Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Wiz has launched a new site designed for security teams and cloud professionals to monitor significant vulnerabilities in cloud environments. It offers technology-based filtering options, features CISA KEV exploits, and includes high-profile CVEs with known exploits from the past 60 days.
Code to cloud promises to reduce the cognitive load of vulnerability management by providing the exact lines of code that need to change to remediate a finding. It can also aid security teams by helping them find the right person for a fix, understand how widespread a problem is, and aid in prioritization. Code to cloud can be achieved via customers manually linking source repos to container images, container tagging, or the provider ingesting all the data a customer provides and using data modeling to identify relationships.
SpyCloud's research shows that 66% of malware infections happen on devices with endpoint security. Although EDR tools have advanced, modern malware evades detection. SpyCloud integrates with EDR products to close the detection gap and defend against cyber threats.
Xanthorox AI is a new hacking tool circulating on the dark web that offers advanced capabilities for cyber operations. It uses custom-built language models and various modules for automated attacks. Experts recommend using AI-powered security solutions to detect and prevent such threats effectively.
Nine harmful VSCode extensions in Microsoft's marketplace secretly installed cryptominers, amassing over 300,000 installs and misleading users since April 4.
The US extradited fugitives from nine countries for crimes like running dark web markets and drug trafficking, including the Rydox marketplace brothers.
Noah Urban, a 20-year-old man, pleaded guilty to cybercrime charges for stealing cryptocurrency and personal information as part of the Scattered Spider group, which hacked organizations like Twilio and LastPass.
This Gartner report [4] provides critical guidance for navigating today's WAAP landscape, including:
Sponsored
Modern applications and APIs are fueling rapid digital transformation—but they're also expanding attack surfaces. As threats evolve, enterprises must rethink their web application and API
The Port of Seattle experienced a ransomware attack in August 2024 that disrupted its websites and phone systems, including Seattle-Tacoma International Airport. The breach affected the personal data of 90,000 individuals, prompting the Port to offer free credit monitoring and notify those impacted. The responsible group, Rhysida, has previously targeted multiple industries and organizations.
Oracle is warning customers that a hacker broke into a computing system twice in one month. Customer data, including login data, was stolen from a legacy environment that has not been used for eight years. However, customer log-in credentials from as recently as 2024 were stolen.
Researchers from Socket have discovered a malicious PyPi package called disgrasya. The tool abuses legitimate WooCommerce sites to validate cards using an attacker-controlled site masquerading as CyberSource. This package is particularly notable in that it does not abuse typosquatting or any other evasion technique but is instead overtly malicious.
Google launched a stable version of its model-signing library with NVIDIA and HiddenLayer to secure the machine learning supply chain. The library enables users to verify that a model used in an application is the one created by developers using digital signatures like those from Sigstore. This counters security threats from the multi-stage ML development (training, fine-tuning, and deployment), where malicious actors can tamper with models via weight alterations, backdoors, or code injection.
PowerUserAccess is a broad managed permission for AWS that explicitly restricts a user's access to some actions related to IAM, Organizations, and Account. Attackers can often accomplish one-time goals such as crypto mining or ransomware with PowerUserAccess but would require AdministratorAccess to establish persistence. However, in practice, attackers can often find an overly permissive resource to exploit to escalate privileges due to PowerUserAccess violating the principle of least privilege.
Signature verification and image signing enhance supply chain resiliency by ensuring image integrity. DataDog created a signing service for signing images to facilitate adoption across varied CI/CD processes that stored signatures in an OCI-compliant registry and verified these signatures. It managed signature verification during image pulls as a containerd plugin rather than through an admission webhook to prevent cluster-level dependencies in the Kubernetes control plane's hot path.
Google has launched Sec-Gemini v1, an experimental AI model that boosts cybersecurity. It merges advanced features with real-time knowledge, outperforming other models in key benchmarks. Sec-Gemini v1 empowers defenders with detailed threat analysis and vulnerability insights.
Enola is a Golang CLI tool that helps you find accounts by username across social media services.
Detectraptor is a repository to share detection content and queries for Velociraptor.
A researcher used ChatGPT-4o to quickly create a fake passport realistic enough to fool automated KYC systems. This raises concerns about the security of relying solely on photo-based verification methods. Experts suggest upgrading to digitally verified identity solutions to combat the growing threat of identity theft.
Microsoft has credited EncryptHub for uncovering Windows security flaws, highlighting a conflicted figure in cybersecurity and cybercrime. EncryptHub, or SkorikARI, was linked to multiple malware campaigns against high-value targets. Despite its technical skill, EncryptHub's inadequate security practices ultimately led to exposure and arrest during the Russo-Ukrainian war.
China's National Internet censor just announced new rules requiring all AI-generated content to include clearly visible or audible watermarks to indicate that it is AI-generated. Users can omit the label in some circumstances, but the AI generator must warn users of the requirement and log any requests to ignore it. These regulations will go into effect on September 1.
OpenAI is experimenting with a watermark feature for its Image Generation model in ChatGPT-4o to prevent unauthorized use of images.
The security report details a recent malware attack in which North Korean threat actors used fake recruitment emails from Dev.to to distribute BeaverTail and Tropidoor malware, which steals information, downloads additional payloads, and provides backdoor access.
International cybersecurity agencies, including the NSA and FBI, warn about the national security threat posed by Fast Flux, a technique used to hide malicious server locations.
Sponsored
Hackers have exploited the same psychological blind spots since the early Internet days. Our brains are hardwired to fall for these scams. Your team is vulnerable.
A vulnerability in Google's Quick Share (CVE-2024-10668) for Windows permitted unauthorized file transfers. The flaw, fixed in version 1.0.2002.2, could be exploited to bypass security and cause denial-of-service attacks.
A data leak at GenNomis, an AI image site, exposed explicit deepfake material, including images of minors and celebrities. This incident raises concerns about unmonitored AI-generated content and underlines the need for improved security measures and responsible AI development. Cybersecurity researcher Jeremiah Fowler emphasized the importance of detecting and preventing harmful deepfakes.
Researchers at the Berlin-based security startup thinkAwesome GmbH discovered a vulnerability in Unitree Go1 robot dogs. The robots include a service called CloudSail, which is a remote access tunnel service that was preinstalled on the devices. The researchers discovered that anyone with the default credentials and a specific API key could remotely control the robots and access their cameras.
Attackers use advanced techniques, such as memory manipulation, to evade detection via code injection. Tools like Volatility and MemProcFS help spot memory structure inconsistencies indicating malicious activity. Security professionals can identify indications of code injection and process manipulation by analyzing memory permissions and DLL loading behaviors.
There has been a surge in login scanning for Palo Alto Networks PAN-OS GlobalProtect portals, with about 24,000 unique IPs attempting access in the last 30 days. This coordinated effort may indicate a plan to discover and exploit vulnerabilities. Organizations should secure their login portals. The primary sources are the United States and Canada, reflecting patterns from a past espionage campaign targeting network devices and highlighting the need to monitor and secure critical systems.
Resource Control Policies (RCPs) were introduced by AWS in late 2024 to restrict access to resources within your AWS organization. RCPs should be used when trying to enforce consistent security standards in supported services, you're running out of SCPs, or you want to use the NotResource condition. SCPs should be used when you want to apply a policy to services that are not supported by RCPs or use the NotAction condition.
Sponsored
SaaS breaches surged 300% last year, with attackers breaching core systems in as little as 9 minutes. The 2025 SaaS Security Threat Report by Obsidian Security [14] draws from the largest SaaS breach data repository and direct involvement in +150 incidents, revealing important past trends - and what to watch out for in the future. Read
SolarWinds has launched a new incident response tool called Squadcast Incident Response. It has also improved its observability platform with AI-based updates to enhance IT operational resilience. These updates include AI-powered alert isolation, on-call management, and integrations with Microsoft Teams and Slack.
A CLI for querying multiple databases: JSON, Parquet, and CSV/TSV with SQL.
secureCodeBox is a Kubernetes-based, modularized toolchain for continuous security scans of your software projects.
Threat hunters have uncovered a web skimmer campaign that exploits Stripe's legacy API to validate stolen payment cards for attackers. The attackers target merchants by hiding the legitimate payment form and cloning buttons to efficiently steal card data. This operation uses malicious scripts on compromised sites and tailors the skimmer payload to each target.
Microsoft's AI tool has detected critical vulnerabilities in bootloaders like GRUB2 and U-boot that enable attackers to bypass Secure Boot and deploy persistent malware. These flaws significantly threaten enterprises, allowing malware to survive OS reinstallation. Organizations must prioritize patching affected systems and improving firmware and bootloader updates.
This blog series provides an explanation of how to conduct cryptographic reviews, a mapping of Signal, and an in depth look at Signal's symmetric-key authenticated encryption, Signal's use of double ratcheting protocols, key transparency, and other cryptographic features such as group messaging.
National Security Advisor Michael Walz has been reportedly using his personal Gmail to discuss sensitive military operations.
Sponsored
Agent-based scanners and legacy approaches have failed to keep up with real-world attacks, creating a false sense of security while missing exposures that are actively being exploited. And they fail to protect unmanageable and unknown assets…
A vulnerability in Verizon's Call Filter feature revealed the incoming call logs of certain customers due to an insecure API request. This issue was identified by a security researcher and was addressed by Verizon within a month. The flaw enabled unauthorized access to call histories, which could jeopardize user privacy.
A security flaw in Canon printer drivers, CVE-2025-1268, may allow hackers to run harmful code, compromising printing operations. This vulnerability affects specific Canon driver versions, enabling attackers to execute malicious code without user interaction. Canon is releasing patches, and users are urged to update their drivers promptly to mitigate exploitation risks.
File transfer software CrushFTP has warned users of a critical vulnerability that could lead to unauthorized access. Following a detailed write up by Project Discovery that included proof-of-concept exploit code, CISA and others are reporting that the vulnerability is being actively exploited. CrushFTP recommends enabling the DMZ zone feature if administrators cannot update the software right away.
Model Context Protocol (MCP) is an open standard that connects AI models and agentic applications to various data sources and tools. Standard MCP implementations do not include built-in approval, lack comprehensive prompt monitoring, and can require complex privilege management. This post provides reference architectures for exposing tools and creating secure and authenticated model interactions and general MCP security best practices.
The Browser Cache Smuggling attack enables attackers to drop malicious DLLs into a browser's cache, which can be moved to vulnerable directories such as Microsoft Teams' localappdata folder. Attacks use a DLL proxy technique to execute malware through legitimate applications while forwarding API calls to the original DLL. To defend against this, organizations should restrict scripting engines like PowerShell, avoid localappdata installations, configure browsers to clear their cache on exit, and set detection rules to alert when non-browser processes access cache files.
EvilCorp and RansomHub are cybercriminal groups linked through tactics and tools that pose a significant ransomware threat. EvilCorp, sanctioned since 2019, uses SocGholish malware for attacks, while RansomHub offers Ransomware as a Service (RaaS) operated by Russian-speaking actors. Their affiliation may result in sanctions on RansomHub, affecting victims, cyber insurance, and law enforcement actions.