Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
McDonald's Netherlands and TBWA\NEBOKO used digital billboards featuring popular menu items as passwords to spotlight how weak and predictable many online credentials are, as real leak data shows terms like “bigmac” and “frenchfries” are used tens of thousands of times.
Microsoft is now disabling NTLM by default in Windows 11 and Windows Server as the next step in deprecating the decades-old authentication protocol, which has been frequently exploited in relay attacks to gain full network access.
Unit 221B researchers warn that victims should refuse to pay or negotiate with the Scattered Lapsus ShinyHunters (SLSH) extortion group, whose tactics include swatting executives, threatening families, and manipulating media, as the Com-based gang's chaotic internal dynamics mean they cannot be trusted to honor any promises to delete stolen data.
MicroWorld Technologies confirmed unauthorized access to a regional eScan antivirus update server resulted in malicious updates distributed to customers during a two-hour window on January 20, deploying a modified "Reload.exe" file signed with what appears to be eScan's certificate. An analysis revealed the malware enabled persistence through scheduled tasks named "CorelDefrag", modified Windows HOSTS files to prevent legitimate updates, and connected to multiple C2 servers to download CONSCTLX.exe backdoor as the final payload. eScan isolated the compromised infrastructure within hours, rotated credentials, and released a remediation update for affected customers, though the company disputed claims about the discovery timeline and customer notification efforts.
A 2024 cyberattack on TriZetto Provider Solutions exposed protected health information and personal data for more than 700,000 patients across multiple US states, and the breach was not detected until nearly a year later. Oregon clinics are now notifying thousands of affected patients, while the owner, Cognizant, faces multiple class action lawsuits despite claiming the threat was swiftly contained and that no ransom was involved.
Aikido Security discovered a trojanized "ClawdBot Agent" VS Code extension impersonating the viral AI assistant Clawdbot, which deploys weaponized ConnectWise ScreenConnect software (Code.exe) configured to connect to attacker infrastructure. Microsoft quickly removed the extension after disclosure. The malware features a sophisticated multi-layered payload delivery. The attack demonstrates advanced evasion through functional AI features to avoid suspicion, process camouflage using legitimate VS Code executable names, DLL sideloading with anti-analysis timing checks, and quadruple impersonation layers that successfully weaponize trusted remote administration software.
AISLE's AI system discovered all 12 zero-day vulnerabilities in OpenSSL's January 2026 security release, marking the first real-world demonstration of AI-based vulnerability discovery at industrial scale. The findings span multiple subsystems and include vulnerabilities that remained undetected for up to 27 years, bringing AISLE's total to 13 of 14 CVE-2025-* vulnerabilities discovered in OpenSSL plus 5 genuine CVEs in curl. This achievement contrasts sharply with curl's cancellation of its bug bounty program due to overwhelming AI-generated spam, illustrating how AI simultaneously collapses median submission quality while raising the ceiling for sophisticated vulnerability discovery in critical infrastructure.
Russia's exclusion from the 2026 Winter Olympics removes critical geopolitical deterrents. The threat model has shifted from espionage to disruption, with potential attacks including destructive malware targeting operational technology, exploitation of Smart Road SS51 Alemagna's V2X infrastructure to hijack Variable Message Signs, and AI-amplified hybrid attacks combining cyber disruptions with high-fidelity deepfakes to transform technical outages into public safety crises. Defenders should prioritize zero-trust visibility with anomaly detection for IoT devices, implement micro-segmentation to prevent lateral movement from compromised edge devices, and deploy content provenance measures to verify legitimate communications against AI-generated content.
Kubernetes vulnerabilities can be divided into four key categories: pod weaknesses, identity and access mechanisms, cluster configuration components, and control plane entry points. This post provides a deep dive into several specific attack areas, including overly permissive RBAC, service account token abuse, malicious admissions controllers, writable volume mounts, unauthorized access to ETCD, and Kubernetes golden tickets. Each section includes an explanation of the attack vector, possible defenses, and a Falco rule to detect the attack.
Aisy provides an AI-assisted vulnerability management platform that maps infrastructure like an attacker, ingests tickets from existing tools, and surfaces chained, high-impact vulnerabilities so security teams can prioritize and remediate the most critical risks first.
SecObserve is an open source vulnerability management system for software development teams that supports a variety of open source vulnerability scanners. It integrates easily into CI/CD pipelines.
SysmonConfigPusher v2 is a web-based tool for managing Sysmon configurations across Windows endpoints using agentless or agent-based deployment.
At least 100 victims filed a class action lawsuit against xAI, alleging that Grok generated 4.4 million images over nine days, including at least 1.8 million non-consensual sexualized deepfakes of women, men, and children, posted publicly on X. The lawsuit claims that xAI executives knowingly failed to implement industry-standard safeguards and instead encouraged users to create "nudified" content through features such as tagging handles to manipulate photos and a "spicy" option for generating controversial content. The case adds to mounting legal pressure on xAI and Musk: 35 State Attorneys General have expressed "deep concern," and formal investigations have been opened by the EU, UK, South Korea, Canada, and Brazil, while US federal agencies remain silent.
Former Google software engineer Linwei Ding was convicted on seven counts of economic espionage and seven counts of trade secret theft for stealing over 2,000 pages of confidential AI materials between May 2022 and April 2023, including Google's AI supercomputing infrastructure, proprietary TPU/GPU systems, orchestration software, and SmartNIC networking technology. Ding is secretly affiliated with two China-based technology companies. He had a colleague scan his badge to falsely indicate his presence while traveling to China. The case highlights insider threat risks, as Ding stated his goal was to help China achieve computing infrastructure capabilities on par with international levels. Each conviction carries a maximum sentence of 10-15 years.
OpenClaw, a widely popular open-source AI agent, is rapidly gaining adoption across enterprises, integrating with email, messaging, and system tools, creating powerful non-human identities with broad access. Experts warn that its “vibe-coded” development, supply chain exposure, and susceptibility to prompt injection form a “lethal trifecta” of risk.
A 2017 confidential source told the FBI that Jeffrey Epstein employed an Italian hacker from Calabria who specialized in finding vulnerabilities in iOS, BlackBerry, and Firefox, developing and selling zero-day exploits and offensive cyber tools to multiple governments.
This report stages a Red Team vs Blue Team experiment between two autonomous agents to probe three key risks - Access, Exposure, and Agency - to understand how the agents work and think.
Automated data extortion attacks compromised approximately 1,400 misconfigured MongoDB instances accessible without authentication.
OpenSSL patched 12 vulnerabilities in its widely used cryptographic library, most of which involve memory safety and parsing weaknesses that can cause denial-of-service or data-integrity issues. Two critical stack-overflow bugs in CMS/PKCS#7 and PKCS#12 parsing can potentially enable remote code execution when handling untrusted data, making timely updates essential for organizations relying on OpenSSL 3.x.
CVE-2026-24858 is a critical authentication-bypass vulnerability (CVSS 9.8) that affects FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb. It allows attackers to log in to devices via FortiCloud SSO. The zero-day, added to CISA's KEV catalog, emerged after reports that the December CVE-2025-59718 patch was being bypassed, prompting Fortinet to temporarily disable FortiCloud SSO globally on January 26. Organizations should immediately upgrade affected products. FortiCloud SSO now blocks login attempts from vulnerable device versions.
Match Group has confirmed that a “limited amount of user data” was stolen after ShinyHunters claimed a breach of 1.7GB of stolen files allegedly containing 10M records. The attackers stole data after compromising an Okta SSO account, which gave them access to the company's AppsFlyer marketing analytics platform and to Google Drive and Dropbox accounts. The hackers stated that while the data contains some PII, it's mostly tracking data.
Swarmer is a low‑privilege tool that quietly edits Windows user registry hives without triggering common EDR hooks on standard registry APIs. Swarmer builds offline registry hives with Offreg.dll by abusing legacy mandatory user profiles and the NTUSER.MAN mechanism, enabling per‑user persistence that survives reboots while largely evading traditional monitoring. This post walks through the workflow, implementation quirks, operational caveats, and both defensive detection opportunities and attacker takeaways around this forgotten Windows feature set.
A security researcher discovered a critical Supabase misconfiguration in which an anonymous JWT embedded in client-side JavaScript granted read access to password_reset_tokens and 34 other tables due to missing Row Level Security (RLS) policies. The exposure of 272 password reset tokens and plaintext passwords enabled a full account takeover, demonstrating how publicly intended anonymous keys become dangerous when RLS is improperly configured. Security teams should audit Supabase deployments by enumerating REST endpoints with anon tokens and validating RLS enforcement across all exposed tables.
Trail of Bits collaborated with the Sigstore community to implement controlled cryptographic flexibility through predefined algorithm suites, avoiding the in-band signaling vulnerabilities that plagued systems like JWT while enabling organizations to select signing algorithms beyond the original hard-coded ECDSA P-256. The implementation includes a centralized algorithm registry in Protobuf specifications, configurable algorithm restrictions via --client-signing-algorithms flags in Rekor and Fulcio, and a new --signing-algorithm option in Cosign for ephemeral key generation. Go implementations of post-quantum algorithms, LMS, and ML-DSA were developed to validate that the architecture can accommodate future cryptographic standards.
Rein Security provides in-app runtime protection that baselines normal application behavior and blocks anomalous actions in real time, closing the production visibility gap for modern and AI-driven applications.
60 cybersecurity projects, certification roadmaps, and everything you need to build your cybersecurity portfolio
FridaC2MCP is an MCP server that exposes Frida's dynamic instrumentation capabilities as a remote server.
Jingliang Su, a Chinese national, was sentenced to 46 months in prison for his role in a Cambodia-based cryptocurrency investment scam that defrauded 174 Americans of $36.9 million through fake trading platforms and romance-based social engineering. The operation laundered stolen funds through US shell companies and offshore accounts before converting them to Tether cryptocurrency via Deltec Bank in the Bahamas. Su is one of nine defendants who pleaded guilty, and he was ordered to pay $26.8 million in restitution.
The MITRE ATT&CK framework can help SOC teams understand behaviors as opposed to isolated data points from alerts. SOC teams can also utilize SIEM tools that map detection rules to ATT&CK tactics to understand their detection coverage. This enables SOC teams to shift from chasing alerts to observing narratives.
Fintech data broker Marquis has pinned a major 2025 ransomware breach on firewall supplier SonicWall, claiming a SonicWall cloud backup hack exposed its firewall configurations and credentials. Hackers allegedly used this data to bypass defenses and steal sensitive US banking customer information, including Social Security numbers. Marquis is weighing legal and financial recoupment options, while SonicWall publicly disputes any proven link to broader ransomware campaigns.
Sponsored
Bots now dominate internet traffic, silently inflating infrastructure costs (>$5 million to unwanted origin hits, in a client's case). Hydrolix classifies humans vs bots in real time and stops abuse
The FBI has seized RAMP, a notorious Russian cybercrime forum used by ransomware groups and initial access brokers.
Wiz's new annual WIN Partner Index is a data-driven benchmark that analyzes adoption patterns across 240+ integrations to identify which cloud security integrations organizations rely on most, which are gaining traction fastest, and where teams see consistent value.
Researchers uncovered 175,000 exposed Ollama AI servers worldwide.
Sponsored
Misconfigurations and excessive privileges quietly chain together into routes attackers can use to reach your critical assets — and they don't wait. Attack Path Management (APM) shows identity risk the way adversaries see it, mapping relationships across identities, systems, and permissions so you can prioritize what truly matters.
Researchers from Koi discovered six zero-day vulnerabilities dubbed "PackageGate" across four major JavaScript package managers (npm, pnpm, vlt, and Bun) that bypass protections against script execution and lockfile integrity designed to prevent malicious code from running automatically. While pnpm, vlt, and Bun patched the flaws, npm (now owned by Microsoft) declined to fix the vulnerabilities, stating that the behavior "works as expected," leaving gaps in defenses adopted after the Shai-Hulud supply chain attack that affected over 25,000 repositories. The bypasses vary by tool—npm's weakness lies in Git dependencies with malicious .npmrc files, pnpm and vlt have lockfile gaps enabling tarball swapping, vlt has a tar extraction path traversal flaw, and Bun's trust allowlist can be spoofed—raising concerns about potential install-time code execution at scale even in hardened environments.
CVE-2026-24002 (CVSS 9.1) is a critical Pyodide sandbox escape vulnerability dubbed "Cellbreak" in Grist-Core that allows attackers to execute arbitrary OS commands or host-runtime JavaScript through malicious spreadsheet formulas. The flaw stems from Grist's blocklist-style sandbox approach that permits traversal through Python's class hierarchy and leaves ctypes available, enabling attackers to access database credentials, API keys, and sensitive files while creating lateral movement opportunities. The vulnerability was patched in version 1.7.9, released January 9, with users advised to update immediately or temporarily mitigate by setting GRIST_SANDBOX_FLAVOR to "gvisor," while avoiding the GRIST_PYODIDE_SKIP_DENO flag that reintroduces the risk.
Researchers from JFrog discovered two new vulnerabilities in the n8n workflow automation platform that could allow for RCE, one of which received a CVSS score of 9.9. The two vulnerabilities are AST sandbox escapes in both Python and JavaScript sandboxes that could allow for arbitrary code execution on the underlying nodes. The vulnerability has been fixed in the n8n cloud platform, but users running self-hosted versions should update to fix it.
Google detailed Android's evolution from password-based authentication to FIDO2 passkeys, starting with Universal Second Factor (U2F) in 2014 as a phishing-resistant second factor and advancing to passwordless passkeys built on WebAuthn and CTAP2 standards that use device biometrics, PINs, or patterns for authentication. Android announced FIDO2 specifications over USB with PIN support in November 2023, featuring streamlined user experiences with Material3 Design bottomsheets, Credential Manager APIs for easier developer integration, and secure PIN protocol algorithms that avoid storing actual PINs on devices or security keys. Google plans continued FIDO enhancements, including NFC support, native credential management for physical security keys, and post-quantum cryptographic algorithms to ensure passkey security remains robust against emerging threats like quantum computers.
The author of this post discovered a novel zero-day in QuickJS using Opus 4.5 and GPT-5.2. They set up a testbed in which the agents were tasked with achieving different objectives across systems with varying protections. The author succeeded in generating over 40 distinct exploits, including complex exploit chains. Experiments such as this demonstrate that tasks like exploit generation are increasingly solvable by LLMs with enough tokens.
Security researchers analyzed Command & Conquer: Generals' newly released source code and uncovered three major multiplayer flaws: a filename stack overflow, arbitrary file writes, and an out-of-bounds write during packet fragmentation. By chaining these bugs, they achieved reliable remote code execution, then built a self-spreading worm that drops a malicious DLL, hooks legacy Windows socket APIs, listens for “magic” packets or chat messages, executes OS commands, and manipulates local game actions such as camera and UI effects.
IDE-SHEPHERD is a free open-source security extension for VS Code and Cursor that addresses trust-based security model vulnerabilities by integrating into the Node.js runtime of the extension host process. The tool uses a require-in-the-middle layer to patch critical modules like child_process, http, and https, enabling real-time interception and blocking of malicious operations, including process execution, network communications, and workspace task execution against a growing ruleset. IDE-SHEPHERD provides granular per-extension behavior analysis rather than publisher-based trust, includes heuristic detection for suspicious extension metadata (wildcard activations, obfuscation, and missing repository links), and offers optional Datadog Agent integration for centralized monitoring while keeping all data local by default.
Aperture is an alpha-stage AI gateway that offers insights into coding agent usage within organizations. It eliminates the need to share API keys by using Tailscale's built-in identity system for authenticating users and machines. The tool supports CLI and VS Code-based AI coding agents such as Claude Code, Codex, and Gemini CLI, providing centralized monitoring of usage, cost tracking across different models and providers, and SIEM integration via S3 exports, all while linking API usage to specific users and devices. Aperture is free for up to three users, similar to Tailscale's Personal plan. It features an extensible platform, starting with a partnership with Oso to enhance security controls, alerts, and audits, with future plans to extend beyond coding agents to other AI workloads.
DumpBrowserSecrets is an improved version of the DumpChromeSecrets program that can extract browser-stored data such as refresh tokens, cookies, saved credentials, credit cards, autofill entries, browsing history, and bookmarks from modern Chromium-based and Gecko-based browsers.
The Sicarii ransomware, which emerged as a RaaS offering in December, contains a critical design flaw that makes decryption impossible even if victims pay, as the malware regenerates new RSA key pairs locally during each execution and discards the private key needed for recovery. The ransomware's suspicious "Israeli/Jewish" branding with Hebrew language and historical symbols appears to be a false flag, given its primarily Russian-language operations and machine-translated Hebrew content with errors. It was likely that inexperienced developers used AI-assisted tooling to create the poorly coded ransomware. Organizations affected are advised to abandon ransom negotiations and focus on alternate recovery pathways, including backups and incident response services.
Acting CISA director Madhu Gottumukkala, a Trump appointee, uploaded internal “for official use only” contracting documents to ChatGPT, triggering federal security alerts and a DHS review of potential damage. Officials had previously granted him a special exemption to use ChatGPT, even as other staff were barred. His tenure has already been controversial after an unsanctioned polygraph and suspensions of career staff.
A legitimate Microsoft Power BI email address is being abused to send fake $399 billing alerts that push victims to call a number and install remote-access tools, handing attackers control of their computers. Scammers exploit Power BI's subscription feature so messages come from a trusted Microsoft domain with no malicious links, bypassing filters until Microsoft temporarily disabled the abused feature.
Russian, Chinese, and financially motivated actors are abusing CVE-2025-8088 in outdated WinRAR to gain persistence via Windows Startup, delivering malware.
WhatsApp is rolling out Strict Account Settings, a one-tap lockdown that hides activity and profile details, blocks high-volume unknown messages, enforces two-step verification, and enables security alerts.