News Gist .News

A default password shipped in a widely used door access control system allows anyone to easily and remotely access door locks and elevator controls in dozens of buildings across the U.S. and Canada, a security researcher found. The vulnerability is rated as a 10 out of 10 on the vulnerability severity scale due to its ease of exploitation. Hirsch, the company that owns the Enterphone MESH system, has refused to fix the bug, citing its design and customers' failure to change the default password.

Amnesty International said that Google fixed previously unknown flaws in Android that allowed authorities to unlock phones using forensic tools. On Friday, Amnesty International published a report detailing a chain of three zero-day vulnerabilities developed by phone-unlocking company Cellebrite, which its researchers found after investigating the hack of a student protester’s phone in Serbia. The flaws were found in the core Linux USB kernel, meaning “the vulnerability is not limited to a particular device or vendor and could impact over a billion Android devices,” according to the report.

1Password has introduced a feature allowing users to add location data to individual login items, enabling the password manager to automatically display relevant passwords based on their current location. This update addresses the challenge of managing numerous unique passwords for various accounts, making it easier to access the correct login credentials when needed. Users can now leverage their mobile phone's location data to automatically show logins tied to a specific geographic area.

Zapier, a popular automation tool, has suffered a cyberattack that resulted in the loss of sensitive customer information. The company's Head of Security sent a breach notification letter to affected customers, stating that an unnamed threat actor accessed some customer data "inadvertently copied to the repositories" for debugging purposes. Zapier assures that the incident was isolated and did not affect any databases, infrastructure, or production systems.

The modern-day cyber threat landscape has become increasingly crowded, with Advanced Persistent Threats (APTs) becoming a major concern for cybersecurity teams worldwide. Group-IB's recent research points to 2024 as a 'year of cybercriminal escalation', with a 10% rise in ransomware compared to the previous year, and a 22% rise in phishing attacks. The "Game-changing" role of AI is being used by both security teams and cybercriminals, but its maturity level is still not there yet.

Microsoft has confirmed that its Windows drivers and software are being exploited by hackers through zero-day attacks, allowing them to escalate privileges and potentially drop ransomware on affected machines. The company patched five flaws in a kernel-level driver for Paragon Partition Manager, which were apparently found in BioNTdrv.sys, a piece of software used by the partition manager. Users are urged to apply updates as soon as possible to secure their systems.

Apple's appeal to the Investigatory Powers Tribunal may set a significant precedent regarding the limits of government overreach into technology companies' operations. The company argues that the UK government's power to issue Technical Capability Notices would compromise user data security and undermine global cooperation against cyber threats. Apple's move is likely to be closely watched by other tech firms facing similar demands for backdoors.

Commonwealth Bank is introducing a new layer of security to its internet banking, requiring millions of customers to approve each login attempt via the app. The bank claims this will make it harder for fraudsters to access customer accounts. However, critics argue that the added complexity may push some users away from mobile banking altogether.

In 2003, Skype pioneered end-to-end encryption in the internet phone-calling app space, offering users unprecedented privacy. The company's early emphasis on secure communication helped to fuel global adoption and sparked anger among law enforcement agencies worldwide. Today, the legacy of Skype's encryption can be seen in the widespread use of similar technologies by popular messaging apps like iMessage, Signal, and WhatsApp.

Truffle Security found thousands of pieces of private info in Common Crawl dataset.Common Crawl is a nonprofit organization that provides a freely accessible archive of web data, collected through large-scale web crawling. The researchers notified the vendors and helped fix the problemCybersecurity researchers have uncovered thousands of login credentials and other secrets in the Common Crawl dataset, compromising the security of various popular services like AWS, MailChimp, and WalkScore.

Broadcom has released patches for three critical vulnerabilities in its VMware products, which are already being exploited in the wild. The bugs were described as VM escape flaws and affect all supported versions of VMware ESX, vSphere, Cloud Foundation, and Telco Cloud Platform. These issues were deemed severe enough to warrant immediate attention from users, who are urged to apply the fixes as soon as possible.

Vishing attacks have skyrocketed, with CrowdStrike tracking at least six campaigns in which attackers pretended to be IT staffers to trick employees into sharing sensitive information. The security firm's 2025 Global Threat Report revealed a 442% increase in vishing attacks during the second half of 2024 compared to the first half. These attacks often use social engineering tactics, such as help desk social engineering and callback phishing, to gain remote access to computer systems.

High-tech Eight Sleep pods allow Elon Musk and DOGE staff to rest at work, but security flaws have been discovered, including an AWS key and remote access. Hackers could exploit the beds to infiltrate home networks and connected devices, raising concerns about personal privacy and entire home network security. The company's lack of oversight has allowed unauthorized access, potentially leading to financial losses and compromised data.

The UK government's reported demand for Apple to create a "backdoor" into iCloud data to access encrypted information has sent shockwaves through the tech industry, highlighting the growing tension between national security concerns and individual data protections. The British government's ability to force major companies like Apple to install backdoors in their services raises questions about the limits of government overreach and the erosion of online privacy. As other governments take notice, the future of end-to-end encryption and personal data security hangs precariously in the balance.

A team of Google researchers has identified a significant exploit, named "EntrySign," affecting AMD's Zen 1 through Zen 4 processors, which allows users with local admin privileges to push custom microcode updates. This vulnerability, while requiring high-level access to exploit, poses serious implications for security, as it enables users to manipulate CPU behavior and potentially weaken system protections. AMD has issued a BIOS patch to address the issue, but many CPUs remain vulnerable until updated, highlighting the ongoing challenges of CPU security management.

Modern web browsers offer several built-in settings that can significantly enhance data security and privacy while online. Key adjustments, such as enabling two-factor authentication, disabling the saving of sensitive data, and using encrypted DNS requests, can help users safeguard their personal information from potential threats. Additionally, leveraging the Tor network with specific configurations can further anonymize web browsing, although it may come with performance trade-offs.

Zapier has disclosed a security incident where an unauthorized user gained access to its code repositories due to a 2FA misconfiguration, potentially exposing customer data. The breach resulted from an "unauthorized user" accessing certain "certain Zapier code repositories" and may have accessed customer information that had been "inadvertently copied" to the repositories for debugging purposes. The incident has raised concerns about the security of cloud-based platforms.

Amnesty International has uncovered evidence that a zero-day exploit sold by Cellebrite was used to compromise the phone of a Serbian student who had been critical of the government, highlighting a campaign of surveillance and repression. The organization's report sheds light on the pervasive use of spyware by authorities in Serbia, which has sparked international condemnation. The incident demonstrates how governments are exploiting vulnerabilities in devices to silence critics and undermine human rights.

In the realm of cybersecurity, the emphasis on strong passwords often overshadows the critical importance of protecting one's email address, which serves as a digital identity. Data breaches and the activities of data brokers expose email addresses to threats, making them gateways to personal information and potential scams. Utilizing email aliases can offer a practical solution to mitigate these risks, allowing individuals to maintain privacy while engaging online.

The NHS is investigating claims that a software flaw at Medefer compromised patient data security, as the issue was discovered in November but may have existed for several years. Medefer has stated that no patient data breach occurred and that the flaw was promptly addressed, although cybersecurity experts have raised concerns about the company's response to the vulnerability. The situation underscores the critical importance of robust cybersecurity measures in handling sensitive medical information, especially within the healthcare sector.

A "hidden feature" was found in a Chinese-made Bluetooth chip that allows malicious actors to run arbitrary commands, unlock additional functionalities, and extract sensitive information from millions of Internet of Things (IoT) devices worldwide. The ESP32 chip's affordability and widespread use have made it a prime target for cyber threats, putting the personal data of billions of users at risk. Cybersecurity researchers Tarlogic discovered the vulnerability, which they claim could be used to obtain confidential information, spy on citizens and companies, and execute more sophisticated attacks.

Recently, news surfaced about stolen data containing billions of records, with 284 million unique email addresses affected. Infostealing software is behind a recent report about a massive data collection being sold on Telegram, with 23 billion entries containing 493 million unique pairs of email addresses and website domains. As summarized by Bleeping Computer, 284 million unique email addresses are affected overall.

A recently discovered trio of vulnerabilities in VMware's virtual machine products can grant hackers unprecedented access to sensitive environments, putting entire networks at risk. If exploited, these vulnerabilities could allow a threat actor to escape the confines of one compromised virtual machine and access multiple customers' isolated environments, effectively breaking all security boundaries. The severity of this attack is compounded by the fact that VMware warned it has evidence suggesting the vulnerabilities are already being actively exploited in the wild.

Recent mass layoffs at Elon Musk's Department of Government Efficiency have resulted in some U.S. government workers with top security clearances not receiving standard exit briefings, raising significant security concerns. Typically, these briefings remind employees of their non-disclosure agreements and provide guidance on handling potential foreign approaches, which is critical given their access to sensitive information. The absence of these debriefings creates vulnerabilities, particularly as foreign adversaries actively seek to exploit gaps in security protocols.

A recent study by Consumer Reports reveals that many widely used voice cloning tools do not implement adequate safeguards to prevent potential fraud and misuse. The analysis of products from six companies indicated that only two took meaningful steps to mitigate the risk of unauthorized voice cloning, with most relying on a simple user attestation for permissions. This lack of protective measures raises significant concerns about the potential for AI voice cloning technologies to facilitate impersonation scams if not properly regulated.

The "Locksmiths in the United States and Canada" report provides an in-depth analysis of the locksmith industry, highlighting operational structures, financial insights, and emerging trends. It serves as a valuable resource for industry professionals, equipping them with actionable information to navigate risks and capitalize on future opportunities. With features such as financial benchmarks and quarterly insights, the report aims to establish trust and expertise among its users.