How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several systems. A trusted setting can be used to lock people out. Even a simple file copy can reach places it shouldn't. And while new tools are helping find security holes faster, some important systems are still taking months, sometimes over a year, to get patched. Not exactly a great match.

The stranger part is how little some attacks now need. Ransom demands without encrypted files. Fake websites that look real enough to steal money. AI tools picking up dangerous instructions while trying to help. Even the attackers are making mistakes in their own code.

This week's stories are a reminder that the biggest problems don't always come from clever tricks. Sometimes the easy way works just fine. Here's what else happened.

The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.

K. National Cyber Security Center (NCSC) has warned that the widespread availability of AI-powered cyber tools has "almost certainly" led to a significant increase in the discovery of zero-day vulnerabilities. "Defensive AI-cyber tools have reduced the window of a vulnerability moving from zero-day to an n-day vulnerability, and have made patching a quicker process," NCSC said . "However, without correct and widespread configuring of this technology, many systems are still vulnerable to attackers using AI-cyber tools to identify and exploit system weaknesses. Additionally, an organisation’s internal patching and testing processes will need to evolve to meet the pace of accelerating vulnerability discovery.

Source link