Cybersecurity News: Chrome quantum-safe certificates, Gemini Live vulnerability, UK warns of Iranian cyberattacks

By
Sarah Lane
-

In today’s cybersecurity news…

Chrome unveils Quantum-Safe certificates

Google’s Chrome team is testing quantum-resistant HTTPS certificates to protect against future attacks by quantum computers. The initiative uses Merkle Tree Certificates, which replace traditional certificate chains with compact proofs, reducing TLS handshake data and integrating transparency into issuance. Chrome’s three-phase rollout began with feasibility testing alongside Cloudflare, with public deployment and a dedicated Quantum-resistant Root Store planned for 2027. (InfoSecurity)

Vulnerability allowed hijacking Gemini Live

In other Chrome news, a vulnerability allowed malicious extensions to hijack the browser’s Gemini Live AI assistant, giving attackers access to local files, camera, microphone, and other system resources. Exploitation required the declarativeNetRequests API, letting injected JavaScript manipulate the AI panel. The flaw was reported to Google back in October and patched in Chrome 143. Palo Alto Networks warns that hijacking such AI assistants can allow complex spying, phishing, or data exfiltration without user consent. (SecurityWeek)

UK warns of Iranian cyberattack risks

The UK’s National Cyber Security Centre (NCSC) warned British organizations of potential Iranian cyberattacks amid Middle-East tensions. State-sponsored and Iran-linked hackers are believed to retain some operational capability despite Iran’s ongoing internet blackout. The NCSC advised organizations with Middle-East supply chains or assets to review their attack surface, increase monitoring, and follow guidance on DDoS, phishing, and ICS-targeting threats. (BleepingComputer)

Alleged scam mastermind convicted

A German court sentenced Mikheil Biniashvili to 7.5 years in prison for leading a branch of the Milton Group investment scam network, which defrauded victims of about €8 million between 2017 and 2019 through fraudulent online trading platforms. Prosecutors said he also developed and sold proprietary scam software PumaTS, enabling copycat operations that caused an additional €42 million in losses worldwide. The court ordered €2.4 million confiscated, but the verdict can still be appealed. (The Record)

Huge thanks to our sponsor, Adaptive Security

This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Today’s phishing doesn’t just hit inboxes — it can sound like your CFO or look like your CEO on Zoom. AI voices, video, and deepfakes are turning trust into the attack surface. Adaptive fights back with AI-driven risk scoring, deepfake simulations featuring your own executives, and interactive training your team will actually remember. Take a three-minute tour or request a CEO deepfake demo at adaptivesecurity.com.

OpenClaw vulnerability hijacks AI agents

A vulnerability in the OpenClaw AI assistant let malicious websites hijack self-hosted agents without user interaction. Attackers could connect via localhost, brute-force passwords, and gain administrator privileges, enabling access to files, logs, Slack messages, and execution of commands across connected devices. The flaw relied on trusted localhost access and unthrottled password attempts. OpenClaw patched the issue within 24 hours, advising users to update to version 2026.2.25 or later. (SecurityWeek)

Memory scalpers hunt scarce DRAM

DataDome reports a bot campaign sending over 10 million scraping requests to e-commerce sites to track scarce DDR5 DRAM inventory, hitting product pages nearly six times more often than legitimate users and using cache-busting and AI tools to evade anti-bot defenses. The goal is to identify and quickly buy limited memory stock for profitable resale, worsening an existing shortage driven by AI and hyperscaler demand. Analysts expect DRAM prices to potentially double in Q1 2026, with supply constraints also impacting smaller cloud providers and entry-level device shipments. (The Register)

Microsoft license fraudster imprisoned

A Florida woman was sentenced to 22 months in prison and fined $50,000 for running a years-long scheme selling stolen Microsoft Certificate of Authenticity labels and extracted product keys. Prosecutors said she bought tens of thousands of genuine Windows and Office COA labels at discounted prices, then had employees manually extract and sell the license codes separately, wiring more than $5.1 million to a supplier between 2018 and 2023. Standalone sale of COA labels violates federal law because they must be distributed with licensed software or hardware. (BleepingComputer)

MSG data breach confirmed

Madison Square Garden confirmed a data breach tied to the 2025 Oracle E-Business Suite hacking campaign, in which the Cl0p gang exploited zero-day flaws to steal data from more than 100 organizations. Hackers allegedly took over 210GB of archive files from MSG’s third-party-hosted EBS instance in August 2025 and leaked the data after a ransom wasn’t paid. The company is notifying affected individuals, saying stolen information includes names and Social Security numbers, but the total number impacted is unclear. (SecurityWeek)