Category: Cyber Security News

The Justice Department charged Kwamaine Jerell Ford with hacking Apple accounts belonging to NFL and NBA players, using stolen card details for thousands of dollars in purchases and allegedly coercing a woman into sex trafficking. Prosecutors say he posed as an adult film actress (“T.T.”) to phish credentials and obtain videos…

Surf AI announced its launch alongside $57 million in funding to help enterprises operationalize their security programs. The New York startup’s agentic platform builds a context graph from identity, security, cloud, data, HR, and IT signals to prioritize risks, coordinate AI-driven remediation with human oversight, and preserve context across workflows. #SurfAI…

A critical flaw in Companies House’s WebFiling service allowed any authenticated user to access or log into other companies’ accounts, potentially exposing non-public director details and enabling unauthorized filings. The bug, introduced in October 2025 and patched after the service was taken offline, could be exploited with a simple “file for…

The Linux Foundation announced $12.5 million in grants from Anthropic, Amazon Web Services, GitHub, Google, Google DeepMind, Microsoft, and OpenAI to advance open source security through its Alpha-Omega and OpenSSF initiatives. The funding aims to develop long-term, AI-aligned security tools and sustainable strategies to help maintainers triage rising volumes of vulnerability…

New York has issued new cybersecurity regulations and launched a $2.5 million SECURE grant program to help protect drinking water and wastewater systems as they increasingly rely on digital controls. The initiative pairs mandatory standards, training, incident reporting, technical assistance, and targeted funding to boost resilience and safeguard public health. #GovernorHochul…

Microsoft and Samsung identified the Samsung Galaxy Connect app as causing C: drive access problems and app failures on some Windows 11 devices. They removed the app from the Microsoft Store, released an updated version, and published a 29-step recovery procedure to restore Windows drive permissions. #GalaxyConnect #Windows11

Microsoft has paused the automatic installation of the Microsoft 365 Copilot app on Windows devices outside the EEA, while existing installations remain unaffected. Admins can still deploy or opt out of the app via the Microsoft 365 Apps admin center as Microsoft evaluates the rollout. #Microsoft365Copilot #Windows11

Researchers at LayerX demonstrated a font-rendering attack that hides malicious commands in webpage HTML using custom fonts and CSS so AI assistants analyzing the DOM see only benign text while users see dangerous instructions. The proof-of-concept fooled multiple popular assistants and prompted recommendations to compare rendered pages with the DOM and treat fonts/CSS as an attack surface. #LayerX #ChatGPT

Agentic AI creates autonomous software that plans, decides, and acts across systems at machine speed, unlocking business value while introducing new, fast-moving security risks. Securing these agents requires treating them as first-class identities with identity-based access control, continuous visibility, intent-aware permissions, and full lifecycle governance to prevent shadow AI and privilege creep. #AgenticAI #TokenSecurity

LeakNet operators are using the ClickFix social‑engineering technique to gain initial access and deploy a Deno-based loader that executes JavaScript/TypeScript payloads directly in memory. By running the legitimate, signed Deno runtime via VBS/PowerShell stagers, the attackers minimize disk artifacts and follow with DLL sideloading, PsExec lateral movement, C2 beaconing, and Amazon S3–based exfiltration. #LeakNet #Deno #ClickFix #ReliaQuest #AmazonS3

A federal grand jury has indicted Kwamaine Jerell Ford for allegedly running a phishing scam from prison that targeted NBA and NFL athletes by impersonating an adult film star and Apple customer support to steal Apple account credentials and financial information. Prosecutors say the scheme expanded into coercion and sex trafficking,…

CISA added a medium-severity information disclosure vulnerability in Wing FTP (CVE-2025-47813) to its Known Exploited Vulnerabilities catalog after evidence of active exploitation; the bug can leak the application’s installation path via an overlong UID session cookie. The vendor fixed the issue in Wing FTP 7.4.4 (also addressing the critical RCE CVE-2025-47812),…

Today’s security validation is fragmented across BAS tools, pentests, and scanners that each show only a slice of risk while attackers chain identity flaws, cloud misconfigurations, detection gaps, and unpatched vulnerabilities into unified operations. The article calls for Agentic Exposure Validation—autonomous, context-aware validation built on a Security Data Fabric of Asset…