The Compound cryptocurrency exchange accidentally botched a platform upgrade and distributed millions in free COMP tokens to users - then threatened to dox the recipients. [...]

Jason Kent, hacker-in-residence at Cequence Security, discusses how to track user-agent connections to mobile and desktop APIs, to spot malicious activity. [...]

Newly discovered code resembles the Kazuar backdoor and the Sunshuttle second-stage malware distributed by Nobelium in the SolarWinds supply-chain attacks. [...]

A campaign is stealing one-time password tokens to gain access to PayPal, Apple Pay and Google Pay, among others. [...]

UPDATE: Indicators of compromise are now available. The unredacted RCE exploit released on Monday allows unauthenticated, remote attackers to upload files to the vCenter Server analytics service. [...]

Ekaterina Kilyusheva, head of the Information Security Analytics Research Group at Positive Technologies, offers a blueprint for locking up the fortress. [...]

The mobile baddie grants itself access to almost everything, enabling spying, data-harvesting, stalking and fraud attacks, among others. [...]

Unauthenticated cyberattackers can also wreak havoc on networking device configurations. [...]

Casey Ellis, founder, CTO and chairman of Bugcrowd, discusses a roadmap for lowering risk from cyberattacks most effectively. [...]

A high-severity vulnerability could cause system crashes, knocking out sensors, medical equipment and more. [...]

Drivers bristle under constant surveillance by artificial-intelligence (AI) tech, but Amazon says it works and boosts safety. [...]

Misconfigured APIs make any app risky, but when you’re talking about financial apps, you’re talking about handing ne’er-do-wells the power to turn your pockets inside-out. [...]

Jeff Costlow, CISO at ExtraHop, makes the case for implementing next-gen intrusion-detection systems (NG-IDS) and retiring those noisy 90s compliance platforms. [...]

Dubbed OMIGOD, a series of vulnerabilities in the Open Management Infrastructure used in Azure on Linux demonstrate hidden security threats, researchers said. [...]

The incident raises considerations for security for critical data housed in third-party infrastructure, researchers say. [...]

John Hammond, security researcher with Huntress, discusses how financially motivated cybercrooks use and abuse cryptocurrency. [...]

A chain of exploits could allow a malicious Azure user to infiltrate other customers' cloud instances within Microsoft's container-as-a-service offering. [...]

An authentication bypass vulnerability in the ManageEngine ADSelfService Plus platform leading to remote code execution offers up the keys to the corporate kingdom. [...]

An authentication bypass vulnerability leading to remote code execution offers up the keys to the corporate kingdom. [...]

The attackers are indiscriminately striking thousands of victims worldwide with their new “Chimaera” campaign. [...]

Grant Oviatt, director of incident-response engagements at Red Canary, provides advice and best practices on how to get there faster. [...]

A design flaw involving Google Timeline could allow someone to track another device without installing a stalkerware app. [...]

Eight states are introducing drivers licenses and identification cards available for use on Apple iPhones and Watches, but critics warn about the dangers of eliminating the use of a paper-based system entirely. [...]

Cream is latest DeFi platform to get fleeced in rash of attacks. [...]

The airline announced the breach on Thursday, and the ransomware gang started a countdown clock the next day. [...]