News
-
Northern Ireland grants consent for UK cyber resilience reforms
Northern Ireland granted legislative consent on 19 October for relevant provisions of the UK Cyber Security and Resilience Bill. The proposed reforms would extend cyber regulation to more digital suppliers, but the vote introduces no immediate duties.
-
Google Cloud London outage disrupts UK banks as regulators seek answers
A power event in Google Cloud’s London region interrupted UK banking and public services on 20 October. The provider reported a nearly eight-hour incident, while MPs sought details of regulatory oversight of critical cloud suppliers.
-
ICO reprimands Welsh organisations after old test account enabled ransomware breach
The ICO reprimanded Ogi Networks and Data Cymru after a long-standing test account with the password “Password1” enabled a 2024 ransomware attack. Information concerning roughly 3,300 people, mainly children, was stolen.
-
Zeabur details credential failures and database access in October breach
Zeabur says attackers accessed its production database, stored environment variables and 101 Google Cloud dedicated servers. Its October investigation distinguishes confirmed access from uncertain database extraction and an unproven link to an earlier intrusion.
-
WhatsApp help pages exposed hidden AI instructions on privacy complaints
Hidden directions for WhatsApp’s AI support bot appeared in 80 help pages, including restrictions on referring users to privacy regulators. Meta says a bug exposed the text; researchers did not establish whether the chatbot followed it.
-
Compromised UpdraftCentral keys used to install WordPress backdoors
Attackers used valid UpdraftCentral management keys to install malicious plugins on two Nethemba websites and attempted a third. TeamUpdraft separately reported access to its customer site and possible exposure of remote management credentials.
-
Russian-linked espionage targets NATO defence and law enforcement networks
Broadcom researchers describe intrusions involving a naval shipbuilder, aircraft engine manufacturer, and law enforcement organisation in two NATO countries. The shipbuilder investigation documented stolen credentials, persistent access, and a loader whose final payload was not recovered.
-
Pegasus infection confirmed on Serbian university rector’s phone
Citizen Lab has confirmed Pegasus spyware on the iPhone of University of Belgrade rector Vladan Đokić. Former prosecutor Rade Bajić received Apple threat notifications, but investigators have not established that his device was infected.
-
OVHcloud CLI downloads replaced with credential-stealing binaries
OVHcloud has confirmed that attackers replaced downloadable binaries for five versions of its command-line utility. The French provider removed the affected files and issued version 0.16.0, while customers assess possible exposure of local credentials.
-
PHP warns of two critical flaws ahead of 21 October security release
PHP has warned of two critical vulnerabilities rated CVSS v4.0 9.2 and scheduled security fixes for 21 October at 14:00 UTC. The advance notice does not establish technical exploit conditions, affected builds or active exploitation.