SECNEWS.co.uk https://validator.w3.org/feed/docs/rss2.html Ivanti Connect Secure zero-day exploited, root flaw still unpatched Firefox Enterprise turns the browser into a self-hosted SOC control Kimsuky poses as conference hosts to phish Ukraine war experts Data guardian tells minister trust must weigh on NHS Palantir deal One in five UK security leaders take time off to dodge Patch Tuesday Bloom says GitHub left npm bug bounty report unanswered for months Hobbs, Whistles and Phase Eight owner TFG London hit by cyber attack Anthropic warns small AI models could soon self-replicate on IoT kit VMware HyperArmor adds virtual patching and MFA to ESX hosts IMF names cyber attack one of three triggers for market turmoil Bytes buys Microsoft security specialist CyberOne for £19.4m Icon cancer patient documents for sale after supplier breach Frontier AI models passed every OT attack test in Booz Allen lab Yandex rewrites cloud terms as drone strikes hit its data centres Google pays $90,000 for unauthenticated RCE in developer docs site Singapore adds national protective DNS to new cyber strategy Xandr hit with record NOK 92m Norwegian fine over Grindr data UK to scale AI flaw hunting and plan for rogue AI agent incidents Gentlemen ransomware gang claims Deloitte, KFC and MoneyGram Critical Bricksforge WordPress flaw exploited to take over sites IonQ to buy zero trust firm Elisity in $1.3bn quantum security bet Ledger finds hardware implant in reseller-sold crypto wallet Danfoss fridge hack hits French supermarkets: lessons for UK retail Ahold Delhaize shuts systems after cyber incident hits Albert Heijn GitLab rushes fix for CVSS 10 pre-auth RCE in CI/CD regex engine PaperCut patch bypasses exposed second pre-auth RCE chain US lifts freeze on UK AI Security Institute access to new models iRhythm heart monitor breach reaches at least 360,000 patients Settra joins Qilin in exploiting GlobalProtect VPN bypass flaw ICO probes surge in robo calls as complaints hit five-year high Public AnyPwn exploit gives root on unpatched AnyDesk for Linux Japan confirms Qilin ransomware suspect extradited to Germany Silent Ransom Group leak exposes fake IT calls and office intruders Peers table 24-hour customer alerts and AI incident reporting Danish CPR breach traced to supplier using ‘123456’ passwords OpenAI bans Russian and Iranian ChatGPT influence operations Unpatched AhsayCBS flaws exploited to hijack MSP backup servers Windows Update certificate expiry will strand lagging devices in 2027 ‘Adception’ malvertising hides fake Claude installer behind Bing link Rein Security raises $25m as AI agent security market crowds AI-assisted bug bounty report exposes decade-old XRP minting flaw Ransomware-hit IDCF Cloud says only customer backups can restore data One prompt could hijack AgentCore agents across an AWS account Max-severity SonicWall SMA1000 flaw draws exploit attempts GhostAction returns: fake ‘security audit’ workflows hit GitHub repos Upgraded DarkSword iPhone exploit kit served via dead analytics tag Supreme Court weighs whether minor data breaches can be sued Anthropic opens fast lane for unreviewed AI bug reports to open source Ex-Cypfer ransomware negotiator arrested in ShinyHunters probe Anthropic cuts live web access from AI tests after Claude misbehaves