Cybersecurity

India’s largest crypto exchange CoinDCX has confirmed that one of its operational accounts was compromised in a recent security breach. @Techcrunch has more, including the millions hackers reportedly made off with.

https://flip.it/96pL.l

#Tech #Crypto #CyberSecurity #Hacked #CoinDCX

134

8

Microsoft Sharepoint server vulnerability puts an estimated 10,000 organizations at risk. (flipboard.social)

submitted 2 weeks ago by TechDesk@flipboard.social to c/cybersecurity@fedia.io

0 comments fedilink

Microsoft Sharepoint server vulnerability puts an estimated 10,000 organizations at risk.

@Engadget reports: "The software giant released an emergency patch but the flaw is being actively exploited."

https://flip.it/h6w1pi

#Microsoft #Cybersecurity #SharePoint #Tech #Hacking

135

34

"Not so long ago, you would be right to question why a seemingly innocuous-looking free “flashlight” or “calculator” app in the app store would try to request access to your contacts, photos, and even (tldr.nettime.org)

submitted 2 weeks ago by remixtures@tldr.nettime.org to c/cybersecurity@fedia.io

2 comments fedilink

"Not so long ago, you would be right to question why a seemingly innocuous-looking free “flashlight” or “calculator” app in the app store would try to request access to your contacts, photos, and even your real-time location data. These apps may not need that data to function, but they will request it if they think they can make a buck or two by monetizing your data.

These days, AI isn’t all that different.

Take Perplexity’s latest AI-powered web browser, Comet, as an example. Comet lets users find answers with its built-in AI search engine and automate routine tasks, like summarizing emails and calendar events.

In a recent hands-on with the browser, TechCrunch found that when Perplexity requests access to a user’s Google Calendar, the browser asks for a broad swath of permissions to the user’s Google Account, including the ability to manage drafts and send emails, download your contacts, view and edit events on all of your calendars, and even the ability to take a copy of your company’s entire employee directory.

Perplexity says much of this data is stored locally on your device, but you’re still granting the company rights to access and use your personal information, including to improve its AI models for everyone else.

Perplexity isn’t alone in asking for access to your data. There is a trend of AI apps that promise to save you time by transcribing your calls or work meetings, for example, but which require an AI assistant to access your real-time private conversations, your calendars, contacts, and more. Meta, too, has been testing the limits of what its AI apps can ask for access to, including tapping into the photos stored in a user’s camera roll that haven’t been uploaded yet."

https://techcrunch.com/2025/07/19/for-privacy-and-security-think-twice-before-granting-ai-access-to-your-personal-data

#CyberSecurity #AI #GenerativeAI #Chatbots #DataProtection #Perplexity

136

3

"Cybersecurity researchers have alerted to a supply chain attack that has targeted popular npm packages via a phishing campaign designed to steal the project maintainers' npm tokens. (tldr.nettime.org)

submitted 2 weeks ago by remixtures@tldr.nettime.org to c/cybersecurity@fedia.io

0 comments fedilink

"Cybersecurity researchers have alerted to a supply chain attack that has targeted popular npm packages via a phishing campaign designed to steal the project maintainers' npm tokens.

The captured tokens were then used to publish malicious versions of the packages directly to the registry without any source code commits or pull requests on their respective GitHub repositories.

The list of affected packages and their rogue versions, according to Socket, is listed below -

eslint-config-prettier (versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7)
eslint-plugin-prettier (versions 4.2.2 and 4.2.3)
synckit (version 0.11.9)
@pkgr/core (version 0.2.8)
napi-postinstall (version 0.3.1)

"The injected code attempted to execute a DLL on Windows machines, potentially allowing remote code execution," the software supply chain security firm said."

https://thehackernews.com/2025/07/malware-injected-into-6-npm-packages.html

#CyberSecurity #NPM #JavaScript #Node #GitHub #Windows #Malware

137

4

#CitrixBleed2 exploited weeks before PoCs as #Citrix denied attacks (mastodon.thenewoil.org)

submitted 2 weeks ago by thenewoil@mastodon.thenewoil.org to c/cybersecurity@fedia.io

0 comments fedilink

#CitrixBleed2 exploited weeks before PoCs as #Citrix denied attacks

https://www.bleepingcomputer.com/news/security/citrix-bleed-2-exploited-weeks-before-pocs-as-citrix-denied-attacks/

#cybersecurity

138

5