The Bite from Inside: The Sophos Active Adversary Report
A sea change in available data fuels fresh insights from the first half of 2024
Similar Posts
Sex toy maker Lovense caught leaking users’ email addresses and exposing accounts to takeovers
Bys sZack Whittaker reports: A security researcher says sex toy maker Lovense has failed to fully fix two security flaws that expose the private email addresses of its users and allow the takeover of any user’s account. The researcher, who goes by the handle BobDaHacker, published details of the bugs on Monday after Lovense claimed it would need…
Cybercrime Groups ShinyHunters, Scattered Spider Join Forces in Extortion Attacks on Businesses
Bys sAn ongoing data extortion campaign targeting Salesforce customers may soon turn its attention to financial services and technology service providers, as ShinyHunters and Scattered Spider appear to be working hand in hand, new findings show. “This latest wave of ShinyHunters-attributed attacks reveals a dramatic shift in tactics, moving beyond the group’s previous credential theft and…
How LiteLLM Turned Developer Machines Into Credential Vaults for Attackers
Bys sThe most active piece of enterprise infrastructure in the company is the developer workstation. That laptop is where credentials are created, tested, cached, copied, and reused across services, bots, build tools, and now local AI agents. In March 2026, the TeamPCP threat actor proved just how valuable developer machines are. Their supply chain attack on
Accounting of Disclosures Under the HITECH Act
Bys sA notice of proposed rulemaking from the HHS Office for Civil Rights that would modify the HIPAA Privacy Rule standard for accounting of disclosures of protected health information and add new requirements for access reports.
SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data
Bys sSAP has rolled out updates to address multiple vulnerabilities as part of its July 2026 security updates, including a critical flaw in SAP NetWeaver Application Server ABAP. The vulnerability in question is CVE-2026-44747 (CVSS score: 9.9), an out-of-bounds write flaw that allows an authenticated attacker to leverage logical errors in memory management to cause a…
Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances
Bys sAI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22. The cause was the SDKs’ default client, which set no spending limit until releases on August 18 added one. The risk was limited…