added two security flaws impacting TP-Link wireless routers to its Known Exploited Vulnerabilities (KEV) catalog, noting that there is evidence of them being exploited in the wild. The vulnerabilities in question are listed below - CVE-2023-50224 (CVSS score: 6.5) - An authentication bypass by spoofing vulnerability

---

Wytec Expects Significant Financial Loss Following Website Hack

Wytec’s website was defaced twice by unknown threat actors more than a week ago and it has yet to be brought back online. The post Wytec Expects Significant Financial Loss Following Website Hack appeared first on SecurityWeek.

---

Hackers Exploit Sitecore Zero-Day for Malware Delivery

Google has observed ViewState deserialization attacks leveraging a sample machine key exposed in older deployment guides. The post Hackers Exploit Sitecore Zero-Day for Malware Delivery appeared first on SecurityWeek.

---

Two Exploited Vulnerabilities Patched in Android

Elevation of privilege flaws in Android Runtime (CVE-2025-48543) and Linux kernel (CVE-2025-38352) have been exploited in targeted attacks. The post Two Exploited Vulnerabilities Patched in Android appeared first on SecurityWeek.

---

378 GB of Data From Navy Federal Credit Union Exposed

A database, in apparent association with the Navy Federal Credit Union, exposed 378 GB of information. 

---

Tidal Cyber Raises $10 Million for CTI and Adversary Behavior Platform

Co-founded by former MITRE experts, the startup will use the funding to accelerate product innovation and fuel company growth. The post Tidal Cyber Raises $10 Million for CTI and Adversary Behavior Platform appeared first on SecurityWeek.

---

Malicious npm Packages Exploit Ethereum Smart Contracts to Target Crypto Developers

Cybersecurity researchers have discovered two new malicious packages on the npm registry that make use of smart contracts for the Ethereum blockchain to carry out malicious actions on compromised systems, signaling the trend of threat actors constantly on the lookout for new ways to distribute malware and fly under the radar. "The two npm packages abused smart contracts to conceal malicious

---

US Cybersecurity Agency Flags Wi-Fi Range Extender Vulnerability Under Active Attack

Flaw allows attackers to reset and hijack TP-Link TL-WA855RE devices; CISA urges users to retire discontinued extenders. The post US Cybersecurity Agency Flags Wi-Fi Range Extender Vulnerability Under Active Attack appeared first on SecurityWeek.

---

Google Patches High-Severity Chrome Vulnerability in Latest Update

Chrome's latest release addresses a high-severity use-after-free vulnerability in the V8 JavaScript engine that could be exploited for remote code execution. The post Google Patches High-Severity Chrome Vulnerability in Latest Update appeared first on SecurityWeek.

---

Cato Networks Acquires AI Security Firm Aim Security

Founded in 2022 to help organizations with the secure deployment of generative-AI utilities, Aim emerged from stealth in January 2024. The post Cato Networks Acquires AI Security Firm Aim Security appeared first on SecurityWeek.

---

Threat Actors Weaponize HexStrike AI to Exploit Citrix Flaws Within a Week of Disclosure

Threat actors are attempting to leverage a newly released artificial intelligence (AI) offensive security tool called HexStrike AI to exploit recently disclosed security flaws. HexStrike AI, according to its website, is pitched as an AI‑driven security platform to automate reconnaissance and vulnerability discovery with an aim to accelerate authorized red teaming operations, bug bounty hunting,

---

Hacker Conversations: McKenzie Wark, Author of A Hacker Manifesto

Known for her seminal book, A Hacker Manifesto, Wark reframes hacking as a cultural force rooted in play, creativity, and human nature. The post Hacker Conversations: McKenzie Wark, Author of A Hacker Manifesto appeared first on SecurityWeek.

---

Are Wearable Devices a Privacy Risk?

A study dives into the data collected by wearable devices to better understand how it is being used. 

---

Detecting Data Leaks Before Disaster

In January 2025, cybersecurity experts at Wiz Research found that Chinese AI specialist DeepSeek had suffered a data leak, putting more than 1 million sensitive log streams at risk. According to the Wiz Research team, they identified a publicly accessible ClickHouse database belonging to DeepSeek. This allowed “full control over database operations, including the ability to access

---

Pennsylvania Attorney General Confirms Ransomware Behind Weeks-Long Outage

Attack disrupted email, phones, and websites for weeks, but officials say no ransom was paid. The post Pennsylvania Attorney General Confirms Ransomware Behind Weeks-Long Outage appeared first on SecurityWeek.

---

Android Security Alert: Google Patches 120 Flaws, Including Two Zero-Days Under Attack

Google has shipped security updates to address 120 security flaws in its Android operating system as part of its monthly fixes for September 2025, including two issues that it said have been exploited in targeted attacks. The vulnerabilities are listed below - CVE-2025-38352 (CVSS score: 7.4) - A privilege escalation flaw in the Linux Kernel component  CVE-2025-48543 (CVSS score: N/A) - A

---

Iranian Hackers Exploit 100+ Embassy Email Accounts in Global Phishing Targeting Diplomats

An Iran-nexus group has been linked to a "coordinated" and "multi-wave" spear-phishing campaign targeting the embassies and consulates in Europe and other regions across the world. The activity has been attributed by Israeli cybersecurity company Dream to Iranian-aligned operators connected to broader offensive cyber activity undertaken by a group known as Homeland Justice. "Emails were sent to

---

Jaguar Land Rover Operations ‘Severely Disrupted’ by Cyberattack

The automotive company said it disconnected its systems, which severely impacted both retail and manufacturing operations. The post Jaguar Land Rover Operations ‘Severely Disrupted’ by Cyberattack appeared first on SecurityWeek.

---

Security Firms Hit by Salesforce–Salesloft Drift Breach

Hackers accessed customer contact information and case data from Salesforce instances at Cloudflare, Palo Alto Networks, and Zscaler. The post Security Firms Hit by Salesforce–Salesloft Drift Breach appeared first on SecurityWeek.