Buckle up, Digital Defenders! 🛡️

Today’s stories point to a growing concern in cybersecurity: trusted systems behaving in untrustworthy ways. Whether it’s AI overriding shutdown commands or routers exposing hardcoded vulnerabilities, control is proving more fragile than expected.

Also, be sure to scroll down and weigh in: Do you regularly use in-flight wifi?

Here’s what you need to know:

Zero-Day Download

Meta’s AI Feed Exposes Users’ Personal Chats to Public View

Meta’s new AI app includes a “Discover” tab that surfaces user-submitted prompts to the public. This includes sensitive medical, legal, and personal information.

Source: Fast Company

Examples on the feed include queries about medical conditions, court filings, and intimate personal details, often linked to real names and Instagram profiles. Despite requiring a manual opt-in to share, many users are unaware that their conversations are public. 

If your organization uses Meta platforms for customer interaction or AI deployment, review privacy defaults and educate users about potential data leakage risks.

Sweden Hit by Record-Breaking DDoS Attacks Targeting State Infrastructure

Sweden is facing its largest-ever distributed denial-of-service (DDoS) attacks, with suspicion falling on Russian actors. The attacks have disrupted public broadcaster SVT, government websites, and critical services.

The wave of attacks temporarily knocked SVT’s news stations offline. It follows Sweden’s addition to NATO in 2024. Officials describe the campaign as an attempt to sow chaos and undermine institutional trust rather than steal data or extort. 

If you’re an entity in a NATO-aligned state, review your resilience plans, including mitigation strategies for service disruptions and coordinated cross-border response protocols.

Anubis Ransomware Adds File-Wiping Feature to Increase Damage and Pressure

The Anubis ransomware-as-a-service operation now includes a “wipe mode” that permanently destroys file contents. It renders recovery impossible even if victims pay the ransom.

Introduced via a new command-line parameter, the wiper feature erases data while leaving filenames and structure intact to increase psychological pressure on victims. Anubis campaigns typically begin with phishing emails and exclude core system directories to preserve device operability.

Remember to update phishing defenses and review incident response plans to address ransomware variants.

Share this newsletter!

Pulse Check

Would you ever use a public-facing AI assistant for sensitive topics
(e.g., legal, health, or personal finance)?

Yesterday's Pulse Check Results

How often do you actually check the CVE database for new threats?

Snackable Bytes

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

US and Canada on Alert as Iran Eyes Cyber Retaliation Beyond Middle East

Following Israeli strikes on Iranian nuclear and military sites, experts warn that Iran may launch retaliatory cyberattacks targeting US and allied infrastructure. 

Source: StateScoop

Analysts expect an uptick in disruptive operations (particularly wipers and ransomware) aimed at US water, energy, and transit systems, where small operators remain vulnerable. Iran’s CyberAv3ngers group previously breached American utilities using default credentials.

A note to US infrastructure operators: Strengthen your defenses and anticipate increased risk from ideologically motivated and state-aligned cyber actors.

Canada’s WestJet Hit by Cyberattack, Disrupting App and Internal Systems

Canada’s second-largest airline, WestJet, has confirmed a breach affecting its internal systems and mobile app. The breach limited access for users and prompted a coordinated response with law enforcement and Transport Canada.

Flight operations remain unaffected, but the airline warned customers and staff to be vigilant when sharing personal data. The incident follows recent cyberattacks on Nova Scotia Power and Air Canada, which have exposed critical infrastructure in Canada.

Aviation and infrastructure operators should bolster incident response readiness and reinforce user data protection protocols amid escalating national cyber risks.

46,000+ Grafana Servers Still Vulnerable to Critical Account Takeover Exploit

A major open redirect vulnerability (CVE-2025-4123) affecting Grafana remains unpatched in over 46,000 internet-facing instances. Attackers can trick users into loading malicious plugins that hijack sessions, reset credentials, or exploit SSRF capabilities.

The flaw, discovered by a bug bounty researcher and dubbed “The Grafana Ghost,” can be exploited client-side without elevated privileges. Despite a fix released May 21, roughly 36% of Grafana deployments remain at risk.

If your organization uses Grafana, immediately patch to secure versions and audit public endpoints to prevent large-scale exploitation.

AWS Security LIVE! at re:Inforce

Join AWS leaders and partners live from re:Inforce for real talk on security. Watch on Security LIVE!

Tune in today — 05:00–07:00 PT and 08:30–15:00 PT

Security Tip of the Day

Stop Letting Apps Broadcast Your Whereabouts

Recent breaches at Securus and LocationSmart revealed how telecoms sell your real-time location to third-party aggregators, often without consent. Once exposed, your movements can be tracked, leaked, or abused with little recourse.

Source: seatmaestro.com.

Here’s how to reduce your personal exposure:

Carriers profit from your coordinates. If you can’t stop the tracking, make the data less useful.

Meet Our Writers:

Greg Parker

Greg Parker is a cybersecurity and emerging tech writer who explores the intersection of digital risk, human behavior, and innovation across sensing and security technologies.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.