Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
A coordinated malware campaign on YouTube, known as the Ghost Network, exploited hijacked accounts to post fake tutorials promising cracked software and gaming cheats. These videos lured users into downloading infostealers, which stole credentials and crypto wallets. The operation relied on fake engagement and resilient tactics, leading Google and Check Point to remove over 3,000 malicious videos in a major crackdown.
AI code generation enables rapid, large-scale software creation, but speed and flawed judgment are the real risks. While AI-made code has vulnerability rates similar to human work, issues like ineffective coding practices and skipped reviews mean more exposure to breaches, so experts urge integrating security directly into AI workflows and cultivating best usage practices.
Sponsored
You can think of CMMC as the DoD's new standard cybersecurity background check for its supply chain. The new rule will require stricter verification for contractor security standards. Read the
Microsoft's new Gaming Copilot, built on Recall-like Copilot Vision technology, is being silently deployed to Windows 11 PCs without user consent or onboarding.
Sponsored
Most PAM vendors started with password vaults and bolted on cloud connectors. StrongDM was built differently [4]: a universal access platform that treats authorization, not authentication, as the primary control plane.
CVE-2025-62518 is a high-severity boundary-parsing vulnerability (CVSS 8.1) in the abandoned async-tar Rust library that allows remote code execution through file overwriting. The flaw affects critical tools, including the uv package manager, tokio-tar (5+ million downloads), and multiple widely-used forks. The issue highlights the open-source abandonware crisis, where unmaintained code is repeatedly forked, spreading bugs across ecosystems with limited visibility and patchability. Security teams should audit dependencies for async-tar and related forks (tokio-tar, testcontainers, wasmCloud), apply available patches, and establish processes to track abandoned dependencies.
TP-Link has issued a warning about two command injection vulnerabilities in Omada gateway devices that could allow attackers to execute arbitrary OS commands. One of the flaws has a critical severity rating (CVSS 9.3) and can be exploited by unauthenticated attackers, while the second requires access to the web management interface. TP-Link also disclosed two additional vulnerabilities in a separate bulletin that could allow command injection and root access.
Researchers from ANY.RUN identified a new phishing campaign using SVG attachments as lures, dubbed the Typical phishing kit or Tykit. The malicious SVG distracts users while embedded JavaScript redirects the victim to a “trampoline” page, which then leads to a phishing site mimicking the Microsoft 365 login page. ANY.RUN believes this campaign is operated by a Phishing-as-a-Service (PhaaS) operator.
Trail of Bits discovered argument injection vulnerabilities across three popular AI agent platforms that allow attackers to bypass human approval safeguards and achieve remote code execution. The flaw exploits pre-approved “safe commands” such as git, find, and ripgrep through malicious flag combinations (e.g., git show --format to write files, fd -x=python3 for execution, or go test -exec to run arbitrary code). These one-shot prompt-injections can be embedded in code comments, GitHub repositories, or logs. Researchers note that maintaining allowlists of “safe commands” without sandboxing is fundamentally insecure, as flag filtering is impractical. Security teams should use container-based sandboxing, use argument separators (--), drastically reduce allowlists, and audit against GTFOBINS/LOLBINS for potential abuse.
British Airways offers free “messaging” WiFi to frequent flyer members, limited to whitelisted messaging app domains via SNI (Server Name Indication) filtering in TLS handshakes. By simulating traffic to approved domains, researchers found they could tunnel general web activity through the free tier. The method relies on customizing TLS connections and proxying traffic, demonstrating how SNI leaks destination domains even when content is encrypted and how service restrictions can be bypassed with technical knowledge.
Many organizations overlook mobile security, leaving them exposed as employees transmit attacks from personal devices. Smishing has become more effective than email phishing, with up to half of users failing simulated tests. Despite the availability of strong mobile defenses, most organizations fail to adopt them, leading to increased breach risk, downtime, and regulatory consequences.
Sponsored
Uncontrolled data equals uncontrolled risk. BENlabs deployed Onna to protect against litigation costs and infosec vulnerabilities hiding in Slack. The result: proactive discovery, predictable costs, and stronger compliance. Onna gives teams the confidence to scale without fear of legal or security fallout.
Imhex is a modern, high-performance hex editor for reverse engineers and programmers. It features a visually optimized interface, data pattern analysis, and powerful scripting capabilities.
Gravwell is an enterprise analytics and security platform that helps teams centralize logs, accelerate threat hunting, and analyze data from both IT and OT environments.
Wiz has open-sourced HoneyBee, an automation framework that rapidly deploys realistic honeypots by generating intentionally misconfigured Dockerfiles and Docker Compose manifests for popular cloud apps. Each honeypot can include AI-generated misconfigurations, Nuclei validation templates, and optional tcpdump monitoring. Using HoneyBee, Wiz researchers discovered cryptomining campaigns targeting exposed Java Debug Wire Protocol (JDWP) and PostgreSQL, capturing complete attack chains, from XMRig deployment to fileless persistence within hours. Honeybee supports three key use cases: validating detection rules safely, orchestrating honeypot networks with SIEM/CSPM integration, and creating hands-on training environments that mirror real-world misconfigurations
Chinese organized crime groups have generated over $1 billion in just three years through a large-scale SMS scam operation targeting Americans with fake toll, postage, and government refund messages. The campaign has surged 350% since January 2024, with a record 330,000 scam texts reported in a single day. The operation uses US-based SIM farms to send messages, steals credit card data, and bypasses MFA by adding stolen cards to mobile wallets (which banks often trust after first use). The groups also employ 400-500 gig workers and money mules recruited via Telegram to buy and resell high-value goods and gift cards for laundering. Security teams should educate users to avoid unsolicited payment messages, verify messages through official channels, tighten device trust policies for mobile wallets, monitor gift card purchases, and deploy anti-malware solutions with web protection and scam detection capabilities.
Datadog's 2025 State of Cloud Security report shows progress alongside persistent gaps across AWS, Azure, and Google Cloud. IMDSv2 enforcement has increased to 49% of EC2 instances, and federated authentication adoption now covers 79% of organizations. However, 59% of AWS IAM users still have access keys older than one year, and nearly one in five EC2 instances remain overprivileged. While data perimeter adoption and public access blocking have improved, insecure defaults and lingering legacy practices continue to expose organizations to risk.
Jaguar Land Rover suffered one of the most expensive cyberattacks in UK history, disrupting production for weeks and affecting over 5,000 organizations. The attack is estimated to have cost at least £1.9 billion in damages and triggered significant supply chain and operational fallout. Government agencies intervened to assist in recovery, but full restoration of systems remains ongoing.
Sponsored
Discover how attackers “call home” through your outbound traffic—and how you can stop them before they do real damage. Read
The bipartisan Foreign Robocall Elimination Act has passed the Senate Commerce Committee, establishing an FCC-led task force to investigate overseas robocalling operations, recommend countermeasures, and evaluate the effectiveness of STIR/SHAKEN caller authentication protocols.
The Shadowserver Foundation has identified over 266,000 internet-exposed F5 BIG-IP instances, nearly half located in the United States.
Sponsored
IT teams face an uphill battle to secure their company's SaaS apps. There's dealing with on/offboarding, going through access reviews, and manually managing permissions for every app that's not behind SSO. And that's just for the apps you _know about_. So how can you manage the chaos and finally get full visibility [4] over your SaaS ecosystem?
A critical vulnerability in WatchGuard Firebox devices running certain Fireware OS versions puts over 73,000 network firewalls at risk of unauthenticated remote code execution. Despite patches being released in September, tens of thousands of devices remain unpatched, with the largest concentrations in the US and Europe.
A ransomware attack on logistics partner Askul forced Japanese retailer Muji to suspend online orders, affecting customers and disrupting services. With Askul's systems nearly paralyzed, many functions, including shipments and customer support, are down. No ransomware group has claimed responsibility.
Researchers from Google's Project Zero discovered a vulnerability in Dolby's Unified Decoder that could lead to remote code execution. Dolby Decoder is used by Android to locally decode all audio messages and attachments. The vulnerability is caused by a buffer overflow.
ClickFix attacks trick users into copying and pasting malicious commands from fake CAPTCHA prompts in web browsers, which are then executed locally on their devices, with attacks spreading primarily through SEO poisoning and malvertising rather than email. These attacks exploit three key weaknesses: users lack awareness training for copy-paste threats, detection evasion techniques bypass email scanners and web proxies by using non-email delivery vectors and heavily obfuscated code, and EDR becomes the sole defense layer since malicious clipboard actions occur within the browser sandbox, invisible to traditional security tools. Security professionals should implement browser-based detection for malicious copy-paste operations, enhance user training to recognize fake CAPTCHA prompts, and deploy comprehensive endpoint monitoring since EDR remains the only reliable detection point after users execute the commands.
Linux capabilities enable fine-grained privilege management by dividing root powers into independent units, but attackers can abuse this by setting capabilities like cap_setuid on binaries (e.g., Python) to create stealthy backdoors without traditional SUID bits. Security teams should expand privilege escalation hunting beyond SUID/SGID files to include capability-enabled binaries using getcap -r / and monitor for setcap usage, as capabilities are stored in file inodes under security.capability attributes invisible to standard ls commands. Tools like LinPEAS and Elastic's detection rule for setcap utility usage help identify suspicious capability assignments, while getfattr can reveal hidden extended attributes that getcap decodes into human-readable capability flags.
Microsoft 365 Copilot was vulnerable to a security flaw that allowed sensitive business data, like recent emails, to be exfiltrated using specially crafted documents. Attackers could embed hidden instructions and a fake login button, which used Mermaid diagrams to send encoded company data to servers under their control if a user clicked the button. Microsoft fixed the vulnerability by disabling interactions with dynamic Mermaid diagram content, effectively closing this exfiltration route.
Sponsored
Doxxing. Deepfakes. Targeted harassment. Executives are prime targets for cyber and physical attacks—are you equipped to protect them? Read _The Complete Guide to OSINT for Executive Protection_ [11] to learn how to Identify and neutralize digital threats before they escalate, set up real-time alerts, and use AI-powered analysis.
Terra Security offers an agentic-AI-powered continuous penetration testing platform that deploys swarms of AI agents to simulate real-world attacks, providing tailored and scalable vulnerability assessments so organizations can address risks before attackers exploit them.
Hunt down social media accounts by username across social networks.
Spotter is a security scanner that uses CEL-based rules to identify security issues in Kubernetes clusters.
Network edge devices like firewalls, VPNs, and email gateways have become major security liabilities, with nearly one in three of the 75 zero-day vulnerabilities tracked by Google in 2024 targeting these appliances. The exploited vulnerabilities consist primarily of basic 1990s-era flaws such as buffer overflows, command injections, and SQL injections—vulnerability classes that have well-established prevention and detection controls, yet persist in security vendors' mission-critical codebases. Security professionals should prioritize patching network appliances immediately when vulnerabilities are disclosed, implement comprehensive logging and monitoring for edge devices, and pressure vendors to adopt modern secure development practices, including memory-safe languages and rigorous code auditing.
The Com hacking collective leaked personal information of hundreds of US government employees, including 680 DHS officials, over 170 FBI email addresses, and 190+ Department of Justice officials on private Telegram channels, with unclear data origins. The doxxing coincides with DHS warnings about Mexican cartels allegedly targeting ICE and CBP agents with bounties, and hackers claimed interest in million-dollar rewards while threatening to target IRS officials next. Security professionals should implement enhanced operational security for government personnel, monitor dark web channels for leaked PII, and review data handling procedures to identify potential breach sources, particularly given The Com's history of high-profile attacks against MGM Resorts, Coinbase, and others.
A former Trenchant (L3Harris subsidiary) iOS exploit developer received an Apple threat notification in March indicating his personal iPhone was targeted with mercenary spyware, potentially marking the first documented case of spyware developers being targeted by their own tools. The developer, pseudonymously called Jay Gibson, was fired from Trenchant weeks earlier after being accused of leaking Chrome zero-days despite working exclusively on iOS exploits, which he and former colleagues deny. Security professionals should note that Apple's threat notification system detects sophisticated targeting even when forensic analysis finds no infection traces, suggesting either failed attack attempts or increasingly stealthy spyware that leaves minimal forensic evidence.
Sponsored
A major AWS outage disrupted multiple high-profile services, including Fortnite, Alexa, and Snapchat, highlighting the critical dependency risks and single points of failure that organizations face when relying on centralized cloud infrastructure providers.
Indian e-commerce platform Dukaan exposed an unsecured Apache Kafka broker for over two years, leaking payment gateway authentication tokens for Stripe, PayPal, and RazorPay, along with customer data from 3.5 million merchants that could have enabled attackers to drain hundreds of millions of dollars from merchant accounts.
Sponsored
The corporate firewall is a relic of bygone times. With employees working from coffee shops, airports, and home networks, traditional perimeter security leaves your endpoints exposed to unmanaged devices and compromised networks.
Socket researchers discovered 131 malicious Chrome extensions with over 20,000 active users that inject code into WhatsApp Web to automate bulk spam campaigns targeting Brazilian users. The extensions, marketed as CRM tools with names like “YouSeller” and “ZapVende,” share identical codebases and are distributed through a franchise model operated by DBX Tecnologia, violating Google's Chrome Web Store policies. The nine-month campaign aims to bypass WhatsApp's rate limits and anti-spam controls by automating message sending without user confirmation.
Foreign threat actors breached the Kansas City National Security Campus, which produces 80% of non-nuclear components for US nuclear weapons, by exploiting unpatched Microsoft SharePoint vulnerabilities CVE-2025-53770 (spoofing) and CVE-2025-49704 (RCE) in July, with attribution disputed between Chinese nation-state groups (Linen Typhoon, Violet Typhoon, and Storm-2603) and Russian cybercriminals. While the breach targeted IT systems rather than air-gapped OT/manufacturing environments, experts warn that even unclassified technical data such as precision requirements, tolerances, and supply chain details could provide adversaries with strategic intelligence about US weapons capabilities and manufacturing processes. Security teams should prioritize patching SharePoint on-premises servers, implement a comprehensive zero-trust architecture across both IT and OT environments as outlined in DoD's emerging OT fan chart framework, establish robust IT/OT segmentation to prevent lateral movement, and recognize that nation-state actors may acquire zero-day knowledge through MAPP program misuse or underground exchanges before patches are available.