Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Internal documents from late last year predicted that Meta would earn about 10% of its overall annual revenue ($16 billion) from fraudulent ads. Meta's automated system only bans advertisers if it is 95% certain that the ads are malicious. Otherwise, the advertisers are simply charged a higher rate. Documents also show that users who click on these scams or malicious ads are more likely to see them in the future.
A federal judge reaffirmed a non-custodial sentence for the engineer behind the massive Capital One breach, maintaining supervised release and restitution rather than prison time despite appeals arguing the punishment was too lenient.
Marks & Spencer faced a £136 million cleanup bill for a cyberattack, which hurt profits, as the retailer struggled with halted online operations and expensive recovery efforts, resulting in a drop of over 55%.
Nation-state attackers breached SonicWall's cloud backup, stealing firewall configs but no other data.
Sponsored
Threat actors don't need to break in anymore—they just log in. The Huntress Identity Security Assessment [4] shows you where. Start a Managed ITDR trial [4] and you'll get a FREE customized report for your Microsoft 365 tenant, INSTANTLY.
Researchers from Check Point have discovered four vulnerabilities that allow attackers to manipulate Teams messages. The vulnerabilities could allow attackers to edit Teams messages without leaving the “edited” label, alter message notifications so they appear to be from a different sender, change the display name inside private chats, and alter caller identities in video and audio calls.
A severe vulnerability in the widely used @react-native-community/cli npm package posed a high risk, allowing remote attackers to execute malicious OS commands on developers' machines running the React Native development server. Affecting millions and scoring 9.8 in severity, the flaw was patched in version 20.0.0.
Google identified PROMPTFLUX, an experimental malware, using a hardcoded Gemini API key to query Google's LLM with prompts for code obfuscation and AV evasion. It was able to self-modify and rewrite its source code to evade detection. Believed to be in testing by a financially-motivated actor, the malware includes a "Thinking Robot' that logs AI responses, persists via Windows Startup, and attempts propagation through drives and network shares, though it currently has no real attack capabilities. Security teams should monitor LLM-assisted malware like other variants, implement API key rotation, and be aware of threat actors bypassing AI safety via social engineering.
Device code phishing exploits OAuth 2.0's legitimate device authorization flow to steal access tokens by tricking victims into authenticating attacker-generated device codes, with Microsoft Azure allowing attackers to request powerful scopes (including Primary Refresh Tokens) through undocumented "Family of Client IDs" while Google severely restricts device flow to only YouTube and Google Drive scopes. Azure's implementation enables attackers to use legitimate Microsoft URLs and APIs throughout the entire attack chain without requiring client authentication, making phishing campaigns highly effective at bypassing MFA and gaining initial access with tokens scoped to Graph API, Intune enrollment, or other sensitive resources. Security teams should implement Conditional Access policies that restrict device code authentication, monitor suspicious device code flow usage patterns in Azure sign-in logs, educate users about the risks of entering codes from unsolicited communications, and consider Google's restrictive scope model as a defensive blueprint for limiting OAuth attack surface.
Amazon Bedrock provides a wizard for creating execution roles using the Agent Builder UI. The trust policy on the created role allows any agent in the account to assume the role by default via a wildcard aws:SourceArn condition. Users should ensure that this condition is scoped to their specific agent.
Deploying Mobile Device Management (MDM) solutions to developer endpoints often presents complications, as security tools are sometimes not well-suited to developer workflows. This leads to many organizations putting in extensive exemptions for developer endpoints, significantly weakening their security posture. This post advocates for a developer MDM that operates by injecting visibility using existing agents such as Zscaler and CrowdStrike.
Sponsored
SOC 2 and ISO 27001 shouldn't eat 40% of your team's time in 2026. Sprinto [11] uses Agentic AI to autonomously collect evidence, monitor risks, and keep you audit-read. Anaconda got compliant with Sprinto and closed a seven-figure deal within weeks. TLDR readers get $1,000 off [11] + an Ultrahuman Ring once you get compliant.
A compiled checklist of 300+ tips for protecting digital security and privacy.
Vega delivers AI-powered security analytics and operations. It streamlines SOC workflows by analyzing data in place, surfacing critical alerts, and automatically fixing coverage gaps and noisy rules for faster response.
Acunetix is a comprehensive web application vulnerability scanner that performs in-depth testing of modern, JavaScript-heavy apps, APIs, and traditional web platforms to identify issues such as SQL injection, XSS, and complex logic flaws, all with low false positives through automated verification. It seamlessly integrates into CI/CD pipelines to enable continuous security testing during development and offers compliance reporting for standards such as PCI DSS, HIPAA, GDPR, and OWASP Top 10. Security teams can utilize Acunetix for pre-production assessments, embed it into DevSecOps workflows for early testing, and leverage its API scanning capabilities to secure microservices and GraphQL endpoints that are often missed by traditional scanners.
Journalists discovered that location data from top EU officials was being sold by brokers, making it easy to track officials' movements, even with Europe's strict privacy laws. A leaked dataset revealed precise information on officials' whereabouts and highlighted weak enforcement against brokers.
Google Chrome now supports autofill for sensitive documents like passports and driver's licenses, with encryption and user consent. However, security experts warn that this centralizes critical identity data in a vulnerable location, contradicting cybersecurity advice against storing such info in browsers. Malware like Shuyal Stealer targets browser-stored credentials, and Chrome autofill data isn't stored securely. Security teams should advise against storing sensitive IDs in autofill, enforce policies to restrict this in workplaces, monitor for info-stealer malware, and recommend dedicated password managers with stronger encryption instead of browser storage.
The Aisuru botnet, with hundreds of thousands of compromised IoT devices and 30 Tbps DDoS power, manipulated Cloudflare's domain rankings by switching from Google's 8.8.8.8 DNS to Cloudflare's 1.1.1.1 in October. This caused malicious domains, mainly in the .su TLD, to outrank major companies like Amazon and Google due to massive DNS queries. The incident revealed vulnerabilities in trust-based domain ranking systems, which treat highly-ranked domains as trustworthy, and attackers used mainly US-based compromised devices from ISPs such as AT&T and Verizon. Security teams should monitor DNS connections to the .su TLD, block it if needed, and avoid relying solely on domain popularity for trust, as DNS query volume can be artificially inflated by botnets.
Sponsored
The market is in flux - with new vendors like StrongDM building platforms that focus on authorization, not just authentication, as the
A newly discovered critical flaw in Control Web Panel (CWP) lets remote attackers execute commands without authentication.
In a major international operation, law enforcement agencies have shut down a vast crypto fraud ring, arresting nine suspects accused of laundering €600 million.
Apple released unusually large security updates patching 105 vulnerabilities in macOS 26.1 and 56 in iOS/iPadOS 26.1.
Sponsored
Cybersecurity isn't just about ransomware, phishing, and attack paths. It's about the people, culture, and choices that happen when an attack strikes — often at the worst possible time.
Operation SkyCloak uses phishing emails with military document lures to deploy sophisticated backdoors targeting defense sectors in Russia and Belarus, establishing persistent access through legitimate OpenSSH services and customized Tor hidden services with obfs4 traffic obfuscation. The malware performs environmental checks to evade sandboxes, creates scheduled tasks for persistence, and enables remote access to critical Windows services (RDP, SSH, and SMB) through anonymous Tor addresses using pre-installed cryptographic keys. Security professionals should monitor for unusual scheduled tasks named after legitimate applications, implement network monitoring for Tor traffic patterns, and enhance email security controls to detect phishing campaigns using military-themed lures targeting defense organizations.
Investigators in India discovered a cybercrime ring that hacked into 80 CCTV dashboards across schools, hospitals, and homes and sold clips to an international porn fetish network. The attackers were able to access the dashboards because they used default passwords such as ‘admin123'.
Japanese publishing giant Nikkei, which owns international brands such as The Financial Times, reported that its Slack platform was breached. An account was breached via stolen credentials from an employee's computer. Messages sent by over 17K members of the Slack organization were stolen. Nikkei stated that no data related to confidential sources was available.
Effective security leaders understand that they must act like a business executive, not an IT manager, and must focus on creating a high-level strategy, master business-oriented communication, manage executive expectations, and proactively communicate successes and manage the maritime. Security leaders should also work at the team level to build resilient teams, develop scalable systems, prioritize areas that require more effort, take personal accountability, and engage with the professional community. This is part one of a 7 part series by Phil Venables on security leadership.
Kernel Address Space Layout Randomization (KASLR) on Android ARM64 devices can be completely bypassed without any exploits due to the Linux kernel's linear mapping being placed at a predictable virtual address (0xffffff8000000000) and Pixel phones loading the kernel at a static physical address (0x80010000). This allows attackers to calculate exact kernel virtual addresses for any data structure using simple arithmetic, effectively nullifying KASLR's protection against local kernel exploits on affected devices. The vulnerability stems from engineering decisions that prioritize memory hot-plugging support over security randomization, with both the Linux kernel team and Google considering this intended behavior and having no immediate plans for mitigation.
A new cybersecurity threat called SesameOp leverages the OpenAI Assistants API as a covert channel for command and control, allowing attackers to communicate with malware undetected. By embedding its communication within legitimate API traffic, SesameOp enables persistent access and remote control of compromised systems while evading traditional detection methods. It achieves this by leveraging obfuscated code, secure encryption, and creative misuse of built-in API functionality, rather than exploiting specific software vulnerabilities.
Sponsored
Join Huntress CEO and former NSA operator Kyle Hanslovan on November 13 at 11am ET as he breaks into a Microsoft 365 account to show you how hackers spin up believable phishing lures, scrape browser creds, and reuse other people's logins without breaking a sweat.
netVisor is an open-source network topology discovery and visualization tool that automatically scans networks to identify hosts, services, and their relationships, generating interactive documentation of network infrastructure. The tool employs a server-daemon architecture, where lightweight agents perform network scanning from multiple vantage points (supporting VLAN mapping) and report to a central PostgreSQL-backed server. This server generates visual topology maps, automatically detecting over 50 common services, including virtualization platforms, network infrastructure, and security tools. Security teams can leverage this for asset inventory, network segmentation validation, and maintaining up-to-date network documentation without the need for manual diagramming.
SlopGuard detects AI-hallucinated packages, typosquatting, and supply chain attacks with automated trust scoring. Zero maintenance, <3% false positives, and multi-ecosystem support
Neon Cyber protects organizations by embedding a browser extension on managed devices, providing real-time protection against phishing and insider threats. It delivers deep visibility into user actions in the browser, following threats and giving analysts a complete forensic context without adding user friction.
The SleepyDuck malware, disguised as a legitimate Solidity extension for Visual Studio Code, uses an innovative Ethereum smart contract-based command and control infrastructure to maintain persistent access even if primary servers are taken down. The malware activates when opening .sol files, connects to Ethereum RPC providers to communicate with contract address 0xDAfb81732db454DA238e9cFC9A9Fe5fb8e34c465, and polls for commands every 30 seconds while collecting system information and providing remote access capabilities. Security professionals should implement strict extension vetting processes, monitor network traffic for Ethereum RPC connections originating from development environments, and establish policies that require extensions to be sourced only from verified publishers with established reputations.
Three former cybersecurity incident response professionals from DigitalMint and Sygnia face federal indictment for allegedly operating as BlackCat/ALPHV ransomware affiliates, attacking five US organizations between May and November 2023 with ransom demands ranging from $300,000 to $10 million. The defendants exploited their insider positions as ransomware negotiators and incident response managers to gain unauthorized network access, steal data, deploy encryption malware, and demand cryptocurrency payments while only successfully extracting $1.27 million from one Tampa medical device manufacturer. Security teams should scrutinize third-party incident response providers and implement strict access controls. This case highlights the severe risk of insider threats when trusted security professionals abuse privileged access for financial gain.
MIT Sloan has withdrawn a paper claiming that over 80% of ransomware attacks are AI-driven following strong criticism by cybersecurity experts who found its claims unsubstantiated and its evidence lacking. Critics argued the research exaggerated AI's role in cyberattacks and pointed to possible conflicts of interest, causing MIT to promise an updated version.
Sponsored
INVICTI ASPM [23] brings all your tools together in one platform so teams see risk clearly and remediate faster.
Microsoft's emergency patch, KB5070881, for the actively exploited CVE-2025-59287 WSUS remote code execution vulnerability inadvertently disabled hotpatching on Windows Server 2025 systems, forcing affected organizations to choose between vulnerability remediation and zero-downtime patching capabilities until the corrected KB5070893 update or the January 2026 baseline becomes available.
Apple released iOS 26.1 and macOS Tahoe 26.1, patching over 100 vulnerabilities, including 19 WebKit browser engine flaws (many found by Google's Big Sleep AI).
The Apache Software Foundation has denied the Akira ransomware gang's claims of breaching Apache OpenOffice and stealing 23GB of employee information, financial data, and internal files.
Sponsored
Phishing has gone beyond email. Today's attackers use AI-generated voices, videos, and interactive deepfakes of company executives. They can fool almost anyone - including you and your coworkers.
CISA has added a 2024 use-after-free vulnerability to the known exploited vulnerabilities (KEV) list after it was observed being exploited by ransomware gangs. The vulnerability results from a decade-old flaw in the netfilter:nf_tables kernel component and can be abused by local attackers to escalate privileges to root.