Honeypots can help defenders, or damn them if implemented badly

Infosec In Brief reports that the UK NCSC validated the usefulness of cyber-deception when carefully implemented, warns of risks from misconfigured deception tools, and plans a service to help organizations; Ox Security disclosed that misconfigurations in AI IDEs (Cursor, AWS Bedrock) can allow unprivileged users or leaked tokens to incur massive costs; Spanish police arrested a suspect tied to the theft and online sale of 64 million personal records; Polish police detained three individuals suspected of traveling hacking activity after finding extensive hacking equipment; and CISA published its CWE Top 25 for 2025 with XSS ranked first.