The SK Telecom breach, which has already generated significant coverage on this site and other outlets, continues to make headlines. This time, it is because after announcing they were accepting full responsibility for the breach, they sued to overturn a $91 million monetary penalty imposed by regulators, and have now rejected a settlement proposal that…
Threat hunters have disclosed a new “widespread timing-based vulnerability class” that leverages a double-click sequence to facilitate clickjacking attacks and account takeovers in almost all major websites. The technique has been codenamed DoubleClickjacking by security researcher Paulos Yibelo. “Instead of relying on a single click, it takes advantage of a double-click sequence,” Yibelo said.
Tom Williams reports: An external software developer engaged by an Australian government agency accidentally made a collection of private documents available on the public internet earlier this year, according to the nation’s Privacy Commissioner, Carly Kind. The commissioner revealed the data breach on Tuesday and confirmed the incident was reported to the Office of the……
Ariana Baio A website dedicated to leaking personal information about Immigration and Customs Enforcement officers and Border Patrol agents was reportedly subject to a cyberattack that its founder believes may have originated in Russia. Dominick Skinner, a Netherlands-based immigration activist, told The Daily Beast that his website, ICE List, came under cyberattack Tuesday evening after the publication reported Skinner planned to release personal information, obtained through……
A vulnerability in Google’s OAuth implementation allows takeover of old employee accounts when domain ownership changes. The post Google OAuth Flaw Leads to Account Takeover When Domain Ownership Changes appeared first on SecurityWeek.
Matt Burgess and Lily Hay Newman report: The possibility that data could be inadvertently exposed in a misconfigured or otherwise unsecured database is a longtime privacy nightmare that has been difficult to fully address. But the new discovery of a massive trove of 184 million records—including Apple, Facebook, and Google logins and credentials for accounts connected to multiple governments—underscores the risks…
Jonathan Greig reports: Federal civilian agencies have until September 25 to patch a vulnerability in popular content management system Sitecore after incident responders said they disrupted a recent attack involving the bug. Sitecore published a bulletin on Wednesday about CVE-2025-53690, which affects several of the company’s products. A key issue with the bug is the use of……
