Latest cybersecurity reporting from selected sources.

Also, 23andMe Breach Settlement, GitHub AI Flaw, Ubiquiti Patches Critical BugsThis week, hidden breaches, researchers exposed a GitHub AI agent flaw, an Ubiquiti critical flaw, a ColdFusion flaw, a growing Chinese ORB, U.K. government FortiBleed exposure, 23andMe victims get $46.75 million, 3.8 million affected by Medtronic breach and Cerner's 2025 victim count went up.

Agencies and Industry Coordinate Post-Quantum Migration PlansThe White House convened government officials, quantum companies and researchers to accelerate the transition to post-quantum cryptography, align public-private investments and reinforce a 2030 deadline as advances in quantum computing increase risks to today's encryption.

Researchers Identified Two Undocumented Variants Used Since 2023Eset uncovered two previously undocumented Windows variants of the China-linked SprySocks backdoor tied to FishMonger and iSoon, revealing expanded espionage capabilities, rootkit-based stealth and continued targeting of government organizations across Asia and Central America.

Proposed Bill Could Reopen Debate Over Computer Misuse Act ProtectionsThe British government has announced plans to update cybersecurity legislation aimed at strengthening the country's digital defenses - while overhauling outdated cybercrime authorities that officials and security researchers warn are no longer fit for modern threats

Eset Researchers Discover Trove of Go-Based MalwareResearchers uncovered a Chinese-linked cyberespionage group after attackers left command and control credentials embedded in malware, exposing internal operations, testing environments and thousands of messages tied to campaigns targeting a Mongolia government agency.

Security Minister Dan Jarvis Endorses Security Researcher ProtectionsThe U.K. government is considering amending its three-decade-old hacking law to include a "statutory defense" cover for security researchers. The announcement comes amid concerns that the law penalizes white hat hackers for essential security practices.

JSON Code 'Beautifiers' Expose Sensitive Data From Banks, Government AgenciesAt what price beauty? Apparently, some developers will paste anything into "JSON beautify" sites, from researchers report recovering authentication keys, database credentials, personally identifiable information for banking customers and much more.

NIH Working on Fixes to Address National Security Risks and Weak Access ControlsThe sensitive health and genomics data of 1 million Americans used by a National Institutes of Health research project could be at risk for access or theft by bad actors, including foreign adversaries, a government watchdog group. Security weaknesses discovered in an audit are being addressed.

Growing Enterprise Use Cases and National Missions Signal Toward a Quantum EraQuantum computers are finally emerging from sterile labs after decades of research and development. Recent breakthroughs and use cases indicate that the quantum decade has begun, with collaboration across the private sector, startup community, government and academia accelerating development.

Compendium Features Dozens of In-Depth Interviews With CEOs, CISOs and ResearchersWelcome to Information Security Media Group's Infosecurity Europe 2025 Compendium featuring cybersecurity insights from industry's top researchers, CEOs, CISOs, government leaders and more. Inside this guide, you'll find links to video interviews created by ISMG.Studio.

Government Agencies Targeted With Infostealers and Cryptomining MalwareA fake police alert is the social engineering cornerstone of an ongoing phishing campaign targeting Ukrainian government agencies, warn security researchers. They're tracking a surge in malicious SVG file attachments, in this case leading to information-stealing and cryptocurrency-mining malware.

Over 400 Organizations Breached Via Ongoing ToolShell Attacks, Researchers WarnThe U.S. government agency that maintains and designs America's nuclear weapons was reportedly breached by attackers exploiting zero-day flaws in on-premises Microsoft SharePoint servers, with researchers now counting over 400 victims, including European and Middle Eastern governments.

Agency to Collaborate with External Experts on Vulnerability ResearchThe U.K. NCSC will collaborate with industry experts for vulnerability detection and mitigation as part of its latest Vulnerability Research Initiative. The announcement comes on the heels of funding concerns for the U.S. government-based Common Vulnerabilities and Exposures program.

China's Hack-For-Hire Scene Disgorges Another LeakThe Chinese nation-state threat actor tracked as Salt Typhoon is operated by a clutch of private firms whose clients include multiple Chinese government agencies, finds analysis of leaked data by Spy Cloud. Researchers found a spreadsheet listing buyers, sellers and financial transaction details.

'Heightened Threat Environment' Faces Critical Infrastructure, US Government WarnsMany types of commonly used types of industrial control systems continue to be deployed in a manner that leaves them publicly exposed to the internet, often by U.S.-based critical infrastructure operators, in what amounts to a preventable security risk, researchers warn.

BladedFeline Hackers Spying on Kurdish Officials Since at Least 2017An Iranian state espionage group stayed hidden for more than half-a-decade until security researchers spotted it in 2023, researchers said Thursday in a report detailing a growing arsenal of hacking tools it deployed against Kurdish and Iraqi government officials.

BladedFeline Hackers Spying on Kurdish Officials Since at Least 2017An Iranian state espionage group stayed hidden for more than half-a-decade until security researchers spotted it in 2023, researchers said Thursday in a report detailing a growing arsenal of hacking tools it deployed against Kurdish and Iraqi government officials.

Researcher Jason Sinchak on Recent Cyber Warnings About Contec CMS8000 DevicesA hidden reverse backdoor in low-cost patient vital sign monitors used globally is hardcoded with an IP address connecting to a Chinese government-funded education and research network, which poses both privacy and potential safety concerns, said security researcher Jason Sinchak of ELTON.

Hackers Unlikley to Exploit Flaws in The WildSecurity researchers found an unpatchable flaw in the system that prevents commercial aircraft from crashing into each other, the U.S. federal government said in a Tuesday advisory that called the likelihood of its exploitation "unlikely" outside of a laboratory setting

Studying Backdoors in Web Shells, Researchers Find 4,000 Infected SystemsHow many servers are infected by web shells designed to give attackers remote access to systems, but now "phone home" to malicious infrastructure that's now abandoned or expired? Security researchers who posed that question have counted 4,000 such systems, including in government and education.