Author: HackWatchit

It takes a bit of effort, but iPhones can wind up with viruses and malware. And that can indeed lead to all kinds of snooping.  Whether through malware or a bad app, hackers can skim personal info while you browse, bank, and shop. They can also infect your phone with ransomware that locks up your personal info or that locks up the phone itself.  Those are some worst-case scenarios. However, good for you and unfortunate hackers is the way iPhones run apps. It makes it tough for viruses and malware to get a toehold. Apple designed the iOS operating system…

Carding — the underground business of stealing, selling and swiping stolen payment card data — has long been the dominion of Russia-based hackers. Happily, the broad deployment of more secure chip-based payment cards in the United States has weakened the carding market. But a flurry of innovation from cybercrime groups in China is breathing new life into the carding industry, by turning phished card data into mobile wallets that can be used online and at main street stores. An image from one Chinese phishing group’s Telegram channel shows various toll road phish kits available. If you own a mobile phone,…

In July 1959, Arthur Samuel developed one of the first agents to play the game of checkers. What constitutes an agent that plays checkers can be best described in Samuel’s own words, “…a computer [that] can be programmed so that it will learn to play a better game of checkers than can be played by the person who wrote the program” [1]. The checkers’ agent tries to follow the idea of simulating every possible move given the current situation and selecting the most advantageous one i.e. one that brings the player closer to winning. The move’s “advantageousness” is determined by…

The FTX estate began a creditor repayment program that could total more than $16 billion, releasing $1.2 billion to smaller claim holders on Tuesday. It’s the latest step in the collapsed crypto exchange’s efforts to help former customers recoup funds.The bankruptcy estate’s initial distribution targeted “Convenience Class” claims under $50,000, reaching the majority of affected users. The estate’s managers will be sending payments in stages to ensure proper verification and orderly distribution, according to FTX.”The start of these distributions is an incredible and important milestone for FTX,” John J. Ray III, plan administrator of the FTX Recovery Trust, said in…

A great place that can sometimes be overlooked on an internal penetration test are the secrets hidden in plain sight. That is, a place where no authentication is required in many circumstances throughout internal networks. I’m talking about source code management platforms, specifically Gitlab. Other self-hosted platforms are likely also susceptible to this unauthenticated technique as well, but we’ll be focusing on GitLab.  A sequence of words that I’ve heard:  Mr. Senior Developer – “If an attacker already has access to our internal network, we’ve got bigger problems.” The biggest problem is this kind of thinking! Yes, a hacker inside…

Intel by Intruder now uses AI to contextualize NVD descriptions, helping security teams assess risk faster. Intruder, a leader in attack surface management, has launched AI-generated descriptions for Common Vulnerabilities and Exposures (CVEs) within its free vulnerability intelligence platform, Intel. This new feature enhances cybersecurity professionals’ ability to quickly understand and assess vulnerabilities, addressing a common pain point: the often vague and technical descriptions provided by the National Vulnerability Database (NVD). With thousands of vulnerabilities published every year, security teams rely on NVD as a key resource for researching CVEs. However, NVD descriptions frequently lack clarity or context, making it…

Two critical OpenSSH vulnerabilities discovered! Qualys TRU finds client and server flaws (CVE-2025-26465 & CVE-2025-26466) enabling MITM and DoS. Upgrade to 9.9p2 now to protect your systems. Qualys Threat Research Unit (TRU) has discovered two security weaknesses in OpenSSH, a widely used tool across various operating systems for secure remote login, file transfers, and other critical functions.  The first vulnerability, identified as CVE-2025-26465, exposes the OpenSSH client to machine-in-the-middle attacks. This flaw “allows an active machine-in-the-middle attack on the OpenSSH client when the VerifyHostKeyDNS option is enabled” and set or ‘yes’ or ‘ask,’ the blog post read. Further probing revealed that…

When I attended the MIT Sloan CIO Symposium in May, it struck me that as I listened to CIOs talking about the latest technology — in this case generative AI — I was reminded of another time at the same symposium in around 2010 when the talk was all about the cloud. It was notable how similar the concerns over AI were to the ones that I heard about the fledgling cloud all those years ago: Companies were concerned about governance (check), security (check) and responsible use of a new technology (check). But 2010 was just at the edge of…

Microsoft once again reminded IT administrators that driver synchronization in Windows Server Update Services (WSUS) will be deprecated on April 18, just 60 days from now. After its deprecation, the company encourages enterprises to adopt cloud-based solutions for client and server updates, like Windows Autopatch, Azure Update Manager, and Microsoft Intune. “For on-premises contexts, drivers will be available on the Microsoft Update catalog, but you won’t be able to import them into WSUS,” the company said in a Windows message center update on Tuesday. “You’ll need to use any of the available alternative solutions, such as Device Driver Packages, or transition…