Latest Cybersecurity News and Articles

---

Cost of Data Breach in US Rises to $10.22 Million, Says Latest IBM Report

The global average cost of a breach fell to $4.44 million (the first decline in five years), but the average US cost rose to a record $10.22 million. The post Cost of Data Breach in US Rises to $10.22 Million, Says Latest IBM Report appeared first on SecurityWeek.

---

Flaw in Vibe Coding Platform Base44 Exposed Private Enterprise Applications

Base44 owner Wix quickly patched a critical authentication bypass vulnerability discovered by researchers at Wiz. The post Flaw in Vibe Coding Platform Base44 Exposed Private Enterprise Applications appeared first on SecurityWeek.

---

Minnesota Activates National Guard in Response to Cyberattack

Minnesota Governor Tim Walz called in the National Guard to assist the City of Saint Paul in responding to a cyberattack. The post Minnesota Activates National Guard in Response to Cyberattack appeared first on SecurityWeek.

---

Product Walkthrough: A Look Inside Pillar's AI Security Platform

In this article, we will provide a brief overview of Pillar Security's platform to better understand how they are tackling AI security challenges. Pillar Security is building a platform to cover the entire software development and deployment lifecycle with the goal of providing trust in AI systems. Using its holistic approach, the platform introduces new ways of detecting AI threats, beginning

---

Apple Patches Safari Vulnerability Also Exploited as Zero-Day in Google Chrome

Apple on Tuesday released security updates for its entire software portfolio, including a fix for a vulnerability that Google said was exploited as a zero-day in the Chrome web browser earlier this month. The vulnerability, tracked as CVE-2025-6558 (CVSS score: 8.8), is an incorrect validation of untrusted input in the browser's ANGLE and GPU components that could result in a sandbox escape via

---

Google Launches DBSC Open Beta in Chrome and Enhances Patch Transparency via Project Zero

Google has announced that it's making a security feature called Device Bound Session Credentials (DBSC) in open beta to ensure that users are safeguarded against session cookie theft attacks. DBSC, first introduced as a prototype in April 2024, is designed to bind authentication sessions to a device so as to prevent threat actors from using stolen cookies to sign-in to victims' accounts and gain

---

Tonic Security Launches With $7 Million in Seed Funding

Tonic Security has emerged from stealth mode to tackle the complexity of exposure and vulnerability management. The post Tonic Security Launches With $7 Million in Seed Funding appeared first on SecurityWeek.

---

Apple Patches Safari Vulnerability Flagged as Exploited Against Chrome

Tracked as CVE-2025-6558, the flaw was found in Chrome’s ANGLE and GPU components and was flagged as exploited by Google TAG. The post Apple Patches Safari Vulnerability Flagged as Exploited Against Chrome appeared first on SecurityWeek.

---

Hackers Exploit SAP Vulnerability to Breach Linux Systems and Deploy Auto-Color Malware

Threat actors have been observed exploiting a now-patched critical SAP NetWeaver flaw to deliver the Auto-Color backdoor in an attack targeting a U.S.-based chemicals company in April 2025. "Over the course of three days, a threat actor gained access to the customer's network, attempted to download several suspicious files and communicated with malicious infrastructure linked to Auto-Color

---

Axonius Acquires Medical Device Security Firm Cynerio in $100 Million Deal

Axonius has acquired Cynerio for $100 million in cash and stock to accelerate its expansion into the healthcare market. The post Axonius Acquires Medical Device Security Firm Cynerio in $100 Million Deal appeared first on SecurityWeek.

---

Scattered Spider Hacker Arrests Halt Attacks, But Copycat Threats Sustain Security Pressure

Google Cloud's Mandiant Consulting has revealed that it has witnessed a drop in activity from the notorious Scattered Spider group, but emphasized the need for organizations to take advantage of the lull to shore up their defenses. "Since the recent arrests tied to the alleged Scattered Spider (UNC3944) members in the U.K., Mandiant Consulting hasn't observed any new intrusions directly

---

Tea App Takes Messaging System Offline After Second Security Issue Reported

Tea has said about 72,000 images were leaked online in the initial incident, and another 59,000 images publicly viewable in the app from posts, comments and direct messages were also accessed. The post Tea App Takes Messaging System Offline After Second Security Issue Reported appeared first on SecurityWeek.

---

Lenovo Firmware Vulnerabilities Allow Persistent Implant Deployment

Vulnerabilities discovered by Binarly in Lenovo devices allow privilege escalation, code execution, and security bypass. The post Lenovo Firmware Vulnerabilities Allow Persistent Implant Deployment appeared first on SecurityWeek.

---

Wiz Uncovers Critical Access Bypass Flaw in AI-Powered Vibe Coding Platform Base44

Cybersecurity researchers have disclosed a now-patched critical security flaw in a popular vibe coding platform called Base44 that could allow unauthorized access to private applications built by its users. "The vulnerability we discovered was remarkably simple to exploit -- by providing only a non-secret app_id value to undocumented registration and email verification endpoints, an attacker

---

PyPI Warns of Ongoing Phishing Campaign Using Fake Verification Emails and Lookalike Domain

The maintainers of the Python Package Index (PyPI) repository have issued a warning about an ongoing phishing attack that's targeting users in an attempt to redirect them to fake PyPI sites. The attack involves sending email messages bearing the subject line "[PyPI] Email verification" that are sent from the email address noreply@pypj[.]org (note that the domain is not "pypi[.]org"). "This is

---

Seal Security Raises $13 Million to Secure Software Supply Chain

The open source security firm will use the investment to enhance go-to-market efforts and accelerate platform expansion. The post Seal Security Raises $13 Million to Secure Software Supply Chain appeared first on SecurityWeek.

---

Chaos RaaS Emerges After BlackSuit Takedown, Demanding $300K from U.S. Victims

A newly emerged ransomware-as-a-service (RaaS) gang called Chaos is likely made up of former members of the BlackSuit crew, as the latter's dark web infrastructure has been the subject of a law enforcement seizure. Chaos, which sprang forth in February 2025, is the latest entrant in the ransomware landscape to conduct big-game hunting and double extortion attacks. "Chaos RaaS actors initiated

---

Promptfoo Raises $18.4 Million for AI Security Platform

Promptfoo has raised $18.4 million in Series A funding to help organizations secure LLMs and generative AI applications. The post Promptfoo Raises $18.4 Million for AI Security Platform appeared first on SecurityWeek.

---

Order out of Chaos – Using Chaos Theory Encryption to Protect OT and IoT

The need for secure encryption in IoT and IIoT devices is obvious, and potentially critical for OT and, by extension, much of the critical infrastructure.  The post Order out of Chaos – Using Chaos Theory Encryption to Protect OT and IoT appeared first on SecurityWeek.

---

Ransomware Statistics: Updates on Ransoms, Attacks and Active Groups

Data reveals global ransomware trends for the first half of 2025.