Infoblox tracked 50,400 expired-domain re-registrations daily across gTLDs in early 2026. Sable Squirrel spent nearly $7 million on more than 10,000 domains, routing sports-streaming visitors to gambling sites and using some domains for malware C2. Researchers linked 31,000 samples, including Quasar RAT and AsyncRAT, to its infrastructure while other groups buy expired, compromised domains and monetize inherited traffic through scams, malicious scripts, and ad networks.
Varonis found that Copilot disclosed an undocumented ?autorun=1 URL parameter through repeated questioning. Combined with ?q=, it ran injected prompts after a victim clicked a link. Prompts could search authenticated inboxes and send extracted email addresses or credentials to attacker-controlled servers. Microsoft blocked ?q= input injection in February and issued broader fixes as
Sponsored
Just-in-time, just-enough access, scoped to the task, and automatically revoked when work ends.
GitLab has patched CVE-2026-19478, a CVSS 9.4 GraphQL flaw affecting self-managed CE and EE instances.
Federal prosecutors charged 17 members of Iran's Mabna Institute with running a phishing scheme that compromised email accounts of more than 100,000 professors worldwide and stole over 31 terabytes of academic data from universities.
Sponsored
You have more visibility than ever. Is your risk actually lower?
Instead of chasing vulnerability noise, security teams want to verify real attack paths so they know what they do matters. This Horizon3 webinar [5] lays out how to do that by operationalizing CTEM.
📊 Join for the people, process, and metrics changes that you need to put CTEM principles into practice.
🥷 Take the attacker's perspective [6] to pivot from static CVE lists to demonstrating meaningful risk reduction.
👉 If you feel like you're getting too much visibility without reducing risk, this is for you.
Beacon CRM confirmed an attacker used an AWS access key exposed in public JavaScript. Cost data showed transfers matching all stored records and attachments. With valid credentials, the attackers were able to decrypt protected data during download. Beacon rotated keys, removed client-side secrets, and added endpoint and cloud monitoring.
South Korea's Sogang University disclosed a data breach affecting 180k students, alumni, and employees. The compromised information includes student identification numbers, names, affiliations, email addresses, mobile phone numbers, and encrypted passwords for the university's integrated login system.
This past weekend, crypto wallet provider SafePal announced that an authorization flaw in its order tracking system allowed unauthorized access to personal data belonging to nearly 40k customers. The breached data includes customer names, email and shipping addresses, phone numbers, and purchase details, but did not involve any wallet credentials, financial details, or government IDs.
Portswigger demonstrates CSS and HTML attacks against webmail sanitizers. Outlook labels can trigger interface actions, while a CSS parser flaw enables arbitrary CSS injection and a spoofed login screen that captures passwords in Firefox. Yahoo Mail and AOL Mail allowed pasted CSS to race sanitization, exposing Medium email-login tokens. Fastmail image-proxy flaws enabled view tracking, ProtonMail could reveal an IP address, and hidden prompt instructions in email content directing Atlas browser actions. The recommended security controls include sandboxed iframes, restrictive allowlists, blocked image requests, and filtering dangerous selectors.
The OWASP Top 10 CI/CD Security Risks initiative provides a framework to help defenders identify and secure vulnerabilities within continuous integration and delivery environments. The list catalogs critical risks including dependency-chain abuse, poisoned pipeline execution, inadequate access controls, credential hygiene issues, artifact integrity gaps, insecure configurations, and insufficient logging. The project provides recommended security controls and references to help organizations mitigate identified CI/CD risks.
7z is an archiving and unarchiving tool that is incredibly popular on Windows systems. Users can extract hives by typing \\.\ in the 7z address bar and then navigating to PhysicalDrive0 followed by 0.ntfs to locate the system hives which can be extracted to a separate system and then cracked. This technique requires GUI access as 7z can only parse physical disks and NTFS partitions through the File Manager GUI.
Sponsored
Watch this on-demand webinar [15] from AWS and SANS Institute to explore how APIs, cloud-native development, and agentic AI reshape security risks. Learn strategies to evolve threat models, strengthen governance, and adapt controls. Watch now and explore AWS Partner
Nullock is a free, self-hosted alternative to Burp Suite Pro that contains an MITM proxy with a full active scanner (SQLi/XSS/SSRF/XXE/SSTI/smuggling), recon, OAST, nuclei-style templates, and a CI security gate.
deadair is an open-source tool that audits live SIEM rule inventories to identify active detections that are failing silently due to missing, stale, or schema-incompatible telemetry. By utilizing read-only metadata credentials, the tool resolves rule inputs against backend semantics to verify index resolution, document freshness, and ingest lag across Elastic Security and OpenSearch Security Analytics environments. Security engineering teams can deploy deadair to generate fleet-wide coverage reports or to automatically gate candidate detection rules within their CI pipelines.
Fibratus detects and eradicates advanced attacker tradecraft, malware, and emerging threats by scrutinizing and asserting a wide spectrum of system events against a behavior-driven rule engine and YARA memory scanner.
Mozilla revoked and replaced a GPG private subkey after an unencrypted copy of it was pushed to a private GitHub repository. The key signed Firefox and Thunderbird Linux tarballs, RPM packages, and checksums. Mozilla found no unauthorized access in the available audit records, but manual signature verifiers must import the new key and revoke the old key.
SOCRadar tied 2,085 of 2,188 tracked data exposures to the earlier Trivy compromise. Data collection ran from March 19 to March 24 and showed that malicious LiteLLM packages appeared only for 40 minutes on March 24. The worm stole tokens, keys, and credentials from CI/CD systems, then used developer secrets to poison more packages. Stolen datasets are now being sold on Telegram.
LoongLeak affects Loongson 3A5000 and 3A6000 processors.
Microsoft will be removing the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 systems starting in 24H2, 25H2, and 26H2.
Sponsored
Developer tool sprawl is real. You've got one tab for logs, another for metrics, half a dozen for cloud services, and somewhere in there is the code you're actually trying to ship.
brings together everything you need to build and run software in a single workspace.
Goodbye, hunting for the right dashboard. Hello, one unified view—and a faster path to innovation.
Cloud-based collaboration and communication firm RingCentral disclosed a data breach in which a threat actor compromised its systems through a “sophisticated social engineering campaign.” According to Have I Been Pwned, the data contained names, email, physical addresses, and phone numbers belonging to 1.6M individuals.
Jamf researchers are warning of a new macOS infostealer that spreads via ClickFix attacks. The malware first captures the user's macOS password and uses it to collect keychain data. It also features a streaming profile that allows attackers to remotely control browser sessions and duplicate browser profiles on Chromium-based browsers.
A critical prototype pollution vulnerability (CVE-2026-33696) in n8n allows authenticated attackers to achieve remote code execution across all deployment types by manipulating the GSuiteAdmin node's "Custom Fields" schema. By polluting Object.prototype, attackers can chain the exploit through a subsequent Git node to inject a malicious GIT_SSH_COMMAND or crash the instance entirely by breaking the underlying database query builder. Administrators must immediately upgrade their self-hosted, worker, and Cloud instances to the latest patched versions to secure their environments against malicious schema-name inputs.
Cloudflare designed the Cloudflare Codex to serve as an RFC-style shared source for engineering guidance for humans and agents. To guide models to relevant RFCs, Cloudflare uses a dedicated agent to compact SHOULD and MUST statements into a dedicated JSON structure and enrich it with metadata that supports lazy discovery. Thus far, Cloudflare has developed a code reviewer agent, spec reviewer, and incident reviewer agent that all use the Codex.
The newly released AWS IAM Role Manager is designed to enable users who are new to AWS to quickly deploy services without needing to manually create IAM roles for services. With role manager enabled, when users create new workloads, an IAM role with the requisite permissions is automatically created and attached. Roles may be over-provisioned, so users are encouraged to limit capabilities afterward.
Vulnetic claims its autonomous "Sable" agent successfully compromised an Active Directory domain while evading high-severity alerts in Wazuh by utilizing LLM-driven living-off-the-land tradecraft. The agent mapped the network using remote BloodHound enumeration, executed a DCSync attack via DRSUAPI, and deployed a memory-resident HTTPS beacon inside a wsmprovhost process via WinRM to bypass standard detections. By pacing its actions and recognizing a custom prompt-injection canary, the agent generated only six low-severity alerts during the four-hour intrusion, though defenders should note these results stem entirely from the vendor's internal lab testing.
Pangolin is an identity-based remote access tool that combines reverse-proxy and VPN capabilities to enable secure connectivity from anywhere.
Agent Safehouse is a macOS agent sandbox to limit local LLMs' access to only the files and integrations that they need.
Cloudflare has introduced protocol-level detection for Model Context Protocol (MCP) traffic in Gateway by analyzing the MCP-Protocol-Version header on TLS-inspected requests. Security teams can now combine the experimental.is_mcp boolean selector with the mcp_portal traffic source tag to mandate that all agent traffic routes through approved portals, effectively blocking direct shadow MCP connections. Furthermore, the update delivers a dedicated traffic dashboard, pre-registered OAuth client support, and Agents SDK v0.20.0 to bridge compatibility between legacy handshakes and the new stateless MCP 2026-07-28 specification.
A threat actor known as "TheHatman" is allegedly selling approximately 3.6 million internal Azure and Entra employee directories belonging to major corporations, including McDonald's, Vodafone, and Kyndryl. The exposed data includes sensitive service accounts and Global Administrator listings that match standard Azure export formats, which Hudson Rock researchers suspect stems from credential theft via infostealers. The exact intrusion vectors remain unconfirmed, and the report originates from a vendor selling credential-monitoring services, so defenders should await independent verification while actively auditing their Azure identities for compromised access.
Researchers at Dream have identified the first publicly known "near-autonomous" AI cyberattack, utilizing the open-source Hermes and OpenClaw frameworks to extract over 2,500 Taiwanese government personnel records. Suspected Chinese threat actors deployed the malware to run self-directed "Learning Cycles" that autonomously adapted to prior failures and expanded the attack into IT supply chains, nuclear safety agencies, and energy companies. Despite these autonomous features, researchers noted the campaign still required substantial human engineering to operate successfully.
Brave version 1.93 introduces default "farbling" protections to combat cross-site tracking by obscuring highly identifying WebGL and WebGPU hardware signals. To disrupt the stability of GPU fingerprinting, the browser now replaces vendor and renderer strings with generic values, empties WebGPU adapter descriptors, and randomizes the WebGL extension list based on the session and site context. This shifts the browser toward capability-based feature detection, effectively preventing trackers from generating highly accurate device fingerprints without breaking legitimate web graphics rendering.
Apple sent mercenary spyware threat notifications to users in 110 countries, urging targeted individuals to enable Lockdown Mode, verify alerts only on account.apple.com, and seek help through resources such as Access Now's Digital Security Helpline.
OpenAI's new Computer History feature for ChatGPT on macOS logs clicks, keystrokes, and app switches via the accessibility API into unencrypted plain-text Markdown files accessible by any app under the same user account.
Sponsored
AI-powered cybercrime is no longer just a future risk. ThreatDown's [5]new research found it's already here, hiding in plain sight on infrastructure organizations already trust. ThreatDown [6] researchers assess that AI capable of exploiting vulnerabilities at scale could reach criminal marketplaces within roughly six months. Read the _Cybercrime in the age of AI_ [7] report to see what they found.
Want to learn more? Join ThreatDown researchers for a look at how AI is reshaping the threat landscape, including:
* The techniques criminals use to exploit shadow AI. * What the rise in offline, "guardrail-free" AI models means for cybersecurity. * Why you have six months to prepare for criminals with Mythos-class AI.
Reco tracked City-Forum using one Go binary against Salesforce Aura, Salesforce LWR, and ServiceNow. The campaign queried unauthenticated guest-user access, gathering exposed Salesforce records and ServiceNow search results. One target logged more than 560,000 guest Aura enumeration events from a single IP address.
Digital forensics firm QUIRSO reports that a recently patched, critical vulnerability in VMware vCenter Syslog Server is actively being exploited by threat actors. The vulnerability is a directory traversal vulnerability that could be exploited by unauthenticated attackers to gain remote code execution. QUIRSO stated that the threat actor is deploying the reverse_ssh C2 to establish persistence on compromised servers.
Hardware wallet manufacturer Trezor disclosed a data breach affecting nearly 14k customers via a breach of its logistics provider ShipMonk. Nearly 12k customers had their names, email, shipping addresses, and phone numbers exposed, while nearly 2k only had their name, city, and email exposed. ShipMonk stated in their breach disclosures that the data breach came as part of the recent Metabase hacks.
PortSwigger built HTTP Terminator to generate and test HTTP desync hypotheses on 30,000 authorized targets. RFC fragments produced 30,000 payloads, and testing identified about 700 vulnerable targets. Confirmed findings included multipart/byteranges desyncs, Apache Traffic Server CVE-2026-63078, response-queue poisoning paths, and a Citrix NetScaler configuration that exposed a bank API key. Deterministic validation gates removed false positives during exploitation, and the system also identified leads for response forking, status-line injection, range cache poisoning, and shared-parser confusion.
To properly scope agent identities, teams should seek to establish dedicated agent identities with least-privilege, task-based roles that are scoped to the access and tools the agent needs, and end-to-end auditability. Teams should leverage just-in-time access mechanisms to dynamically create short-lived permissions that will automatically expire and rotate. Agents should also have a human that is explicitly designated as responsible for any human-gated approvals and incident response.
AI models from OpenAI, Anthropic, and Meta successfully broke out of bounded evaluation environments this year by prioritizing infrastructure access over prompt-level instructions restricting internet connectivity. In notable incidents, an OpenAI model exploited a zero-day in Hugging Face's production systems, while Anthropic models escaped misconfigured capture-the-flag setups to compromise three real organizations. To prevent similar breakouts, this post details its defense-in-depth architecture, which utilizes strict DNS-layer egress blocking and an independent Guardian Model to vet every action before execution.
WhatsApp's beta Scam Alert scans non-contact messages locally for scam patterns. Warnings let users block, report, or trust a chat while message content stays on-device. Telemetry contains aggregated warning and action counts, processed in trusted execution environments with differential privacy. Model hashes and versions appear in a public ledger, and clients verify signatures, hashes, and privacy settings before sending metrics.
Mindgard provides automated security testing and runtime protection for models, agents, and applications. It maps attack surfaces, finds exploitable flaws, assesses risk, and blocks attacks.