Feed aggregator

COLUMBUS, Ohio (WCMH) -- Columbus has officially been chosen as the home of the 18th National Women’s Soccer League franchise. Excitement for the yet-to-be-named team has been building for weeks, and the announcement was filled with tears and cheers. “It’s just incredible and amazing to witness history,” said Lila Nelson, a freshman on the Bexley [...]

Security leaders warn the era of AI-driven bug hunting has arrived, with Mythos uncovering hundreds of overlooked vulnerabilities in code bases as trusted as Firefox. Are defenders ready for the avalanche of exploits and the frantic race to patch?

• A disgruntled developer discloses multiple Windows 0-days.
• Microsoft purchases its own bugs in massive campaign.
• VeraCrypt & Wireshark suddenly lost their dev accounts.
• A serious problem with re-captured domain names.
• How might AI help to secure open source repositories.
• A listener wonders what we thought of Project Hail Mary.
• Cyber security professionals tell us What Mythos Means

Show Notes - https://www.grc.com/sn/SN-1075-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit

Sponsors:

• canary.tools/twit - use code: TWIT
• joindeleteme.com/twit promo code TWIT
• hoxhunt.com/securitynow
• meter.com/securitynow
• zscaler.com/security

PIKETON, Ohio (WCMH) -- Ten years ago this week, eight people were killed while they slept in Pike County. Seven of the victims were members of the Rhoden family and the eighth was engaged to one of the Rhodens. The murders happened late on April 21 and into the morning of April 22 in 2016. [...]

COLUMBUS, Ohio (WCMH) -- New legislation in the Ohio Senate would make some significant updates to Ohio’s existing laws against child sex offenders. Senate Bill 393, sponsored by Ohio Sens. Jane Timken (R-Jackson Twp.) and Nathan Manning (R-North Ridgeville), would increase penalties for offenders based on the age of their victims and the amount of [...]

COLUMBUS, Ohio (WCMH) – There are two more weeks until the May 5 primary election, where voters will decide which candidates in several key races will move on to the November election, as well as weigh in on issues all over the state. Officials with the Franklin County Board of Elections noted the early voting process has been running smoothly, but they [...]

Clouds increase tonight, with rain showers and storms possible overnight into Wednesday morning. Expect more warm and wet weather coming.

DELAWARE, Ohio (WCMH) -- A truck driver that was indicted in a fatal Interstate 71 crash that killed a family and involved nine vehicles pleaded not guilty to all charges. Modou Ngom, 50, of Columbus, appeared in Delaware County court Tuesday afternoon and pleaded not guilty to all seven counts he is facing. He was [...]

COLUMBUS, Ohio (WCMH) -- Columbus could be welcoming a professional women's soccer team soon. A major announcement on the "future of soccer in Columbus" will take place at ScottsMiracle-Gro Field in the Arena District, according to the Columbus Crew. NBC4 will cover the announcement live on air on the free NBC4 Columbus streaming channel and [...]

COLUMBUS, Ohio (WCMH) – A 24/7 hotline that helps connect Ohio residents to human services such as food and housing assistance will soon be available across the state. On April 14, Gov. Mike DeWine announced a partnership between the Ohio 211 hotline and the state’s Department of Children and Youth to expand the call center’s [...]

A 24-year-old British national and senior member of the cybercrime group “Scattered Spider” has pleaded guilty to wire fraud conspiracy and aggravated identity theft. Tyler Robert Buchanan admitted his role in a series of text-message phishing attacks in the summer of 2022 that allowed the group to hack into at least a dozen major technology companies and steal tens of millions of dollars worth of cryptocurrency from investors.

Buchanan’s hacker handle “Tylerb” once graced a leaderboard in the English-language criminal hacking scene that tracked the most accomplished cyber thieves. Now in U.S. custody and awaiting sentencing, the Dundee, Scotland native is facing the possibility of more than 20 years in prison.

Two photos published in a Daily Mail story dated May 3, 2025 show Buchanan as a child (left) and as an adult being detained by airport authorities in Spain. “M&S” in this screenshot refers to Marks & Spencer, a major U.K. retail chain that suffered a ransomware attack last year at the hands of Scattered Spider.

Scattered Spider is the name given to a prolific English-speaking cybercrime group known for using social engineering tactics to break into companies and steal data for ransom, often impersonating employees or contractors to deceive IT help desks into granting access.

As part of his guilty plea, Buchanan admitted conspiring with other Scattered Spider members to launch tens of thousands of SMS-based phishing attacks in 2022 that led to intrusions at a number of technology companies, including Twilio, LastPass, DoorDash, and Mailchimp.

The group then used data stolen in those breaches to carry out SIM-swapping attacks that siphoned funds from individual cryptocurrency investors. In an unauthorized SIM-swap, crooks transfer the target’s phone number to a device they control and intercept any text messages or phone calls to the victim’s device — such as one-time passcodes for authentication and password reset links sent via SMS. The U.S. Justice Department said Buchanan admitted to stealing at least $8 million in virtual currency from individual victims throughout the United States.

FBI investigators tied Buchanan to the 2022 SMS phishing attacks after discovering the same username and email address was used to register numerous phishing domains seen in the campaign. The domain registrar NameCheap found that less than a month before the phishing spree, the account that registered those domains logged in from an Internet address in the U.K. FBI investigators said the Scottish police told them the address was leased to Buchanan throughout 2022.

As first reported by KrebsOnSecurity, Buchanan fled the United Kingdom in February 2023, after a rival cybercrime gang hired thugs to invade his home, assault his mother, and threaten to burn him with a blowtorch unless he gave up the keys to his cryptocurrency wallet. That same year, U.K. investigators found a device at Buchanan’s Scotland residence that included data stolen from SMS phishing victims and seed phrases from cryptocurrency theft victims.

Buchanan was arrested by Spanish authorities in June 2024 while trying to board a flight to Italy. He was extradited to the United States and has remained in U.S. federal custody since April 2025.

Buchanan is the second known Scattered Spider member to plead guilty. Noah Michael Urban, 21, of Palm Coast, Fla., was sentenced to 10 years in federal prison last year and ordered to pay $13 million in restitution. Three other alleged co-conspirators — Ahmed Hossam Eldin Elbadawy, 24, a.k.a. “AD,” of College Station, Texas; Evans Onyeaka Osiebo, 21, of Dallas, Texas; and Joel Martin Evans, 26, a.k.a. “joeleoli,” of Jacksonville, North Carolina – still face criminal charges.

Two other alleged Scattered Spider members will soon be tried in the United Kingdom. Owen Flowers, 18, and Thalha Jubair, 20, are facing charges related to the hacking and extortion of several large U.K. retailers, the London transit system, and healthcare providers in the United States. Both have pleaded not guilty, and their trial is slated to begin in June.

Investigators say the Scattered Spider suspects are part of a sprawling cybercriminal community online known as “The Com,” wherein hackers from different cliques boast publicly on Telegram and Discord about high-profile cyber thefts that almost invariably begin with social engineering — tricking people over the phone, email or SMS into giving away credentials that allow remote access to corporate internal networks.

One of the more popular SIM-swapping channels on Telegram has long maintained a leaderboard of the most rapacious SIM-swappers, indexed by their supposed conquests in stealing cryptocurrency. That leaderboard previously listed Buchanan’s hacker alias Tylerb at #65 (out of 100 hackers), with Urban’s moniker “Sosa” coming in at #24.

Buchanan’s sentencing hearing is scheduled for August 21, 2026. According to the Justice Department, he faces a statutory maximum sentence of 22 years in federal prison. However, any sentence the judge hands down in this case may be significantly tempered by a number of mitigating factors in the U.S. Sentencing Guidelines, including the defendant’s age, criminal history, time already served in U.S. custody, and the degree to which they cooperated with federal authorities.

DELAWARE, Ohio (WCMH) -- A former downtown Delaware restaurant space that housed a longtime local dining staple has been listed for sale, with an option for a new operator to lease the property. According to an online listing by Sokol & Associates, the building at 27 to 31 E. Winter St. was listed this month [...]

COLUMBUS, Ohio (WCMH) — Nearly 10 years after a man died in the doorway of his own home, Columbus police have made an arrest. On Dec. 17, 2016, Columbus officers responded to reports of an unresponsive person at a home on Duxberry Avenue, near the intersection of Billiter Boulevard in South Linden. Police arrived at [...]

COLUMBUS, Ohio (WCMH) — Emergency units have responded to a two-alarm fire in downtown Columbus Tuesday morning. According to the Columbus Division of Fire, a fire has been reported from the basement of a building on West Long Street, just near the North High Street intersection. The fire reportedly is located in a basement vault [...]

COLUMBUS, Ohio (WCMH) – Ohio State released the report on its investigation into former university president Ted Carter on Tuesday morning. An Ohio State representative said the 50-page report does not include any sanctions. Carter resigned suddenly on March 8 after a relationship came to light between him and Krisanthe Vlachos, a podcaster initially accused [...]

Robert J. Ruark, a Columbus man convicted of murder, is now at the center of a push for clemency as a new documentary, "My Name Is Robert Ruark," highlights his case and raises questions about Ohio's felony murder rule and the consequences of poor legal representation.

DUBLIN, Ohio (WCMH) -- A proposed $900 million mixed-use development near Ohio University's Dublin campus is drawing both interest and concern as it continues through the city's review process. Design firm NBBJ presented updated plans for the "Cosgray Commons" project to the Dublin Planning and Zoning Commission on April 16, marking the third review of [...]

SPRINGFIELD, Ohio (WCMH) -- Two of Ohio's representatives in Congress split from their party when legislation passed to protect temporary residence for thousands of Haitian immigrants. Reps. Mike Carey and Mike Turner were among 10 Republicans who joined Democrats last week in passing a House resolution to extend Temporary Protected Status (TPS) for Haitian migrants [...]

PIKETON, Ohio (WCMH) – Ten years after eight family members were found murdered in Pike County, one of their accused killers is still awaiting trial.  On the night of April 21, 2016, into the early morning of the next day, eight people in or associated with the Rhoden family were shot to death across four [...]

COLUMBUS, Ohio (WCMH) -- Gov. Mike DeWine has ordered U.S. and Ohio flags to be flown at half-staff. In honor of the life and service of former Ohio House of Representatives member William "Bill" Patmon, DeWine has ordered that the flags of the United States and the state of Ohio be flown at half-staff upon [...]