Account takeover fraud is surging in the US, making it the most damaging form of digital fraud, accounting for 31% of losses. Globally, it’s skyrocketed by 141% since 2021, proving that fraudsters are working harder than your average gym-goer. Time to pump up those security measures, folks!

The figma-developer-mcp server vulnerability, CVE-2025-53967, is like giving hackers a backstage pass to your system. This command injection bug lets attackers execute arbitrary commands by exploiting unvalidated user inputs. While it’s patched now, it’s a stark reminder that even AI tools can inadvertently play the role of an unwanted accomplice.

Hackers are embracing AI like a kid with a new toy, using ChatGPT for reconnaissance while other AI models handle the dirty work. OpenAI’s report highlights cybercriminals exploiting AI to turbocharge their existing scams and strategies, proving once again that even in the world of crime, efficiency is key.

North Korean hackers have turned crypto theft into a blockbuster hit, swiping over $2 billion in 2025 alone. This staggering haul highlights their growing reliance on cyber heists to fund their regime. With advanced laundering tricks, they’re outpacing James Bond villains, but blockchain sleuths are hot on their trail!

Jaguar Land Rover’s sales hit a speed bump with a 25% drop due to a cyber incident. The company is now shifting gears, beginning a phased restart of operations. JLR’s plan includes revving up engine production and assembling the team to boost their manufacturing comeback.

Redis has finally patched a 13-year-old Lua flaw, CVE-2025-49844, that lets hackers perform remote code execution. This bug, dubbed “RediShell,” has a CVSS score of 10.0, so it’s as serious as forgetting your wedding anniversary. Redis users, update your systems faster than a teenager texts.

The Qilin ransomware group has brewed up trouble for Asahi, claiming responsibility for a cyberattack that disrupted the beer giant’s operations in Japan. Asahi confirmed ransomware was involved, and Qilin alleges they’ve stolen 27 gigabytes of sensitive data. So, is the beer half-full or half-empty? Cheers to cyber woes!

North Korea-backed hackers have swiped over $2 billion in cryptocurrency this year, funding missile and nuclear programs with digital loot. These crafty crypto-thieves are resorting to social engineering rather than technical exploits. It’s like James Bond meets Silicon Valley, with Pyongyang making off with billions in digital cash and leaving blockchain analysts scratching their heads.

Shuyal Stealer isn’t your average malware—it’s the James Bond of infostealers, quietly pilfering credentials from 17 browsers, disabling Task Manager, and sending the loot via Telegram before vanishing without a trace. It’s a master of disguise, turning your digital life into its own personal buffet.

Two teenagers were arrested in Bishop’s Stortford for a cyber-attack on a London nursery group. The duo, dubbed “Radiant,” demanded £600,000 in Bitcoin after stealing data from the Kido nursery group. The Metropolitan Police has been working at pace to bring these culprits to justice. Stay tuned as the investigation continues.

Oracle E-Business Suite zero-day CVE-2025-61882 was stealthily exploited for two months before being patched. The Cl0p cybercrime group led the charge, with the vulnerability linked to Russia-aligned Graceful Spider. Feuds among threat groups like Scattered LAPSUS$ Hunters add drama, while over 2,000 instances remain exposed, offering a buffet of hacking opportunities. Stay vigilant!

OpenAI has disrupted multiple clusters misusing ChatGPT for malware development, involving actors from Russia, North Korea, and China. These cyber villains used the AI to draft phishing emails, develop remote access trojans, and even plan TikTok challenges. ChatGPT: now aiding and abetting, but not itself committing, cyber crimes.

Salesforce is standing firm against cyber extortion, refusing to pay ransom for data theft attacks impacting its customers. Despite threats from “Scattered Lapsus$ Hunters” to leak nearly a billion stolen records, the company remains unyielding, urging others not to cave in to the cybercriminals’ demands.

California Consumer Privacy Act complaints can spark investigations! Think a company isn’t respecting your privacy rights? File a complaint with the California Privacy Protection Agency. It’s as easy as pie, but with fewer calories and more impact! Your voice can lead to the largest-ever fines and make a difference.

Tractor Supply, America’s largest rural lifestyle retailer, was hit with a $1.35 million fine for violating the California Consumer Privacy Act. The California Privacy Protection Agency’s record penalty underscores that privacy laws are only as strong as their enforcement, reminding everyone that your complaints matter—so keep speaking up.

Docker rolls out unlimited access to its Hardened Images catalog, enabling developers to embrace near-zero CVEs without breaking the bank. These super-secure images come with a 30-day free trial, proving that safety doesn’t have to be pricey. Get ready to say goodbye to vulnerabilities and hello to peace of mind!

CISA’s new catalog addition: Synacor Zimbra’s flaw, CVE-2025-27915. This XSS vulnerability allows attackers to hijack sessions and exfiltrate data through sneaky ICS files, making your calendar appointments more hazardous than your in-laws’ holiday visits. Fix it by October 28, 2025, or risk becoming a cyber punchline!

Attackers are using Cascading Style Sheets to hide text in emails, tricking spam filters with “salting.” This stealthy tactic involves inserting invisible content, leaving security defenses scratching their heads. Cisco Talos warns that this growing problem needs more sophisticated filtering methods to catch the “salty” mischief.

Google’s AI assistant Gemini is facing a hilarious yet serious threat: ASCII smuggling. This sneaky attack method uses invisible characters to trick Gemini into spreading fake info or worse. It’s like convincing a vending machine to serve you a pizza instead of a soda—just with more potential for chaos.

Storm-1175 exploits GoAnywhere MFT vulnerability CVE-2025-10035, making remote code execution as easy as ordering pizza online. This flaw, a zero-day glitch, is the secret ingredient in Medusa ransomware attacks. Microsoft suggests a digital lockdown: update servers, restrict internet connections, and block suspicious activity like a bouncer at a club.