Researchers have identified a significant security risk involving artificial intelligence, specifically large language models (LLMs). Attackers can embed backdoors within these models, making them hard to detect. These backdoors lie dormant until triggered by a specific phrase, at which point the model executes harmful actions. This poses a serious threat to users and organizations relying on AI for various applications, as it could lead to data breaches or misinformation. The findings highlight the need for improved security measures in AI development to prevent such vulnerabilities from being exploited.
Anthropic, an AI company, has reported that its latest Claude model has identified over 500 vulnerabilities in various software systems. These vulnerabilities were carefully validated by human researchers to ensure that no false positives slipped through. This kind of thorough analysis is crucial because it helps organizations pinpoint and address security weaknesses before they can be exploited. The findings emphasize the ongoing need for vigilance in software security, as even established systems can harbor significant vulnerabilities. Companies using affected software should take immediate steps to assess their systems and apply necessary updates or patches to mitigate potential risks.
The Cybersecurity and Infrastructure Security Agency (CISA) has mandated that all federal agencies upgrade their outdated edge devices within the next year. This initiative is in response to concerns over the security weaknesses posed by aging network infrastructure, which could leave federal systems vulnerable to cyberattacks. Experts have long warned that outdated technology can create entry points for attackers, potentially compromising sensitive government data. By enforcing this requirement, CISA aims to bolster the overall security posture of federal networks and reduce risks associated with legacy systems. The move reflects a growing recognition of the need for modern, secure technology in government operations.
Lockdown Mode is a security feature for iPhones designed to protect users from cyber attacks and prevent forensic tools from accessing data after a device is seized by authorities. This mode is particularly useful for individuals who may be at risk of targeted attacks, such as journalists, activists, or those in sensitive positions. By activating Lockdown Mode, users enhance their privacy and security, making it significantly harder for anyone to extract information from their devices. The feature gained attention after reportedly thwarting attempts by law enforcement, including the FBI, to access iPhones during investigations. This highlights the ongoing battle between personal privacy and law enforcement access to digital data, raising important questions about the balance between security and individual rights.
The DKnife toolkit has been in use since 2019, allowing attackers to hijack traffic from edge devices to spy on users and deliver malware. This toolkit targets routers and other network devices, making it a significant threat to both individuals and organizations that rely on these systems for internet connectivity. By intercepting data, attackers can monitor communications and potentially steal sensitive information. The ongoing use of DKnife illustrates the persistent risks posed by advanced cyber espionage techniques. Users and companies need to be vigilant about securing their network devices to prevent such intrusions.
The Cybersecurity & Infrastructure Security Agency (CISA) has issued a warning regarding a serious vulnerability, identified as CVE-2026-24423, in SmarterMail. This flaw allows for unauthenticated remote code execution (RCE), which means attackers could potentially take control of affected systems without needing any prior authentication. This vulnerability has already been leveraged in ransomware attacks, posing significant risks to users and organizations running SmarterMail. Users are urged to take immediate action to secure their systems, as the flaw could lead to severe data breaches and operational disruptions. The urgency of this warning stems from the active exploitation of the flaw in the wild, highlighting the need for prompt remediation.
A new global campaign is taking advantage of older home routers that are no longer receiving security updates. Attackers are exploiting these outdated devices to hijack domain name system (DNS) settings, which can lead to users being redirected to malicious websites without their knowledge. This affects anyone still using these vulnerable routers, which are particularly common in homes and small businesses. The lack of security updates makes these devices easy targets for cybercriminals, raising significant concerns about the safety of personal data and online activities. Users are urged to check their router's firmware and consider upgrading to newer models that receive regular updates.
In 2025, Proton's Data Breach Observatory reported a staggering 794 major data breaches that collectively exposed over 306 million records. These incidents primarily targeted small businesses, highlighting a significant vulnerability within this sector. The breaches varied in nature, but they all led to sensitive information being compromised, which can have dire consequences for both the businesses involved and their customers. The data exposed in these breaches could include personal information, financial details, and other confidential records, raising concerns about identity theft and fraud. This situation underscores the urgent need for small businesses to bolster their cybersecurity measures to protect against such attacks.
Conpet, a company involved in oil and gasoline transport, fell victim to a cyberattack that compromised its corporate IT infrastructure. The Qilin ransomware group has claimed responsibility for the attack. Despite the breach, Conpet reported that its main operations remained unaffected, meaning their transport services continued without interruption. This incident raises concerns about the security of critical infrastructure sectors, as ransomware attacks can lead to significant operational disruptions and data loss. Companies in similar industries should evaluate their cybersecurity measures to protect against such threats.
Substack has confirmed that it experienced a data breach, although the company did not disclose how many users were affected. While the details surrounding the breach remain limited, Substack mentioned that only a small amount of user data was compromised. This incident raises concerns about the security of users' personal information on the platform, especially given the growing number of breaches affecting online services. Users of Substack should remain vigilant, as data breaches can lead to phishing attempts and other security risks. The lack of specific details about the breach leaves many questions unanswered, particularly regarding what types of data were compromised and how the breach occurred.
Security researchers have identified several significant vulnerabilities within the OpenClaw AI assistant that complicate its safe use. Users reported that malicious 'skills' could be installed, potentially leading to unauthorized access or misuse of the assistant's capabilities. Additionally, the configuration settings for the application are described as finicky, making it difficult for users to ensure secure setups. These issues raise concerns for both individual users and organizations considering using OpenClaw, as they could expose sensitive data and create security risks. Proper attention to these vulnerabilities is crucial to protect users and maintain trust in AI technologies.
In November 2025, a massive DDoS attack reached a peak of 31.4 terabits per second, making it one of the largest ever recorded. The attack was executed by the AISURU/Kimwolf botnet and lasted for just 35 seconds. Fortunately, Cloudflare's security systems were able to automatically detect and block the attack before it could cause significant disruption. This incident is part of a worrying trend of increasingly powerful and brief DDoS attacks that can overwhelm even the most robust defenses. Organizations must remain vigilant as such attacks not only threaten individual services but also have the potential to disrupt broader internet infrastructure.
Hackread – Cybersecurity News, Data Breaches, AI and More
Flickr has informed its users about a data breach linked to a security flaw in a third-party email vendor. This issue may have led to the exposure of user information, including usernames, email addresses, IP addresses, and activity logs. Although Flickr did not specify how many users were affected, the incident raises concerns about the security of personal data held by external partners. Users should be vigilant about potential phishing attempts or unauthorized access to their accounts, as this type of leaked information can often be exploited for malicious purposes. The situation serves as a reminder for companies to carefully vet their third-party vendors to protect user data.
German security officials are alerting the public about a series of phishing attempts targeting high-profile individuals, including military officials, diplomats, and investigative journalists, primarily using the messaging app Signal. Authorities believe these attacks are likely orchestrated by a state-backed hacking group, although they acknowledge that non-state actors could exploit similar tactics. The attackers are reaching out directly to their targets within the app, which raises concerns about the security of private communications among key figures. This situation is significant as it not only threatens the privacy of those affected but also poses risks to national security and the integrity of journalistic work. The potential for similar attacks by financially motivated cybercriminals adds another layer of urgency to the warnings.
On December 29, 2025, Poland's critical infrastructure faced a series of cyberattacks aimed at energy and industrial sectors, including wind and solar farms, a manufacturing company, and a combined heat and power plant. The attacks were executed by a single threat actor, as confirmed by Poland's national computer emergency response team, CERT Polska. Fortunately, these incidents were purely destructive and did not disrupt energy generation or distribution. The attackers gained access through exposed VPN connections, raising concerns about the security practices in place across the nation’s energy sector. This incident serves as a reminder of the vulnerabilities that can exist in critical infrastructure systems, emphasizing the need for improved cybersecurity measures.