A cyberattack has reportedly compromised the hydraulic pump system responsible for protecting Venice's iconic Piazza San Marco from flooding. Hackers claim to have gained access to this critical system, raising concerns about the safety of the area, especially given Venice's vulnerability to rising water levels. While the extent of the damage and the attackers' motives remain unclear, this incident underscores the potential risks associated with municipal infrastructure becoming targets for cyber threats. Authorities are likely assessing the situation to ensure the flood protection measures can continue functioning effectively during high tide events. The implications of this breach could affect not only the local population but also tourism and the preservation of cultural heritage in Venice.
Latest Cybersecurity Threats
Real-time threat intelligence from trusted sources
OpenAI has announced that its Mac applications require an update due to a security incident linked to the Axios hack. The company reported that a developer tool inadvertently fetched a compromised version of a widely used open-source library. However, OpenAI reassured users that the integrity of its overall systems and software remained intact. This incident highlights the risks associated with third-party libraries and the importance of maintaining secure development practices. Users of OpenAI's Mac apps should ensure they update to the latest versions to mitigate any potential issues arising from this vulnerability.
A serious vulnerability, known as CVE-2026-39987, has been discovered in all versions of Marimo prior to 0.23.0, earning a high CVSS score of 9.3. This flaw allows attackers to potentially exploit systems running affected versions of the software, raising significant security concerns for users. Researchers noted that the vulnerability was actively exploited within hours of its disclosure, indicating a swift response from malicious actors. Users of Marimo are urged to update to version 0.23.0 or later to protect their systems from potential attacks. This incident emphasizes the critical need for timely software updates in response to newly identified vulnerabilities.
Rockstar Games has recently experienced a data breach due to a security incident involving Anodot, a data analytics company. The ShinyHunters extortion group has leaked sensitive analytics data stolen from Rockstar on their data leak site. This incident raises concerns for the gaming community as it not only affects Rockstar but also puts user data at risk. The leaked information could potentially be used for further targeted attacks or to exploit vulnerabilities in Rockstar's systems. It underscores the importance for companies to bolster their security measures in the face of such threats.
BleepingComputer
Booking.com has reported a data breach involving unauthorized access to its systems, which has compromised sensitive reservation and user data. The company is urging affected users to reset their reservation PINs as a precautionary measure. This incident raises significant concerns for travelers who use the booking platform, as the exposed data could potentially be used for fraudulent activities. Booking.com has not disclosed the exact number of users affected or the specific data that was accessed, but the breach underscores the ongoing risks associated with online booking systems. Users are advised to monitor their accounts for any suspicious activity and to take steps to secure their information.
Schneier on Security
Anthropic has introduced a new AI model called Claude Mythos Preview, which has raised concerns in the cybersecurity community due to its potential for cyberattack capabilities. To mitigate these risks, Anthropic is not releasing the model to the public and has initiated Project Glasswing. This project aims to test the model against a variety of software—both public and proprietary—to identify and fix vulnerabilities before they can be exploited by malicious actors. The focus on preemptively addressing weaknesses highlights the growing intersection of AI technology and cybersecurity. As AI models become more advanced, the potential for misuse increases, making it crucial for companies to stay ahead of potential threats.
Security researchers have identified a new Android banking trojan called Mirax, which is targeting users across Europe. This malware utilizes a method known as Malware-as-a-Service (MaaS) to infect devices, allowing cybercriminals to gain remote access and turn affected smartphones into residential proxy nodes. By doing this, attackers can route their malicious activities through the compromised devices, making it harder to trace their actions back to them. This poses a significant risk to users, as their personal data and banking information could be at risk. The emergence of Mirax highlights ongoing vulnerabilities in mobile security and the need for users to remain vigilant against such threats.
Booking.com has reported that hackers gained access to user information, although the company has not disclosed how many customers were affected. They have stated that the situation has been contained, but specifics about the type of data compromised remain unclear. This incident raises concerns for users who may have shared sensitive booking details on the platform. Protecting user data is crucial for maintaining trust in online services, especially in industries like travel where personal information is frequently exchanged. Booking.com will likely need to assess its security measures to prevent future breaches and reassure customers about their data safety.
A new infostealer called 'Storm' has emerged, capable of hijacking user sessions by decrypting data on the server side rather than locally. This technique allows attackers to bypass traditional security measures like passwords and multi-factor authentication (MFA). Researchers from Varonis have demonstrated how the infostealer sends sensitive browser data directly to the attackers' servers, raising significant concerns about user privacy and account security. The implications are serious, as organizations relying on standard security protocols may find themselves vulnerable to these sophisticated attacks. Companies should be vigilant and assess their security measures to protect against this evolving threat.
Recent allegations suggest that Microsoft is engaging in corporate espionage through its LinkedIn browser extension, raising concerns about user privacy. However, security researchers are analyzing these claims and have found mixed results regarding the extent of data collection by the extension. While some users are worried about their information being tracked or misused, the research indicates that the data collection practices may not be as invasive as initially claimed. This debate over LinkedIn's data handling practices is crucial as it could impact user trust and privacy standards across similar platforms. Understanding the reality behind these accusations is important for users who rely on LinkedIn for networking and job opportunities.
SCM feed for Latest
A recent report indicates that AI browser extensions are more likely to contain known security vulnerabilities compared to other types of extensions. The study found that these AI tools often request permissions related to cookies, scripting, and tabs, which can increase the risk of exploitation. Users of these extensions may unknowingly expose themselves to threats as these vulnerabilities can allow attackers to manipulate browser behavior or access sensitive data. This situation raises concerns for both individual users and organizations that rely on these AI tools for productivity. As the popularity of AI extensions grows, it becomes increasingly important for developers to prioritize security in their design and for users to remain vigilant about the permissions granted to these tools.
An international law enforcement operation has successfully frozen over $12 million linked to cryptocurrency scams and identified more than 20,000 victims. The crackdown revealed that suspected losses from cryptocurrency fraud worldwide exceed $45 million. One notable case involved a victim from the UK who lost more than £52,000. According to the FBI, cryptocurrency scams are a significant issue, with total losses reaching $11.3 billion. This incident underscores the ongoing risks associated with cryptocurrency investments, highlighting the need for increased awareness and caution among potential investors.
OpenAI has confirmed that it was affected by a supply chain hack linked to North Korean attackers, specifically involving a compromised macOS code signing certificate. This incident raises concerns about the security of software supply chains, as attackers can use such certificates to sign malicious software, making it appear legitimate. OpenAI is now taking steps to mitigate any potential risks associated with this breach. The impact of this incident could extend beyond OpenAI, affecting users who rely on their software for various applications. The situation underscores the need for enhanced security measures in software development and distribution to protect against similar future attacks.
The Hacker News
Last week, Anthropic took action to limit access to its Mythos Preview model after it autonomously discovered and exploited zero-day vulnerabilities across all major operating systems and web browsers. This incident raises alarms among cybersecurity experts, with Palo Alto Networks' Wendi Whitmore warning that similar capabilities could soon be available to malicious actors. According to CrowdStrike's 2026 Global Threat Report, the average time for eCrime to escalate into an attack is just 29 minutes, emphasizing the urgency for organizations to address vulnerabilities quickly. The implications of such advanced AI-driven exploits could make it significantly easier for attackers to compromise systems, putting countless users and organizations at risk. Companies need to be vigilant and enhance their security protocols to prevent potential breaches.
Help Net Security
Google is enhancing the security of its Pixel smartphones by focusing on the cellular baseband modem, which is responsible for mobile network communication. In the previous Pixel 9 model, the company implemented measures to mitigate memory-related vulnerabilities. With the upcoming Pixel 10, Google is taking further steps by incorporating a DNS parser built in the Rust programming language into the modem firmware. This change aims to bolster the device's defenses against potential exploitation of the modem, which can process external data. By addressing these vulnerabilities, Google is working to protect users from possible attacks that could compromise their devices through the modem interface.