346 stories from 29 sources
The month in Cybersecurity
Longest running story: 34 days
Click on a headline to see stories that shaped it.
Threads
7 threads
Bitget’s theft produced outflows that exceeded the stolen funds and tested customer confidence. Binance then faced a far larger reported theft, forcing it to cover losses, restore withdrawals, and confront broader scrutiny of custody and fund movements.
Reports of AI-linked bank breaches expanded into repeated attacks across financial institutions and warnings about shared payment and partner weaknesses. Fraud also moved beyond unauthorized transactions as criminals manipulated victims and tested delegated spending controls.
AI agents moved from an emerging attack surface to reported intrusions against government, financial, and corporate systems. Defenders responded with tighter controls and AI-based discovery, but remediation and accountability struggled to keep pace.
Critical PHP vulnerabilities moved from warning to active exploitation, forcing organizations to take websites offline and patch exposed systems. The broader software-risk picture worsened as AI-assisted exploitation increased the speed at which weaknesses could spread.
Federal breaches and repeated disclosures of Homeland Security personnel data showed that government systems remained vulnerable to prolonged intrusion and targeting. Planning for extended outages and attacks on public systems expanded cybersecurity into a continuity and public-trust problem.
The ConnectWise breach showed how compromising a trusted provider can expose thousands of customer organizations. Other cloud, vendor, and technology-provider weaknesses pushed financial institutions to demand stronger supplier controls and resilience.
Compromised intermediate certificates created risks of forged credentials and intercepted connections. The fallout ended with eMudhra leaving the certificate business, exposing how weak private-key protection can undermine broader web trust.
Week’s Recap