US defense contractor settles whistleblower suit for $4.6M • The Register - Out of a possible 110 points, MORSE awarded itself 104. A third party assessment of the environment found a catastrophic score of (-)142, Yes, 246 points in the opposite (bad) direction. As part of the settlement, MORSE is handing back $4.6 million to the Feds, and $851,000 of that is going to the ex-employee who blew the whistle.
Signalgate storm brews up as journalist releases transcripts • The Register - All data is forever. If you send it, the recipient can maintain it. There are no disappearing communications.
CrushFTP CEO flames VulnCheck for assigning critical CVE • The Register - Not how you do it. CrushFTP didn’t
- Provide a timely public disclosure.
- Provide a unified reporting number (like CVE) to track discussions/searches/defenses
- Publicly attacked another vendor after they registered a CVE a week after the disclosure.
- Gave contradictory private and public statements, and put “real” fixes behind customer paywall.
- Recurring behavior: Crush refused to issue a CVE for previous critical bugs against its software.
Resecurity turns the table on BlackLock ransomware • The Register - bad guys make same security mistakes, end up burned.
UK threatens £100K-a-day fines under new cyber bill • The Register - You hate to see it, but money talks.
New npm attack poisons local packages with backdoors - Just stop writing code. Forever, in any language.
Dozens of solar inverter flaws could be exploited to attack power grids - Cloud Management sounds great, in the right hands, but in the wrong hands, terrible
Oracle
Experts doubt Oracle’s breach denial as inside data emerges • The Register Oracle plays coy on reported Cloud, Health security breaches • The Register Oracle under fire for its handling of separate security incidents | TechCrunch Oracle customers confirm data stolen in alleged cloud breach is valid Oracle Health reportedly warns of info leak • The Register
Since Oracle rubbished reports of a security breach, rose87168, the individual who claimed responsibility for the alleged intrusion and theft of approximately six million records – customer security keys, encrypted credentials, LDAP entries, and other data – sent a 10,000-line sample of the collection to Alon Gal, co-founder and CTO at security shop Hudson Rock. One customer, we’re told, said its users are in the sample set, and have access to sensitive information. Another concurred, claiming the data is legitimate and from a production environment though it dates back to 2023.A third Hudson Rock customer said their users and tenant IDs match those in the sample, and that they are used in their production environment.
“There has been no breach of Oracle Cloud,” Oracle said. “The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data.”
It’s claimed Oracle didn’t patch a known years-old hole in its own public-facing middleware on its own production SSO servers for its own cloud service, allowing someone to swoop in and grab sensitive customer data.
Meanwhile, Big Red reportedly told Oracle Health customers recently that patient data may have been taken by unknown online attackers. The biz is said to have sent a letter to some healthcare customers about an incident that occurred on or around February 20, 2025, in which stolen credentials were used to access customer data.
Citing multiple sources, the news site reported that a hacker is trying to extort affected hospitals, reportedly demanding millions of dollars. “My team was not able to access customers’ environments for a number of days. My concern is not just with patient data breach. Access through hosts allows any and all access to what is hosted, obviously,” said the employee. “Some customers host other applications like HR and finance. I don’t know if it was hacker[-]accessed though.”