Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Microsoft alerts users to security vulnerabilities in Kubernetes stemming from default Helm charts that expose sensitive data, lack authentication, and use weak passwords, urging the need for thorough reviews and regular misconfiguration scans.
Sponsored
Protecting billions in assets isn't for everyone, but for those who accept the challenge, it can be the best work of your career. SEE OPEN
Who is Coinbase [4]? Here's what they say:
Socket found three malicious Go modules with hidden code that can download payloads to wipe a Linux system's primary disk (/dev/sda), making it unbootable. Attackers exploited the decentralized nature of the Go ecosystem and confusion around namespace validity to disguise malicious modules as legitimate. The payloads executed commands that wiped disks, causing irreversible data loss and severe disruptions for affected organizations.
Due to a security vulnerability, dating app Raw exposed users' personal data, including names and locations. Raw fixed the issue but hasn't committed to notifying affected users.
Harrods is the third major UK retailer facing cybersecurity issues in two weeks, following M&S and Co-op. The luxury store restricted internet access after unauthorized access attempts but kept stores open. While no organization has confirmed ransomware involvement, experts suggest Scattered Spider might be behind the attacks.
Daniel Card vibe-coded cybersecurity tools and educational games using AI (specifically GROK). These tools include a data visualization mapper for OSINT and attack surface mapping, SOC Chef (a collection of resources for security operations professionals), and an interactive timeline creation tool. He's also developed educational games like "Cyber Detective," "Attack the Net," and "Defend the Net" that demonstrate cybersecurity concepts from both attacker and defender perspectives, accomplishing in days what would have previously taken him weeks or months to develop.
Phishing-as-a-service toolkits allow criminals to bypass common multifactor authentication (MFA) through adversary-in-the-middle attacks. These tools create proxy servers that intercept credentials and MFA codes between victims and legitimate sites. While traditional MFA (one-time codes or push notifications) is vulnerable, WebAuthn-based authentication (passkeys) remains resistant because credentials are cryptographically bound to specific URLs and devices.
Slow Pisces is a North Korean hacking group primarily focused on generating revenue for the DPRK by targeting cryptocurrency organizations. A new campaign associated with Slow Pisces involves reaching out to cryptocurrency developers and directing them to a coding challenge that involves a malicious repository that downloads and runs a malicious C2 server. If the victim opts for a Python interview, the malware is launched via YAML deserialization, whereas if they opt for a JavaScript interview, the malware is loaded via ejs templates.
Sponsored
Black Duck addresses the strategic risks of AI-generated code with True Scale Application Security [13]. As a seven-year leader in the Gartner Magic Quadrant leader for Application Security Testing, Black Duck is the only choice for securing mission-critical software everywhere code happens. Discover how Black Duck delivers True Scale
LayerX provides AI-powered browser security to protect users from threats such as rogue extensions, gen-AI risks, data leakage, web threats and vulnerabilities, and more.
MCP for Security is a collection of Model Context Protocol servers for popular security tools like SQLMap, FFUF, NMAP, Masscan, and more. Integrate security testing and penetration testing into AI workflows.
b3acon is an email-based C2 server that uses an in-memory, dynamically compiled C# IMAP client via PowerShell.
The author found and reported leaked secrets by scanning thousands of public GitHub repos for deleted files containing sensitive information. Using automation, they restored deleted files, searched for exposed credentials, and analyzed the Git history to recover secrets. This approach uncovered common causes of secret leaks, such as a lack of Git knowledge and accidental commits of binary files containing sensitive data.
Microsoft is replacing passwords with passwordless options like passkeys for new accounts by default. The initiative features a redesigned sign-in process optimized for passkeys. While existing accounts can keep passwords, Microsoft reports nearly one million daily passkey registrations with a 98% sign-in success rate versus 32% for passwords.
An xAI employee leaked an API key on GitHub that allowed access to private AI models custom-built for Elon Musk's companies (SpaceX, Tesla, and X). The leak remained active for two months despite alerts. The exposed models included unreleased versions of Grok and specialized AI tools containing proprietary company data.
Microsoft is phasing out password autofill in Authenticator and moving users to Edge by August 2025.
Major security firms like Amazon, CrowdStrike, Google, and Palo Alto Networks report no disruptions in sharing threat intelligence with the federal government under President Trump.
iHeartMedia is offering credit monitoring and identity theft protection to individuals impacted by a data breach in December that exposed personal information such as Social Security numbers.
Sponsored
When the AI boom began, organizations raced to automate fastest and implement AI into every workflow.
about separating AI noise from reality. This session goes deeper than ever to reveal the cybersecurity realities behind AI's glamorous façade – and what your organization must know to stay safe and effective.
A security researcher discovered a vulnerability where Windows RDP would accept a revoked password without raising any alerts. This vulnerability occurs because when a user logs in using a Microsoft or Azure account, Windows validates the password and then caches it in an encrypted local storage, which is used for all further authentication attempts. Microsoft has responded that this is an intentional design decision to prevent users from getting locked out of a device.
Ascension, one of the largest private healthcare systems in the US, is notifying patients that their data was stolen in a breach in December 2024. Ascension stated that the breach was caused by them inadvertently disclosing data to a business partner which the attacker then stole the data from via a vulnerability in third-party software used by the business partner. The disclosed data includes names, addresses, phone numbers, email addresses, dates of birth, race, gender, and Social Security numbers.
Emera Inc. and Nova Scotia Power reported unauthorized access to their Canadian network. They have isolated the affected systems, engaged cybersecurity experts, and notified law enforcement. No disruption to power operations has occurred.
Ladybird browser has a bug that allows use-after-free exploitation via a constructor and a malicious handler. Attackers can manipulate the argument buffer to trigger a heap-use-after-free condition, leaking object addresses and potentially achieving code execution by overwriting return pointers. Exploiting this bug involves crafting memory structures to control the renderer and executing malicious code, which requires careful data and pointer manipulation within the browser environment.
This post describes a process for understanding a new data source and creating detections for malicious behaviors. The first steps involve reading the documentation to understand the service and brainstorming ideas for what a malicious user might do. Then, examine the logs to determine what is considered regular or anomalous behavior, often utilizing event counts. Finally, plan out what type of detection they will write, write the detection, and then test for success, failure, and edge cases.
Eddie Zhang vibe-hacked his way to discovering vulnerabilities in Open Game Panel, including a PHP type juggling authentication bypass and two local file inclusion flaws that enable remote code execution when chained with game configuration files. His "vibe hacking" approach combined AI tools with manual analysis, demonstrating both the potential and limitations of AI-assisted security research.
Sponsored
With Drata, GRC is a growth enabler. Automate governance, risk and compliance with access to 25+ frameworks & 300+ integrations. Eliminate manual security reviews and speed up vendor assessments. Build trust faster with real-time monitoring and AI-powered automation. Join leading companies like Superhuman, Notion and Kandji, who have transformed their GRC programs with Drata: schedule a live demo today [11].
Santa is a binary and file access authorization system for macOS. It consists of a system extension that monitors executions and file access to determine whether to allow or deny the execution.
Pistachio's platform can send simulations and scenarios to employees via email, Microsoft Teams, or Slack. It runs in the background to help them identify and respond to threats in real time. It also observes user behavior and learning patterns, adapting the security education accordingly.
A free, open-source, robust yet user-friendly, compact, and cross-platform tool for OpenPGP encryption. It stands out as an exceptional GUI frontend for the modern GnuPG (gpg).
This post walks through the various communications equipment that has been available to US Defense Secretary Pete Hegseth since the Obama administration. Hegseth initially would shift his chair to the back of his office to get a better Wi-Fi signal to use the Signal app but later requested a direct line to the public internet be run to a personal computer at his desk with Signal and another app for sending text messages installed. Hegseth also has access to SecDef Cables, which is a communications center dedicated to the office of the Secretary of Defense.
A new privilege escalation technique in Google Cloud Platform (GCP) exploits IAM Conditions and tagBindings to elevate access for attackers with low-risk roles. By attaching specific tags to resources, attackers can bypass restrictions and gain elevated privileges without directly modifying IAM policies. Organizations should prioritize securing tag permissions to prevent this overlooked escalation path in GCP.
WordPress' Security Team is not effectively fixing known security issues, lacking transparency and accountability. Despite claims of a large team, details about their members remain hidden. Some security issues, like SSRF vulnerability, have gone unaddressed for years without clear plans for resolution.
95–98% of AppSec alerts do not require action and may be harming organizations more than helping.
Scammers are posing as TAP Air Portugal in fraudulent emails to deceive victims into providing personal and financial information by offering fake refunds for flight issues linked to recent power outages in Spain and Portugal.
Apple has been ordered to pay Optis $502 million in a UK patent dispute over 4G technology used in iPhones and iPads.
Sponsored
Ever notice how "routine patching" somehow eats up entire weekends?
identifies outdated applications and handles everything for you.
The Co-operative Group, a major UK retailer, shut down some IT systems following attempted cyberattacks. While stores remain operational, back office and call center functions face disruption. The company has engaged the National Cyber Security Centre but hasn't disclosed if hackers successfully accessed systems or if customer data was compromised.
CloudSek's digital risk monitoring platform found a forum post selling root access to the Bangalore Water Supply and Sewage Board's database. This was traced to a publicly accessible .env file with plaintext MySQL credentials and an exposed Adminer interface. The database holds over 290,000 user records, including full name, phone number, address, Aadhaar number, and email address.
SonicWall has warned customers that several vulnerabilities which impact its Secure Mobile Access (SMA) appliances are being actively exploited. The vulnerabilities being exploited include various remote code injection and session hijacking attacks. SonicWall recommends that customers review their SMA devices to ensure no unauthorized logins and apply any available patches.
This post identifies four security components to address in MCP servers: agent to MCP communication, MCP to tool/server connectivity, the underlying supply chain, and securing the identity of the user and agent when talking to servers. For securing the agent to MCP communications, the post suggests an allowlist of LLM providers that an MCP can be integrated with. It also suggests utilizing existing security practices to secure MCP-to-tool communication and the supply chain, as well as using OAuth to ensure the identities of both the user and the agent.
Anthropic's March 2025 report details misuse of Claude, including an "influence-as-a-service" operation that orchestrates social media bot activities, credential stuffing targeting security cameras, recruitment fraud, and novice actors creating sophisticated malware. In response, Anthropic implemented advanced detection methods like Clio and hierarchical summarization to analyze conversation data and classifiers to screen user inputs and Claude's responses for harmful content, leading to the banning of accounts linked to violative activities.