Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Microsoft launched Offline Mode for OneDrive Business customers in April 2024, which allows users to continue using the web version of OneDrive while offline. This works by downloading file metadata and running a SharePoint web server locally. This post introduces an update to the OneDriveExplorer, which can parse the cache used for offline mode.
Semgrep tested Claude Code with Sonnet 4 and OpenAI Codex with GPT5's ability to detect IDOR vulnerabilities in code with four levels of increasing difficulty, from no authorization to implicit authorization through middleware. In total, the models identified 15 real, previously unknown vulnerabilities and 93 false positives, with Sonnet 4 performing best. In its test with a generic prompt, Semgrep found that the models could detect some simpler IDOR vulnerabilities but failed in more complex cases.
Sponsored
Enterprise-grade security at an SMB-ready price point? Not impossible anymore: Microsoft's new Defender and Purview add-ons work at a scale
Cybersecurity insurer Coalition announced that it will start offering coverage for certain deepfake incidents, including those that lead to reputational harm.
Advent of Hacks is a GitHub repository with a list of free cybersecurity holiday events, CTFs, and Advent challenges.
Chrome Root Program and CA/Browser Forum adopted Ballots SC-080, SC-090, and SC-091 to sunset 11 legacy Domain Control Validation methods relying on email, phone, fax, postal mail, and reverse DNS lookups by March 2028, pushing Certificate Authorities toward automated, cryptographically verifiable ACME-based validation to prevent fraudulent certificate issuance.
Sponsored
Today's phishing attacks involve AI-generated voices, videos, and interactive deepfakes of company executives. They fool 99% of people.
A coordinated phishing campaign that ran from April to November targeted at least 18 US universities using approximately 70 domains and the Evilginx adversary-in-the-middle toolkit. Attackers sent personalized emails containing TinyURL-shortened links that impersonated university SSO portals to steal MFA-bypassing session cookies. UC Santa Cruz, UC Santa Barbara, University of San Diego, Virginia Commonwealth University, and University of Michigan were among the most heavily targeted. Recommended mitigations include adopting phishing-resistant MFA (FIDO2/WebAuthn) and monitoring unusual session cookie behavior.
Vitas Healthcare, the largest US for-profit hospice chain, reported that a compromised vendor account was used to access its systems from late September to late October, exposing data belonging to over 300,000 current and former patients. Exposed information includes contact details, identification numbers, Social Security numbers, medical and insurance data, and next-of-kin contacts. No ransomware group has claimed responsibility.
Ivanti disclosed a critical vulnerability in its Endpoint Manager (EPM) platform that allows unauthenticated attackers with access to the EPM web service to register fake endpoints and inject malicious JavaScript into the administrative dashboard. Ivanti also patched three additional high-severity vulnerabilities, including two that could enable unauthenticated remote code execution on arbitrary systems.
A security researcher released a Sysmon configuration tailored to detect Remote Monitoring and Management (RMM) tools listed in the LOLRMM framework. The rules cover process creation, file operations, network activity, and DNS queries, derived from behavioral analysis of RMM installers executed in VirusTotal, Hybrid-Analysis, and Any.run sandboxes. By capturing file paths, registry keys, and network indicators, the configuration helps security teams spot unauthorized RMM activity even when binaries are renamed or obfuscated.
The UK NCSC explains that prompt injection fundamentally differs from SQL injection because LLMs do not separate instructions from data, they simply predict tokens. As a result, techniques like parameterized queries cannot fully mitigate prompt injection. The agency recommends treating LLMs as "inherently confusable deputies" and implementing deterministic guardrails that constrain system actions outside of the model rather than relying on input filtering. Effective defenses include enforcing least privilege for LLM-driven workflows, closely monitoring tool and API usage, and acknowledging that prompt injection remains a residual architectural risk.
Risk-Based Alerting (RBA) allows analysts to combine multiple lower-fidelity alerts into a single higher-confidence incident by assigning risk scores to alerts that do not individually generate incidents. An incident is only created once a cumulative risk threshold is met. When assigning scores, teams should weigh potential impact, the criticality of the asset or user involved, and the confidence that the behavior reflects real malicious activity. This approach can reduce alert fatigue and improve triage efficiency.
Sponsored
Deepfakes are getting more sophisticated and now span voice, image, and video. Resemble AI's DETECT-3B Omni [13] gives security teams a way to fight back: this multimodal AI model was trained on 3 billion parameters to deliver unified deepfake protection across all content types, with a benchmark-beating 94-99% accuracy. Read the detailed
This tool provides a streamlined interface for searching proof-of-concept (PoC) exploit code associated with specific CVEs. Rather than serving as a vulnerability database, it aggregates and directs users to underlying PoC sources, making it useful for quickly locating exploit references for testing, validation, or workflow integration.
Imper.ai provides real-time detection and prevention of impersonation and social engineering attacks across video, voice, phone, and chat communications.
CrackFtp is a mass FTP checker and cracker designed to test login credentials and alert on successful logins to secure domains with Telegram notifications.
Twin brothers Muneeb and Sohaib Akhter, federal contractors previously convicted of hacking in 2015, were arrested for allegedly deleting nearly 100 government databases containing FOIA records and sensitive investigative files. After learning of their termination from Opexus, the pair allegedly used still-active credentials to access systems. Authorities say Muneeb also stole IRS tax records of 450 individuals and attempted to erase evidence via AI-assisted log deletion queries. The case underscores the need for immediate credential revocation on termination, rigorous vetting for privileged roles, and strong backup strategies.
Russian threat actor UTA0355 impersonated multiple prominent European security conferences, including the Belgrade Security Conference and Brussels Indo-Pacific Dialogue, to harvest Microsoft 365 credentials. The attackers created convincing replica websites and abused OAuth and Device Code authentication flows. They used rapport-building outreach on WhatsApp and Signal, leveraged compromised accounts for credibility, and selectively triggered credential theft based on targeted email domains. Defenses include user training on OAuth consent prompts, monitoring anomalous device registrations in Entra ID, and enforcing conditional access controls.
Security researchers report a 700% increase in ransomware attacks targeting hypervisors like Hyper-V and VMWare ESXi, with groups such as Akira leading the trend. Hypervisors often lack endpoint-style protections and offer attackers a control point over numerous VMs simultaneously. Attacks abuse built‑in tools to encrypt VM storage and misuse management utilities to disable protections.
Sponsored
With Blumira, you get FLAT-RATE, UNLIMITED INGESTION PRICING based on employee count, not data volume. Whether your team generates 100GB or
FinCEN reported $2.1 billion in ransomware payments across 4,194 incidents from 2022-2024, with 2024 showing a significant drop to $734 million following law enforcement disruptions of ALPHV/BlackCat and LockBit operations.
Google patched a Gemini Enterprise weakness that let attackers hide prompt-injection instructions inside shared Docs, Calendar events, or emails.
The US is offering up to $10 million for information on two key figures in the Iranian state-linked hacking outfit now called Shahid Shushtari, previously known by several front-company names.
Sponsored
Old-school firewalls are built for a perimeter that no longer exists. Work happening outside the corporate network is just a fact - but that doesn't mean you should give up on security.
Barts Health NHS Trust confirmed that the Cl0p ransomware group exfiltrated 241 GB of data from invoice databases after exploiting a vulnerability in Oracle E-Business Suite. The breach occurred in August but remained undetected until data surfaced on leak sites in November. Stolen data included patient billing information, former staff salary records, and supplier payment details. Clinical systems remained unaffected. Oracle has since patched the exploited flaw. The incident highlights the continued targeting of healthcare organizations through enterprise software vulnerabilities.
A newly disclosed XXE vulnerability, CVE-2025-66516, affects several Apache Tika components and allows attackers to embed malicious XFA content in PDFs, potentially exposing sensitive server files or enabling remote code execution. Upgrade all affected Tika modules ASAP.
Researchers have discovered two malicious extensions for VSCode that masquerade as a theme and an AI assistant, respectively, to drop infostealers. The extensions run a script that uses curl to download a malicious DLL, which executes as runtime.dll. The infostealers collect running processes, clipboard content, WiFi credentials, system information, screenshots, lists of installed programs, cookies from Chrome and Edge browsers, and cryptocurrency wallet passwords and credentials.
CISOs are increasingly adopting comprehensive offensive security programs as AI-enabled threats create more sophisticated attack patterns that traditional scanning cannot detect. OffSec maturity spans from basic vulnerability management through penetration testing to advanced threat hunting and security tool evasion testing. Automation and AI have lowered barriers to implementation. Offensive and defensive programs must work in concert rather than in isolation, with OffSec providing empirical risk validation and data-driven evidence for security investments.
Holiday shopping periods create compressed attack windows where bot-driven credential stuffing, account takeover, and automated fraud campaigns intensify against retail systems running at peak capacity with reduced staff. Layered defenses should include adaptive MFA for risky transactions, bot management with device fingerprinting, credential-stuffing detection, and blocking passwords against known breach datasets. Organizations should also test authentication failover procedures and implement strict third-party access controls, as vendor credential compromise remains a primary attack vector.
React2Shell is a critical remote code execution flaw in React Server Components and related Next.js setups that allows an attacker to send a crafted HTTP request to a server-side function endpoint and execute arbitrary code on the backend. Systems are especially at risk when using React Server Functions with the use server directive or default Next.js App Router configurations, which expose vulnerable endpoints even in otherwise standard apps. The issue affects multiple React server DOM packages and a wide range of Next.js 15 and 16 versions. Fixed versions are already available. Upgrading these components is the primary mitigation.
Sponsored
👋 Security teams: XBOW's Lightspeed on-demand pentest delivers expert-level, exploit-proven results in days -- _using the same attack-automation engine that climbed to #1 on the HackerOne leaderboards_. BOOK YOUR PENTEST [11] BY DEC 26TH AND THEY WILL
malcontent discovers supply-chain compromises through the magic of context, differential analysis, and 14k+ YARA rules.
Open Source Deep Packet Inspection Software Toolkit.
Resemble AI builds enterprise voice-AI tools for ultra-realistic voice generation, cloning, and deepfake detection to secure communications and prevent AI-enabled fraud and social engineering attacks in real time.
Researchers disclosed three Android malware families with enhanced capabilities: FvncBot targets Polish banking users with keylogging, web-inject attacks, and hidden VNC; SeedSnatcher steals cryptocurrency wallet seed phrases and 2FA codes via Telegram distribution; and an upgraded ClayRat enables full device takeover through accessibility services abuse. FvncBot uses the apk0day crypting service and session-based installation to bypass Android 13+ restrictions, while ClayRat spreads through 25 phishing domains impersonating YouTube and Russian taxi apps. Organizations should monitor for accessibility service abuse patterns and enforce sideloading restrictions to mitigate these threats.
Gartner analysts have urged organizations to block AI-enabled browsers, such as agentic and sidebar-based tools, because they send sensitive browsing data to cloud backends and can autonomously act within logged-in sessions, making them vulnerable to prompt injection, phishing, and credential abuse. They worry staff could automate mandatory tasks such as security training and misconfigure procurement or travel bookings, and have recommended strict risk assessments, tight controls, or outright bans for now.
Chrome's upcoming AI “agentic” features will act on users' behalf to complete tasks such as shopping or filling out forms, while also reducing security risks. It uses separate models to check that planned actions align with user goals and to vet URLs, limits what page data agents can read or modify, and asks for explicit permission before accessing sensitive sites, using passwords, or completing purchases.
Sponsored
Blumira is the SecOps platform for growing teams - combining AI, automation, and human expertise. Respond to threats in 30 minutes/wk.
Financial services, manufacturing, and healthcare were the most targeted sectors.
Portugal established a legal safe harbor for good-faith security researchers who identify and responsibly disclose vulnerabilities without seeking economic benefit, provided they report findings to system owners and the national cybersecurity authority within strict guidelines.
Sponsored
In this on-demand webinar, Nick Fohs, Sr. Manager of Enterprise Security & Systems at Reddit, provides an inside look at how Reddit was able to strengthen security without slowing employees down. The
You'll learn: