Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Sponsored
Intruder ran its Autoswagger tool against targets from several large bug bounty programs - and came back with exposed credentials in APIs offered by Microsoft and other massive companies. See the examples and
Microsoft temporarily removed Copilot functionality from SQL Server Management Studio (SSMS) 22 Preview 1 after 75% of survey respondents preferred GitHub Copilot integration over the current implementation.
Venezuelan President Nicolás Maduro claimed his Huawei Mate X6 smartphone, reportedly gifted by China's Xi Jinping, is "the best phone in the world" and cannot be hacked by US cyber spies, despite cybersecurity experts noting that well-resourced nation-state actors can compromise any device and that HarmonyOS may contain undiscovered vulnerabilities due to limited global scrutiny.
Kosovo national Liridon Masurica, also known as "@blackdb," pleaded guilty to conspiracy to commit access device fraud for operating the BlackDB.cc cybercrime marketplace from 2018 to 2025.
Sponsored
In this guide [4], you'll learn how to:
Canadian financial services firm Wealthsimple disclosed a data breach detected on August 30 that exposed the personal information of fewer than 30,000 customers (less than 1% of its 3 million client base) through a compromised third-party software package. The stolen data included contact details, government IDs, financial account numbers, Social Insurance Numbers, IP addresses, and dates of birth. No passwords or customer funds were compromised. Wealthsimple is providing affected customers with two years of free credit monitoring, dark-web monitoring, identity theft protection, and insurance. It confirmed the incident was unrelated to recent Salesforce breaches.
The GhostAction supply chain attack compromised 817 GitHub repositories by injecting malicious workflow files that appeared to be routine automation scripts but actually exfiltrated CI/CD secrets to an external server. The campaign affected 327 developers across multiple programming languages, stealing 3,325 secrets, including npm, PyPI, DockerHub tokens, and AWS credentials that could enable further attacks on software supply chains. The attackers personalized each commit and analyzed legitimate workflows to identify which secrets to target. At least 24 projects (9 npm and 15 PyPI) remain at risk from compromised tokens despite no confirmed malicious package releases yet.
Hackers used stolen secrets from Nx to expose over 6,700 private repositories in a major supply chain attack that targeted hundreds of organizations. The threat actors leveraged malicious Nx packages to steal API keys and credentials, and exploited the compromised accounts to publish sensitive data from private repositories to public GitHub repositories.
Russian-speaking threat actors deployed the "GPUGate" campaign using a sophisticated multi-stage attack combining Google Ads malvertising, GitHub commit manipulation, and hardware-specific GPU-gated decryption to target Western European IT professionals with fake GitHub Desktop installers. The attackers leveraged Google's paid search results, modified legitimate GitHub repository commits to include malicious download links, and created 128MB installers with OpenCL-based decryption that only executes on systems with real GPUs (device names >10 characters), effectively bypassing sandbox analysis. The campaign demonstrates advanced evasion tactics, including UAC bypass, Windows Defender exclusions, persistence through scheduled tasks, and modular payload delivery, with the ultimate goal of credential theft, lateral movement, and potential ransomware deployment targeting high-value IT sector victims.
CVE-2025-43300 is a zero-click out-of-bounds write vulnerability in the ImageIO framework that occurs when processing DNG images with JPEG lossless compression. Exploited in the wild, the vulnerability stems from incorrect buffer allocation and loop bounds in the lossless JPEG decompression code, where the system assumes at least two components per pixel but processes images with only 1 component, causing writes beyond allocated memory. Apple's patch adds bounds checking to verify buffer size before each write operation and raises an exception when the buffer would be exceeded, fixing the mismatch between allocated buffer size (based on components per pixel) and actual write operations.
Attackers are restricted to using port 445 when performing NTLM relay attacks on SMB in Active Directory environments. A common strategy to get around this limitation is by extracting the SAM and SYSTEM registry hives to dump NT hashes, but this often triggers alerts or is blocked by EDR. This article details a technique that uses Service Control Manager (SCM) to start the Webclient service, which offers more lateral movement options.
Sponsored
Download This Gartner® Report to Learn Dropzone's Takeaways:
Dittobytes compiles C-code into truly Position Independent Code (PIC) for Windows, macOS, and Linux. Supporting AMD64 and ARM64, it has a metamorphic engine that ensures each compile produces unique, functional shellcode. The resulting shellcode is very small and simple and has minimal overhead.
FireCompass is a platform that integrates attack surface management, continuous threat exposure management, network and application penetration testing, penetration testing as a service, and red teaming.
findmytakeover is a tool that detects dangling DNS records in a multi-cloud environment. It achieves this by scanning all DNS zones and infrastructure within the configured cloud service provider, whether in a single or multiple accounts, to identify DNS records for which the underlying infrastructure no longer exists, rather than relying on a wordlist.
German prosecutors charged a 30-year-old man with computer sabotage, data alteration, and espionage for attacking Rosneft Deutschland in March 2022, stealing and deleting 20 terabytes of data while leaving a "Glory to Ukraine" message, costing the company €12.36 million in damages. The attack, conducted in the aftermath of Russia's invasion of Ukraine, exposed sensitive internal communications and corporate documents, with the stolen data later distributed by the Anonymous hacktivist collective. The incident highlights the vulnerability of critical energy infrastructure to cyberattacks, particularly during geopolitical tensions, emphasizing the need for enhanced cybersecurity measures in essential services sectors.
A new variant of spyware called Stealerium can automatically take webcam photos of people while they watch porn, then send these to hackers for possible blackmail. Distributed as free, open-source code, it infects users via phishing emails. Researchers say this marks a move from large-scale ransom to more personal extortion, and warn it's hard to track individual victims.
NYU researchers built an AI-powered ransomware as a proof-of-concept, showing how large language models can automate targeted ransomware attacks. Their project, initially intended for research purposes, was flagged by security experts as a real threat after it was uploaded to VirusTotal. The experiment highlights growing concerns that, soon, cybercriminals will be able to easily weaponize AI for sophisticated, undetectable attacks.
Sponsored
According to the report, cyberattacks are the leading cause of mission-critical failures, with average costs hitting $1M per
A maximum severity vulnerability (CVE-2025-55190, CVSS 10.0) in Argo CD allows API tokens with minimal project-level get permissions to bypass isolation mechanisms and retrieve all repository credentials, including usernames and passwords.
Attackers injected malware into npm packages like debug, chalk, supports-color, and strip-ansi, targeting crypto/web3 wallets in browsers.
Hackers accessed Salesloft's GitHub account between March and June, stealing security tokens linked to 22 companies and prompting the company to disable Drift, reset credentials, and enhance security measures.
Sponsored
If you're leading governance, risk and compliance, you're under constant pressure: security reviews, audits, vendor questionnaires -
streamlines the entire GRC workflow. Security questionnaires? Automated. Evidence collection? Continuous. Risk management? Built in.
Hackers are exploiting a critical CVE in SAP S/4HANA that enables low-level users to gain admin control. The flaw affects multiple versions, risking data theft, backdoors, and ransomware. SAP released patches on August 12. Organizations should update immediately, as the Dutch NCSC issued a medium-high priority advisory on September 5.
A dark web vendor claims to have breached Anuvu (formerly Global Eagle), a major satellite provider for airlines and cruise lines, allegedly obtaining over 70 admin credentials for internal services like AWS and Postgres databases. The stolen data includes sensitive employee info, customer databases, and Starlink contract details, potentially exposing users of in-flight connectivity. Researchers verified parts of the data appear legitimate and warned that the breach could enable targeted phishing and credential stuffing attacks against airline partners like Air France, Delta, Southwest, and British Airways.
A new phishing campaign that leverages iCloud Calendar invites was reported to BleepingComputer. The phishing email notifies the user that their PayPal account is being charged and requests the user to call a given phone number. The notable thing is that the email is sent from Apple's servers because the attackers add the user's email to an Office 365 group, which they invite to the event, and include the phishing text in the Notes field.
The true/false positive binaries only capture whether an alert accurately alerts on a signal, but not if it is impactful. The author proposes adding a layer of intent or disposition to alert metrics to measure whether the alert had an actual business impact. This leads to a refined classification with the steps: True Positive - Malicious, True Positive - Suspicious, True Positive - No Business Impact, and False Positive.
MCPs pose security issues like poor auditing, insecure credentials, and excessive privileges. Teleport offers a Unified Identity Framework, giving each MCP a unique cryptographic identity with dynamic credentials, fine-grained access, and thorough logging. This post covers deploying and securing MCP access to a database.
Active Directory Certificate Service (ADCS) is used in Active Directory environments to manage certificates for systems, users, applications, and more, and provides a variety of potential privilege escalation vectors. ADCS logging is not enabled by default and must be enabled via certsrv. This post demonstrates how to create and test KQL alerts for a common privilege escalation technique.
Sponsored
The 2nd biggest cybersecurity acquisition in history confirmed what every CISO suspected: LEGACY PAM IS A LIABILITY. The question isn't if you replace it — it's how long you can wait.
The repository contains ten variations of malicious PDF files that include phone-home features. These can be used with Burp Collaborator or Interact.sh.
ghbuster is a tool from Datadog that detects suspicious GitHub users and repos using heuristics. The tool analyzes patterns like coordinated star manipulation, commits from unlinked emails, users with only forked repositories, and accounts with minimal community activity to flag threat actors weaponizing trust in the open-source ecosystem. It provides a command-line interface with modular detection rules and requires a GitHub API token.
Finch is a fingerprint-aware TLS reverse-proxy that inspects TLS handshakes and HTTP requests to extract JA3, JA4, JA4H, and Akamai HTTP/2 fingerprints, then evaluates them against hot-reloadable rules.
VirusTotal discovered a phishing campaign using SVG files with embedded JavaScript to impersonate Colombia's judicial system, delivering malware through fake government portals. The campaign used 44 unique SVG files that evaded all antivirus engines but were detected by VirusTotal's AI Code Insight feature, which also uncovered 523 additional samples dating back to August. The malicious SVGs create convincing fake judicial portals with progress bars and security tokens, while secretly downloading ZIP archives containing malware to victims' systems.
The EU fined Google €2.95 billion for abusing its dominant position in advertising tech by favoring its AdX exchange since 2014. This is Google's fourth major EU antitrust penalty, totaling nearly €10 billion over ten years. Google has 60 days to suggest compliance or risk divestment. It plans to appeal.
Czech cybersecurity agency NUKIB warned of increasing risks from Chinese-linked technologies in vital sectors such as energy, healthcare, transport, and government, citing APT31's attacks on Czech ministries. The agency pointed out risks from Chinese devices like IP cameras, PV inverters, smart meters, phones, cars, and AI models that can send data to or be controlled remotely from China. NUKIB stressed that Chinese laws give authorities broad powers to access data and force private companies to cooperate in state-led spying, urging Czech organizations to implement proper protections against these cyber threats.
Sponsored
Learn how Mattermost Enterprise Advanced secures classified data with spillage controls, disappearing messages, mobile security enforcement, post-quantum encryption, and uncompromising Zero Trust access for defense, intelligence, and critical infrastructure. Join the webinar
Waymo co-CEO Tekedra Mawakana announced the company will "challenge, limit, or reject" law enforcement requests for robotaxi camera footage that lack valid legal processes like warrants, as each vehicle's 29 cameras create privacy concerns about potential surveillance misuse.
Tire manufacturing giant Bridgestone confirmed a cyberattack disrupted operations at multiple North American facilities, including plants in South Carolina and Quebec.
Australian airline Qantas cut executive bonuses by 15% after a July cyberattack linked to Scattered Spider compromised the data of 5.7 million customers through a third-party call center platform.
Sponsored
Weak and reused passwords expose companies to critical risks. In fact, the majority of web application breaches stem from poor credential hygiene, costing organizations millions per incident.
Nearly all of enterprise customers report that Bitwarden improved their security posture once fully deployed. Start a free enterprise