Some Virtual Reality (VR) technologies pose significant privacy risks by improperly collecting and sharing users' data. Yan Shvartzshnaider, an assistant professor in the Electrical Engineering and Computer Science Department at York University's Lassonde School of Engineering, is working to address virtual privacy concerns and develop cybersecurity solutions.

Researchers at the University of Alabama in Huntsville (UAH) are leading a NATO collaboration to address emerging security challenges posed by quantum technologies. Quantum computers use quantum phenomena to solve mathematical problems that conventional computers find difficult or intractable. Researchers have stressed that quantum computers will eventually be able to break many of today's public-key cryptosystems, thus putting digital communications at risk.

Thousands of GitLab servers are vulnerable to zero-click Account Takeover (ATO) attacks involving the exploitation of a critical vulnerability. GitLab recently released security updates to address two critical vulnerabilities that affect both the Community and Enterprise Edition. The most critical vulnerability, tracked as CVE-2023-7028 with a CVSS score of 10, enables ATO via Password Reset. Threat actors can use the flaw to hijack an account without user interaction. Most of the vulnerable servers are in the US (964), Germany (730), and Russia (721).

The US Securities and Exchange Commission (SEC) confirmed that a SIM swapping hack resulted in its X (Twitter) account getting hijacked. On January 9, hackers took control of the account and posted a false announcement claiming that the commission had approved Bitcoin futures Exchange-Traded Funds (ETFs). Due to the post, Bitcoin surged to a 19-month high before falling nearly 6 percent after SEC staff used Chair Gary Gensler's X account to reveal that the ETF announcement was false.

According to Ukraine's defense intelligence directorate (GUR), the pro-Ukraine hacker group called BO Team infiltrated the Russian State Research Center on Space Hydrometeorology, destroying its database and valuable equipment. The hackers claimed to have destroyed 280 servers and two petabytes of data, which included weather and satellite information, as well as unique research. GUR estimates that the lost data could cost Russia at least $10 million.

Security researchers at Menlo Security have observed a 198% increase in browser-based phishing attacks during the latter half of 2023 compared to the first half, with a 206% rise in evasive attacks.  Evasive attacks, designed to circumvent traditional security controls, now constitute 30% of all browser-based phishing assaults, according to the researchers.  These sophisticated tactics include SMS phishing, Adversary in the Middle (AITM) frameworks, image-based phishing, brand impersonation, and Multi-Factor Authentication (MFA) bypass.

An unsecured database exposed 1.3 million records, including COVID test results and other Personally Identifiable Information (PII). According to a researcher at vpnMentor, the database had documents bearing the name and logo of Coronalab.eu, which is owned by Microbe & Lab, an Amsterdam-based medical laboratory. The 1.3 million exposed records include 118,441 certificates, 506,663 appointments, 660,173 testing samples, and more.

Proof-of-Concept (PoC) exploit code for a critical vulnerability, tracked as CVE-2024-0204, in Fortra's GoAnywhere Managed File Transfer (MFT) solution has been made public, raising concerns that attackers will soon exploit it. Organizations of various sizes widely use Fortra's GoAnywhere MFT solution. In early 2023, the Cl0P ransomware gang used a zero-day vulnerability, tracked as CVE-2023-0669, in the same solution to exfiltrate data from more than 130 victim organizations. Following the exfiltration, the group threatened to publish the data unless they were paid not to.

Threat actors with a Google account could exploit a loophole impacting Google Kubernetes Engine (GKE) to take over a Kubernetes cluster. The flaw has been dubbed "Sys:All" by the cloud security company Orca. About 250,000 active GKE clusters in the wild are said to be vulnerable to the attack vector. According to security researcher Ofir Yakobi, there is a common misconception that the system:authenticated group in GKE only includes verified and deterministic identities. However, it includes any Google-authenticated account, even those from outside the organization.