automotive cybersecurity
-
CISA adds critical ASUS Live Update flaw to known exploited vulnerabilities catalog
CISA added a critical ASUS Live Update vulnerability, CVE-2025-59374 (CVSS 9.3), to its Known Exploited Vulnerabilities catalog citing active exploitation; the flaw stems from a past supply chain compromise and vendors say affected builds were limited to devices meeting specific targeting conditions.
-
Leroy Merlin notifies French customers after data breach
Leroy Merlin has notified customers in France that personal data including names, contact details, postal addresses, dates of birth and loyalty information were exposed in a cyberattack; the company said banking data and passwords were not affected and that it has taken steps to contain the incident.
-
Researchers find thousands of credentials in JSONFormatter and CodeBeautify archives
Researchers at watchTowr Labs said they recovered over 80,000 files saved to JSONFormatter and CodeBeautify that contained thousands of credentials and sensitive records spanning government, finance, telecoms and other sectors; both sites have temporarily disabled the save feature.
-
SEC asks court to dismiss lawsuit against SolarWinds and its CISO
The SEC moved to voluntarily dismiss its enforcement action against SolarWinds and CISO Timothy G. Brown on Nov. 20, 2025. The agency had accused the company of overstating cybersecurity practices and failing to disclose risks related to the 2020 supply‑chain compromise, but many allegations were previously dismissed by a federal court.
-
Princeton University discloses November 10 database breach affecting alumni and donors
Princeton University said a database was compromised on November 10 after a phishing attack on an employee, exposing names, contact details and biographical information of alumni, donors, students and staff; the university said the database did not generally contain Social Security numbers, passwords or financial information and has blocked the attackers’ access.
-
UK introduces Cyber Security and Resilience Bill to bolster critical infrastructure defenses
The UK government has introduced the Cyber Security and Resilience Bill to tighten protections for hospitals, energy, water and transport systems, build on the NIS Regulations, require managed service providers to meet security standards and report major incidents quickly, and impose turnover-based penalties for serious breaches.
-
Hezi Rash hacktivist group tied to hundreds of DDoS attacks, Check Point reports
Hezi Rash, a Kurdish nationalist hacktivist group founded in 2023, has been linked by Check Point to about 350 DDoS attacks between August and October 2025 targeting sites in Japan, Turkey, Israel, Iran, Iraq and Germany; analysts say the campaigns are ideologically driven and focus on disruption.
-
Ribbon Communications says nation-state hackers breached its network; initial access traced to December 2024
Ribbon Communications disclosed a nation-state-associated breach of its IT network, detected in September 2025 with preliminary evidence of initial access in December 2024. The company is working with outside cybersecurity experts and federal law enforcement, has found customer files on two laptops outside its main network, and said it has not found evidence of theft…
-
Canada warns of hacktivist breaches at water, energy and farm facilities
The Canadian Centre for Cyber Security warned that hacktivists have repeatedly breached internet-exposed industrial control systems at water, oil and agricultural sites, altering control settings and prompting guidance to remove direct internet exposure, use multifactor VPNs, and report incidents through the Cyber Centre.
-
Dentsu says Merkle subsidiary suffered data breach exposing staff and client information
Dentsu disclosed that U.S. subsidiary Merkle suffered a cybersecurity incident that exposed staff and client data, systems were taken offline, data were stolen and impacted individuals are being notified while an investigation continues.
