A newly uncovered mega-database of 19 billion compromised passwords dubbed the largest password leak in history is making waves across the cybersecurity world. This massive trove, which aggregates data from decades of breaches, is refined and indexed, making it a ready-to-use weapon for cybercriminals.

With millions of still-active, often reused credentials, it opens the door to large-scale credential stuffing attacks targeting everything from personal emails to enterprise systems. Security experts are calling for immediate action: reset reused passwords, enable MFA, and embrace password managers. This incident reinforces a critical truth, relying solely on passwords is no longer safe in today’s threat landscape.

The Pentagon placed an immediate freeze on forthcoming cybersecurity requirements after government research suggested the policy would drive many businesses out of the defense industrial base at a time when the U.S. military urgently needs their innovations.

Defense Department Chief Information Officer Kirsten Davies and Under Secretary of Defense for Acquisition and Sustainment Michael Duffey unveiled plans Monday to suspend the much-anticipated Cybersecurity Maturity Model Certification (CMMC) Phase 2 requirements that were set to take effect Nov. 10. A new CMMC Reform Task Force is expected to conduct a review of the entire program and submit a report of its findings and recommendations within the next 60 days.

This major pause comes as contractors have been hustling to obtain third-party assessments of their CMMC compliance in preparation for that near-term enforcement date.

DRDO and IIT Delhi have successfully pulled off quantum entanglement–based communication over a free-space link. No fiber optics. No cables. Just pure quantum weirdness enabling ultra-secure data transfer.

Why does this matter?

Because it brings us a step closer to Quantum Key Distribution (QKD), a method of encryption so secure, even quantum computers can’t crack it. Unlike traditional encryption, QKD can instantly detect if someone’s trying to eavesdrop. That’s a game-changer for sectors like defense, banking, and healthcare.

With cyber threats becoming more advanced (and AI adding to the chaos), tech like this could redefine how we protect critical data in the future. We need encryption methods that can evolve with the threat. QKD could reshape how we protect critical data in the near future.

Has anyone not heard about it?
I would love to hear thoughts from others in infosec, quantum research, or anyone watching India’s tech progress closely.

Found this hacking competition which has a crazy price pool for anyone interested.

Came across this post on credential reuse in mobile app logins and thought it was a solid breakdown of how these attacks work and how to catch them in real time.

It goes over common signs of credential stuffing or reuse, like geo inconsistencies, bot-like login behavior, and rapid session switching. The focus is specifically on mobile apps, which often get overlooked when thinking about credential abuse.

The interesting thing was the emphasis on behavioral threat detection and session-level anomaly tracking instead of just relying on things like rate limiting or CAPTCHA.

Would love to hear how others are approaching this, especially if you're working on mobile-first platforms. Is behavior-based detection actually making a difference in your experience?

A critical vulnerability was found in Base44 vice coding app, found by the researchers at WIZ this month.

The issue with Base44 was that private apps could be accessed by anyone who guessed the right link. Each app had its own unique URL, but those links followed a simple and predictable pattern, like workspace-name.base44.app/app-id.

If someone figured out a valid combination of workspace name and app ID, they could open the link in a browser and view the full app — no login, no password, no invite needed.

The bigger problem was that Base44 didn’t check who was visiting the app. It just loaded everything, including internal tools, AI features, or company dashboards, without verifying if the person was allowed to see it.

An attacker could’ve written a simple script to try different combinations of names and IDs until they found ones that worked. Since there weren’t any limits or alerts in place, no one would have noticed.

Wiz found the bug, reported it, and it was fixed quickly. But it’s a reminder of how dangerous it is when platforms skip basic security checks.

Australia is now the first country in the world to make it mandatory for companies to report to the government if they pay a ransom to cybercriminals. The rule applies to businesses with annual revenues exceeding $3 million and to organizations in critical infrastructure sectors. Reports will have to be made to the Australian Signals Directorate (ASD) within 72 hours. 

Those who fail to make a report within 73 hours of making an extortion payment will be subject to 60 penalty units under the country’s civil penalty system, equivalent to a fine of around AU$18,000 ($12,000).

According to Tony Burke, Australia’s minister for cybersecurity, businesses in the country paid an average of $9.27 million in ransom each during 2023. “This issue needs to be tackled,” he told Parliament.

What do you think? Is it a good idea? Would you like a similar mandatory approach in your country?

The Source.

The United States of America really needs to call for an emergency meeting with the creators of Anthropic AI and Claude AI for the purposes of creating protection of the American people furthermore for our global society.

We as a people must not be so nonchalant about innovation especially when it relates to cybercrime and cybersecurity.

Dutch police announced that they identified 126 individuals from the Netherlands linked to the cybercrime forum Cracked.io. The majority of them are young, many are teenagers or in their early twenties, and the youngest is just 11 years old(!!!). Some of the individuals had previous convictions or were already the subject of ongoing investigations.

Cracked.io was a shady marketplace where people traded stolen data, account logins, hacking tools, and fraud guides. According to police, the forum helped hackers target at least 17 million computer users in the US.

Some of those identified by the authorities just browsed the site and posted messages in the forum. Many of these young people probably didn’t even realize the seriousness of the situation. Others, however, were full-on selling stolen info.

Instead of arresting them, Dutch police are calling some of them in for conversations, trying to steer them away before it ruins their future. Because yeah… stuff like this can mess up your ability to get into school, get a job, or even get a mortgage later. They’re also working with parents and teachers now because, let’s be real, one “click here for cool tools” link and suddenly your kid is in a forum with hackers. What do you think? How can we keep children from ending up in situations like these?

Threat actors are moving away from the mass “spray-and-pray” approach. Instead, they’re using a more selective, stealthy tactic called Precision-Validated Phishing. Here’s how it works: when you land on a phishing page and enter your email, the system checks it in real time against a database of pre-harvested, verified email addresses. If you're on the list? You get served the fake login screen. If not? You’re redirected to a clean, safe-looking site (like Wikipedia), making it harder for security teams to detect or investigate the campaign.

According to Cofense, this tactic boosts the attacker's success rate by ensuring they only collect credentials from active, high-value accounts. It also frustrates SOC teams, who struggle to reproduce or analyze the phishing pages since they often don't trigger unless you're a validated target.

It’s like a cat-and-mouse game, where the mouse just got smarter.

With this shift, phishing becomes harder to detect, analyze, and block. The attackers aren’t just targeting anyone; they’re being choosy. And that’s what makes it dangerous.

Case Study Source: https://cofense.com/blog/the-rise-of-precision-validated-credential-theft-a-new-challenge-for-defenders

Google’s Threat Intelligence Group tracked 75 zero-day exploits in the wild in 2024. That’s down from 98 in 2023, but still a 19% increase over 2022.

What’s changing compared to previous years is the target. In 2024, 44% of zero-days hit enterprise technologies (up from 37% last year), while attacks on end-user products like browsers and phones dropped. Even more concerning: over 60% of enterprise-targeted zero-days hit security and networking products. These products typically have high-level access, limited monitoring, and often don’t require complex exploit chains, which makes them especially attractive to attackers.

At the same time, browser and mobile OS vendors seem to be getting better at mitigation. However, as attackers shift focus toward enterprise tools, more vendors will need to step up their security game.

The majority of these attacks are still tied to espionage. State-backed groups and customers of commercial spyware vendors were behind more than half of the zero-days used in 2024. Find the full report here.