GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user’s package without having to steal their credentials.

“Your configuration becomes validated and exempt from expiry after its first successful publish,” the Microsoft-owned subsidiary

 Hundreds of French supermarkets faced a sophisticated hack where industrial controls were manipulated.

Risks are growing at a time when companies are relying more than ever on vendors for cybersecurity, according to a new report.

The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying ​Grindr users’ sensitive data to advertisers.

The administrative penalty is the largest issued by the data protection watchdog, arguing the case merited a high fine because of the “very serious” nature of the breach. The infringements

The dangerous part of a stolen identity isn’t always the initial login. It’s what an attacker can do with that access next.

With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalation, attackers can move through systems faster than security teams can investigate. A compromised account that looks legitimate at first could become the starting point for a much

Three vulnerabilities in LG’s webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner.

LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12.

The chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware