Author: HackWatchit

Members of the U.S. House Committee on Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection held a Thursday hearing addressing the reauthorization of cybersecurity information sharing activities that underpin the nation’s national cyber defense. Ten years ago, Congress enacted the Cybersecurity Information Sharing Act of 2015, which transformed how the government and private sector collaborate to defend the nation against cyber threats. The witnesses at the hearing include Kate Kuehn, member and CISO-in-residence at the National Technology Security Coalition, John Miller, senior vice president of policy for Trust, Data, & Technology, General Counsel at the Information Technology Industry Council, Diane…

Meta plans to train AI on EU user data from May 27 without consent Pierluigi Paganini May 16, 2025 Meta plans to train AI on EU user data from May 27 without consent; privacy group noyb threatens lawsuit over lack of explicit opt-in. Meta plans to use EU user data for AI training starting May 27 without explicit consent. Austrian privacy group noyb threatens a class action lawsuit if the social network giant does not desist. In April, Meta announced it will start training its AI models using public data from adults in the EU, after pausing the plan last…

can be a scary topic for people. Many of you want to work in machine learning, but the maths skills needed may seem overwhelming. I am here to tell you that it’s nowhere as intimidating as you may think and to give you a roadmap, resources, and advice on how to learn math effectively. Let’s get into it! Do you need maths for machine learning? I often get asked: Do you need to know maths to work in machine learning? The short answer is generally yes, but the depth and extent of maths you need to know depends on the…

David Fletcher// The following blog post is meant to expand upon the findings commonly identified in BHIS reports.  The “Server Supports Weak Transport Layer Security (SSL/TLS)” is almost universal across the breadth of our testing. Why is this finding important? This finding is important because attackers are ultimately interested in data.  Use of a strong SSL/TLS configuration provides identification, authentication, confidentiality, and integrity services to the application or protocol that is using it. If weak protocols and ciphers are supported, then an attacker may be able to break the encrypted tunnel that exists between the client and server. After this…

Ransomware gang members increasingly use a new malware called Skitnet (“Bossnet”) to perform stealthy post-exploitation activities on breached networks. The malware has been offered for sale on underground forums like RAMP since April 2024, but according to Prodaft researchers, it started gaining significant traction among ransomware gangs since early 2025. Prodaft told BleepingComputer they have observed multiple ransomware operations deploying Skitnet in real-world attacks, including BlackBasta in Microsoft Teams phishing attacks against the enterprise, and Cactus. The malware promoted on underground forumsSource: Prodaft Stealthy and powerful backdoor The Skitnet infection begins with a Rust-based loader dropped and executed on the…

Ethereum’s recent Pectra upgrade is sparking a surge in smart account usage, redefining how users interact with the network.Data compiled by Base analyst 0xKofi from Bundle Bear shows that more than 26,000 wallets have transitioned to the new smart account format powered by the EIP-7702 in the Pectra upgrade.What are smart accounts?EIP-7702 is a new standard that lets regular Ethereum wallets operate like smart contracts, without losing their original address or flexibility.Traditionally, Ethereum wallets fell into two categories: Externally Owned Accounts (EOAs), which could send transactions but lacked programmability, and Smart Contracts addresses that could automate tasks but couldn’t initiate…

The Linux Foundation this week made available a customizable reference guide intended to help organizations identify critical cybersecurity skills requirements.Developed in collaboration with Open Source Security Foundation (OpenSSF), the Cybersecurity Skills Framework defines roles and responsibilities across a wide range of IT and cybersecurity roles and functions, including tasks that should be assigned to application developers, DevOps engineers, project managers and platform architects.The Linux Foundation is encouraging organizations to adapt and extend the framework to their own requirements, with updates based on feedback provided to be made annually. Clyde Seepersad, senior vice president and general manager of education for The…

In this Help Net Security interview, Camellia Chan, CEO at X-PHY, discusses the dangers of deepfakes in real-world incidents, including their use in financial fraud and political disinformation. She explains AI-driven defense strategies and recommends updating incident response plans and internal policies, integrating detection tools, and ensuring compliance with regulations like the EU’s DORA to mitigate liability. How have attackers used deepfakes in real-world incidents, even if hypothetically, and how plausible are those tactics becoming? We’ve already seen deepfakes used in everything from financial fraud to political disinformation. One of the more alarming trends is impersonation scams, where attackers use…

A high-severity Chrome vulnerability (CVE-2025-4664) that Google has fixed on Wednesday is being leveraged by attackers, CISA has confirmed by adding the flaw to its Known Exploited Vulnerabilities catalog. About CVE-2025-4664 CVE-2025-4664 stems from insufficient policy enforcement in Google Chrome’s Loader, which attackers can use to make the browser leak cross-origin data that can be used to take over accounts. The vulnerability can be triggered with a maliciously crafted HTML page, on Chrome versions prior to v136.0.7103.113/.114 on Windows, macOS and Linux. “Google is aware that knowledge of CVE-2025-4664 exists in the wild,” the company said when it pushed out…