Kirsten Doyle

A major piece of the internet’s invisible plumbing faltered recently when Cloudflare (the infrastructure giant that protects and accelerates millions of sites) experienced a global outage that left users staring at error messages across the web. Platforms including X and OpenAI suffered elevated disruption, while some site owners couldn’t even access their dashboards.  Cloudflare eventually traced the root cause to a configuration file that ballooned beyond its expected size, crashing a key traffic-handling component. By mid-afternoon on the same day, the company announced a fix and apologised “to customers and the internet in general for letting you down today,” adding that it would…

Several London councils have spent the past few days grappling with cyber-attacks that have disrupted key systems and forced emergency plans into action, the BBC has reported. The Royal Borough of Kensington & Chelsea (RBKC) confirmed that it and Westminster City Council are dealing with a “cyber incident affecting some shared IT systems.” Phone lines and other services have been intermittently unavailable, and both councils say they are working with cyber specialists and the National Cyber Security Centre to contain the issue and protect data. The Met Police has opened an investigation. According to the Royal Borough of Kensington and Chelsea (RBKC), the…

ReliaQuest has uncovered what appears to be a coordinated campaign by the threat group Scattered Lapsus$ Hunters (SLSH) to target organizations using the customer service platform Zendesk.   The findings, published in a new ReliaQuest blog, point to a sustained effort to weaponize help-desk workflows as a path into corporate systems. Researchers identified a cluster of newly created infrastructure over the past six months, including typosquatted domains and impersonation URLs crafted to mimic legitimate Zendesk environments. Many of these pages host phishing portals (some posing as SSO login screens) designed to steal user credentials before the genuine Zendesk authentication process even begins. ReliaQuest also reports signs that attackers have been submitting fraudulent…

Harvard University has disclosed a vishing attack that exposed the personal information of students, parents, alumni (and some of their spouses, partners), donors, staff, and faculty members.    Exposed data includes “biographical information pertaining to University fundraising and alumni engagement activities” as well as emails, phone numbers, home and business addresses, attendance records, and donation details. The University said it acted immediately to remove the actor’s access to its systems and prevent further unauthorized access. “Our investigation is currently ongoing. We are working with third-party cybersecurity experts and law enforcement to investigate this incident. This website will be updated.” Harvard said it is working with third-party…

Real estate lender tech provider SitusAMC has confirmed it suffered a cyberattack on November 12 that impacted the sensitive personal information of clients of hundreds of some of the nation’s biggest banks, including JPMorgan Chase. The data exposed was related to residential mortgages. JPMorgan Chase, Citi, and Morgan Stanley are among those that have been notified that their client data may have been taken. In a statement, the company said: “Corporate data associated with certain of our clients’ relationships with SitusAMC, such as accounting records and legal agreements, has been impacted. Certain data relating to some of our clients’ customers may also have been impacted. The scope, nature,…

Researchers at Huntress are warning that a new wave of ClickFix attacks is using steganography to hide malware inside PNG images—an unusual twist in an already troubling social-engineering technique. ClickFix attacks rely on one simple move: convincing a user to open the Windows Run prompt and paste a malicious command. That manual action lets attackers bypass many traditional controls. What Huntress has now uncovered is a far more sophisticated execution chain sitting behind that simple trick, leading to infostealers such as LummaC2 and Rhadamanthys.  Attack Stages The campaign begins with familiar lures. Early versions mimicked generic “Human Verification” checkpoints. Newer ones, however, have gone all-in on a…

Salesforce says it has picked up unusual behaviour linked to Gainsight-published apps that customers deploy and manage in their own environments. The company’s investigation shows that this activity may have allowed unauthorized access to some customers’ Salesforce data through the app’s integration path. As soon as it detected the issue, Salesforce revoked every active access and refresh token tied to Gainsight apps and pulled those apps from the AppExchange while it continues the investigation. There’s no indication that the Salesforce platform itself was compromised. The activity points to the app’s external connection rather than a platform vulnerability. Salesforce has notified…

Trend Micro researchers are warning that bad actors are exploiting the weakest points in S3 environments: misconfigurations, leaked access keys, and relaxed encryption controls. Their latest analysis tracks five emerging ransomware variants built specifically to break, lock, or wipe cloud storage.  The playbook is different from traditional ransomware. Rather than dropping malware and encrypting files on a machine, attackers are weaponizing AWS’s features. Several variants use the Key Management Service or Server-Side Encryption to encrypt S3 objects at scale. One strain employs default AWS KMS keys to secure bucket data and then schedules the key for deletion, providing victims with…

A cluster of major websites (including X and ChatGPT) went down for large parts of Tuesday after Cloudflare, the backbone beneath much of the modern web, tripped over its own wiring. Shortly after 11:30 GMT, reports began to stack up on Downdetector. Thousands of users. Dozens of services. A quiet drumbeat turning into a roar. Pages froze. Apps hung. Routine clicks suddenly felt like walking through mud. Cloudflare later admitted the fault was theirs. A configuration file meant to sift hostile traffic misbehaved, triggering a crash in the software that keeps its wider network flowing. In the company’s words, it was…

Logitech has confirmed it suffered a data-theft breach tied to a zero-day in a third-party platform, days after the Clop extortion gang published almost 1.8 terabytes of data allegedly stolen from the company.  In a Form 8-K filed with the U.S. Securities and Exchange Commission, the consumer-electronics maker said it “recently experienced a cybersecurity incident relating to the exfiltration of data,” adding that the attack did not impact products, business operations, or manufacturing. Logitech says the stolen data “likely included limited information about employees and consumers and data relating to customers and suppliers,” and that it does not believe national ID numbers or payment…