Search: “credentials”

4 stories in the last 3d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 31 Malware 27 Vulnerability 26 Advisory 23 Data breach 16 AI safety & security 16 Threat actor 14 Research 11 Industry 10 Tools 10 Phishing & fraud 8 Policy & legal 4 AI tools & infra 3 AI policy 1

SeverityAll critical 20 high 74 medium 47 low 5 info 54

Forgery of C2PA on a Pixel 10

Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.

A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.

Lobsters · securitySep 16, 13:24 UTC · 15h agoResearch

Webinar: How malicious OAuth apps can lead to Google Workspace breaches

BleepingComputer webinar will dissect two Google Workspace breaches caused by malicious OAuth apps and social engineering, hosted September 23 with Material Security.

On September 23, 2026, BleepingComputer will host a webinar with Material Security examining two real attacks that used malicious OAuth applications and social engineering to breach Google Workspace environments. Rather than stealing credentials, attackers persuaded users to authorize malicious apps, gaining access to data through the granted permissions. The session covers first-hour response decisions and which security controls provide the greatest value for fast-growing organizations.

BleepingComputerSep 14, 12:15 UTC · 2d agoPhishing & fraud

Cisco Identity Services Engine Authorization Bypass Vulnerabilities

Cisco fixed authorization bypass flaws in ISE and ISE-PIC web management letting authenticated admins modify file descriptions via crafted HTTP requests.

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine and ISE Passive Identity Connector result from missing server-side validation of Administrator permissions. An authenticated remote attacker with valid Administrator credentials can submit crafted HTTP requests to modify descriptions of files on specific pages. Cisco has released software updates addressing the issues.

Cisco Security AdvisoriesSep 16, 16:00 UTC · 12h agoAdvisory 15 sources

Google’s New Search Redirects Make It Harder to Check Where Links Lead Before Clicking

Malwarebytes reports Google's new encoded google.com/goto?url= redirects break hover-preview link checking, weakening a common phishing defense.

Google now routes some search results through opaque google.com/goto?url= redirects using custom encoding, so browser link previews no longer reveal the true destination, only the claimed label above the result. Malwarebytes found the final destination is visible only in the redirect response's Location header, complicating hover-based safety checks as well as scraping, archiving, and audit tools. The change arrives amid malvertising, search-result poisoning, and fake installer campaigns like the recent Node.js infostealer lure. Google says it deploys measures against evolving abuse but did not explain the change.

Cyber Security NewsSep 15, 12:21 UTC · 1d agoResearch