60
Search: “Certificate Transparency Monitoring”
18 stories
60
Attackers Steal METR API Key and Consume AI Credits Worth About $600,000
METR disclosed attackers stole an API key and burned about $600,000 in inference credits, plus a second probing campaign against its infrastructure.
METR, the AI model evaluation non-profit, disclosed two 2026 security incidents. In March, attackers found a publicly exposed EC2 instance behind a fail-open authentication bug, prompted an agent to reveal its API key, added SSH persistence, and consumed roughly $600,000 in inference credits over three weeks. In May, a likely financially motivated actor systematically probed METR's public infrastructure using agents for vulnerability discovery, credential stuffing, OAuth token grants and staff phishing, with no confirmed access to non-public data.
52
60
60
60
⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [13 January]
60
60
THN Cybersecurity Recap: Top Threats, Tools and News (Oct 21
60
Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience
60
60
60
Week in review: cPanel vulnerability actively exploited, DigiCert breach, LinkedIn job scams
60
Risky Bulletin: BEC campaign steals €35 million from French notaries
Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.
A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.
72
60
60
⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack & Vibe
60
⚡ Weekly Recap: SharePoint 0-Day, Chrome Exploit, macOS Spyware, NVIDIA Toolkit RCE and More
60