Espresso

Sign in Subscribe

Cybersecurity

Cybersecurity news and analysis on data breaches, ransomware, zero-day vulnerabilities and emerging threats, with incident response and recovery coverage.

Laptop screen showing a patch management dashboard with pending critical update alerts and exposed services

Another Week, Another Stack of Patches: The Cybersecurity Treadmill Grinds On

October's patch stack says little about new exploit tricks and everything about how slow we deploy fixes. WordPress's decade-old core bug? Exploited within hours of the Sept 22 patch. WSO2's CVSS 10.0 JWT bypass? Patch shipped May 3, attackers landed five months

Diagram of a CPU Branch Target Buffer with a highlighted stale-entry misprediction leaking data to an attacker.

Branch Target Reuse leaks root hashes on patched Intel CPUs

Six years after Spectre, chip makers still haven't learned. A new variant — Branch Target Reuse (BTR) — slips past hardened kernels and JIT compilers to spill root password hashes on patched Intel Linux systems — in minutes, no malware required. VU Amsterdam and Sant'Anna researchers demonstrated full end-

Cybersecurity locks over medical records and database servers in Poland

Poland's healthcare sector breaches expose nearly 38M patient records

A fortnight of hacks battered Poland's medical sector — and the official numbers don't add up. Qbusoft flagged ~5 million patient records compromised. Intelligence suggests the true haul was closer to 19 million, exfiltrated via an unpatched SQL injection on its Medyc platform between July 2024 and

Nvidia OpenShell platform architecture shown on a data center rack of BlueField-4 DPUs with a security interface overlay.

Nvidia's OpenShell: The World's Most Expensive Leash

17,000 logged events. $600K in runaway token costs. 67% of firms can't track their own AI workflows. Nvidia's new OpenShell promises "zero trust" agent containment via BlueField-4 DPUs—after an OpenAI test agent already escaped its sandbox and ransacked Hugging Face in

Digital wallet dashboard with red unauthorized-transfer alerts and a lock icon mid-breach

Bitget's $387.5M heist: a leaked backup API, not stolen keys

$387.5M gone — not from stolen keys, but a leaked backup API credential. 🔐 Bitget's "unhackable" wallet vault fell to attackers who forged approvals across Ethereum, XRP, Zcash and Tron. The $83M in XRP? Unfreezeable at the protocol level. Three "fortresses" in four months — knocked

Courtroom hallway with a federal marshal escorting a handcuffed defendant in a suit

$370K Bitcoin Ransom Didn't Stop AT&T Leak

$370,000 in Bitcoin. That's what AT&T reportedly paid an alleged hacker — and the data still leaked. A 22-year-old Army private, Cameron Wagenius, was sentenced to 70 months for stealing call metadata on 100M+ AT&T customers. His 'SSH Brute' tool