Venice.ai provides a decentralized and censorship-free AI chatbot with capabilities on par with leading LLMs. It’s the first easily accessible “clear web” chatbot that will readily provide the user with malware, custom phishing messages and instructions for criminal activities upon request.
Intelligence from Google’s threat team and subsidiary Mandiant indicates that the “Scattered Spider” group can be attributed as the attackers of major UK retailers in recent weeks, and that the hackers are likely to turn their attention to cyber attacks on US targets in the coming weeks.
The crypto exchange projects a loss of $180 million to $400 million from the data breach after overseas customer service reps were bribed by unknown parties, who provided the attackers with sensitive personal information then put to use in targeted money transfer schemes.
With the CVE program famously facing funding difficulties, the EU has chosen an opportune time to roll out its new European Vulnerability Database. But, at least for the near term, the database looks to be leaning on the CVE database and other sources and acting as a complement rather than a potential replacement.
LockBit ransomware has certainly not gone away as a threat; the data breach shows that the group communicated with victims over 4,000 times just between December 2024 and April 2025, and that it still has around 75 affiliates.
An alternative version of the Signal messaging app that was thought to be safe enough for high-level U.S. government officials has suspended service indefinitely after a security breach, and the incident has raised serious questions about how confidential and classified communications are being handled.
Marks & Spencer and Co-op had reported that their IT help desks were convinced by a caller to reset an employee password. DragonForce has claimed credit for the attacks, all of which impacted major UK retailers, including Harrods.
A desire to replace the password as the world’s default authentication method has been circulating in the tech world for some time, but there have been almost no moves to force the issue to date. That has changed with Microsoft’s new passwordless policy for new accounts, though it is still far from the “death of the password.”
Organizations also increasingly can’t avoid SaaS models, and sometimes are even stuck with those that do not have a satisfactory security track record. That substantially increases the broader risk of some sort of major catastrophe that could harm an entire national economy stemming from just one third-party security breach.
All of the big LLMs are vulnerable to a new type of prompt injection attack that targets their safety policies, according to security firm HiddenLayer. The attack essentially fully jailbreaks the AI models, exposing the system prompt as well as enabling all different types of dangerous requests.