Privacy
-
Meta says Instagram support flaw led to 20,000 account takeovers
Meta said a flaw in its AI-assisted Instagram recovery system led to the takeover of more than 20,000 accounts. The disclosure says attackers used password reset links to bypass protection on accounts without two-factor authentication.
-
WFP says breach exposed data of about 600,000 Gaza households
The World Food Programme said a breach of its Gaza self-registration system exposed personal details of about 600,000 households. The agency suspended the platform, but said aid delivery and existing registrations would continue.
-
DentaQuest says breach affected part of network, leak tied to 2.6 million accounts
DentaQuest said a security incident exposed data tied to 2.6 million accounts after a breach linked to ShinyHunters. The leaked records included names, contact details, government IDs and health insurance information.
-
iFood confirms data breach affecting 1.2 million users in Brazil
iFood said a December data breach exposed the personal details of 1.2 million users in Brazil, including CPF numbers, but not passwords or payment data. The company and hackers dispute the scale of the incident.
-
Google patches Gemini flaw that could let poisoned notifications trigger Android actions
Google patched a Gemini on Android flaw that let a poisoned notification influence the assistant, potentially triggering actions from fake messages to smart home controls. SafeBreach said the bug was fixed server-side and no in-the-wild abuse was found.
-
ChatGPhish flaw can turn ChatGPT summaries into phishing lures
Researchers disclosed ChatGPhish, a ChatGPT flaw that can render malicious links, images and QR codes inside summaries of web pages. The technique may leak browser details and create a new phishing surface during normal browsing.
-
Google Chrome rolls out cookie theft protection for all users
Google said Chrome’s Device Bound Session Credentials feature is now generally available and rolling out to all users. The change is designed to bind session cookies to a device and make stolen cookies harder to reuse for account takeovers.
-
Fake LinkedIn emails abuse Adobe service in phishing campaign
A phishing campaign is using fake LinkedIn business emails and Adobe Target to hide credential theft, with attackers disguising HTML attachments as PDFs and redirecting victims to a real LinkedIn page after login.
-
Apple releases quantum-resistant cryptographic code and verification tools
Apple has released quantum-resistant cryptographic code and verification tools for its corecrypto library, including ML-KEM and ML-DSA. The company said the work found a bug that could have broken digital signatures.
-
Europol says it took down First VPN in cybercrime crackdown
European authorities shut down First VPN, a service used by cybercriminals to hide activity, and arrested the alleged administrator in Ukraine, Europol said. Officials also seized servers and domains and identified thousands of users linked to crime.
