Latest Cybersecurity News and Articles

---

Microsoft Adds Inline Data Protection to Edge for Business to Block GenAI Data Leaks

Microsoft on Monday announced a new feature called inline data protection for its enterprise-focused Edge for Business web browser. The native data security control is designed to prevent employees from sharing sensitive company-related data into consumer generative artificial intelligence (GenAI) apps like OpenAI ChatGPT, Google Gemini, and DeepSeek. The list will be expanded over time to

---

NIST Still Struggling to Clear Vulnerability Submissions Backlog in NVD

The effects of the backlog is already being felt in vulnerability management circles where NVD data promises an enriched source of truth. The post NIST Still Struggling to Clear Vulnerability Submissions Backlog in NVD appeared first on SecurityWeek.

---

Oracle Denies Cloud Breach After Hacker Offers to Sell Data 

Oracle has denied that Cloud systems have been breached after a hacker claimed to have stolen millions of records. The post Oracle Denies Cloud Breach After Hacker Offers to Sell Data  appeared first on SecurityWeek.

---

Russian Firm Offers $4 Million for Telegram Exploits

A Russian exploit acquisition firm is offering up to $4 million for a full-chain exploit targeting messaging service Telegram. The post Russian Firm Offers $4 Million for Telegram Exploits appeared first on SecurityWeek.

---

VanHelsing RaaS Launch: 3 Victims, $5K Entry Fee, Multi-OS, and Double Extortion Tactics

A ransomware-as-a-service (RaaS) operation called VanHelsing has already claimed three victims since it launched on March 7, 2025. "The RaaS model allows a wide range of participants, from experienced hackers to newcomers, to get involved with a $5,000 deposit. Affiliates keep 80% of the ransom payments, while the core operators earn 20%," Check Point said in a report published over the weekend

---

Webinar Tomorrow: Which Security Testing Approach is Right for You?

Understand whether BAS, Automated Penetration Testing, or the combined approach of Adversarial Exposure Validation (AEV) aligns best with your organization’s unique security needs. The post Webinar Tomorrow: Which Security Testing Approach is Right for You? appeared first on SecurityWeek.

---

Pennsylvania State Education Association announces data breach

The Pennsylvania State Education Association announced a data breach impacting the private personal information of 501,183 education professionals.

---

US Lifts Sanctions Against Crypto Mixer Tornado Cash

The US Department of the Treasury has removed sanctions against the fully decentralized cryptocurrency mixer service Tornado Cash. The post US Lifts Sanctions Against Crypto Mixer Tornado Cash appeared first on SecurityWeek.

---

FCC Probes Whether Banned Chinese Telecom Providers Still Operating in US

The FCC is investigating whether Chinese firms such as Huawei, ZTE and China Telecom are still operating in the US. The post FCC Probes Whether Banned Chinese Telecom Providers Still Operating in US appeared first on SecurityWeek.

---

82% of all phishing emails utilized AI

A report found that there has been a 57.9% increase in attacks being sent from compromised accounts getting through traditional detection.

---

56% of security teams say AI is crucial to daily operations

A report by Seemplicity found that 86% of security teams are using AI in their security stacks and 56% say AI is now crucial to their daily operations.

---

Medusa Ransomware Uses Malicious Driver to Disable Security Tools

The Medusa ransomware relies on a malicious Windows driver to disable the security tools running on the infected systems. The post Medusa Ransomware Uses Malicious Driver to Disable Security Tools appeared first on SecurityWeek.

---

⚡ THN Weekly Recap: GitHub Supply Chain Attack, AI Malware, BYOVD Tactics, and More

A quiet tweak in a popular open-source tool opened the door to a supply chain breach—what started as a targeted attack quickly spiraled, exposing secrets across countless projects. That wasn’t the only stealth move. A new all-in-one malware is silently stealing passwords, crypto, and control—while hiding in plain sight. And over 300 Android apps joined the chaos, running ad

---

VSCode Marketplace Removes Two Extensions Deploying Early-Stage Ransomware

Cybersecurity researchers have uncovered two malicious extensions in the Visual Studio Code (VSCode) Marketplace that are designed to deploy ransomware that's under development to its users. The extensions, named "ahban.shiba" and "ahban.cychelloworld," have since been taken down by the marketplace maintainers. Both the extensions, per ReversingLabs, incorporate code that's designed to invoke a

---

How to Balance Password Security Against User Experience

If given the choice, most users are likely to favor a seamless experience over complex security measures, as they don’t prioritize strong password security. However, balancing security and usability doesn’t have to be a zero-sum game. By implementing the right best practices and tools, you can strike a balance between robust password security and a frictionless user experience (UX). This article

---

NetSfere Launches Quantum-Resilient Messaging Platform for Enterprise and Government Use

NetSfere Integrates ML-KEM and AES into its text, voice and video messaging platform to meet 2027 NSA Quantum Security mandates. The post NetSfere Launches Quantum-Resilient Messaging Platform for Enterprise and Government Use appeared first on SecurityWeek.

---

Albabat Ransomware Expands Targets, Abuses GitHub

New versions of the Albabat ransomware target Windows, Linux, and macOS, and retrieve configuration files from GitHub. The post Albabat Ransomware Expands Targets, Abuses GitHub appeared first on SecurityWeek.

---

Industry Moves for the week of March 24, 2025 - SecurityWeek

Explore industry moves and significant changes in the industry for the week of March 24, 2025. Stay updated with the latest industry trends and shifts.

---

Critical Next.js Vulnerability Allows Attackers to Bypass Middleware Authorization Checks

A critical security flaw has been disclosed in the Next.js React framework that could be potentially exploited to bypass authorization checks under certain conditions. The vulnerability, tracked as CVE-2025-29927, carries a CVSS score of 9.1 out of 10.0. "Next.js uses an internal header x-middleware-subrequest to prevent recursive requests from triggering infinite loops," Next.js said in an

---

Encrypted Messaging Apps Promise Privacy. Government Transparency Is Often the Price

Public officials and private citizens are consistently warned about hacking and data leaks, but technologies designed to increase privacy often decrease government transparency. The post Encrypted Messaging Apps Promise Privacy. Government Transparency Is Often the Price appeared first on SecurityWeek.