Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Jaguar Land Rover halted operations after a cyberattack disrupted its retail and production activities. The company is carefully rebooting its global applications, reporting no customer data theft so far. Experts say the breach was spotted late, and JLR is now working with responders to restore service and lock out attackers from its systems.
Cloudflare has autonomously blocked hundreds of hyper-volumetric DDoS attacks over the past few weeks, with the largest reaching peaks of 5.1 Bpps and 11.5 Tbps.
NIST updated its security controls to improve software patching to emphasize logging, root cause analysis, and designing for cyber resilience.
Frostbyte10 is a critical vulnerability in Copeland controllers, used by major grocery chains for refrigeration, that allows hackers to manipulate temperatures and potentially spoil food and medicine remotely.
Sponsored
Meanwhile, compliance requirements keep expanding. New regulations emerge annually across privacy, financial controls, and cyber resilience. Each framework demands separate audits, evidence collection, and documentation — even when requirements overlap significantly [4].
Multiple malicious versions of the popular Nx build system package were published to NPM on August 26. The attack leveraged AI command line tools to search for sensitive files, extracted credentials, and then attempted lockout by appending `sudo shutdown -h 0` to .bashrc and .zshrc files. The root cause of the supply chain attack was a flawed GitHub Action that allowed code injection through unsanitized PR titles combined with the `pull_request_target` trigger.
The data theft affecting Drift AI, a Salesloft tool, is more extensive than initially reported. Attackers used compromised credentials to access Google Workspace emails, and as a result, all Salesloft Drift integrations are now considered potentially compromised. Organizations must revoke and rotate all connected credentials and check for unauthorized access.
A fraudster stole $1.5 million from Baltimore between February and March by pretending to be a vendor employee, hacking into the vendor's Workday account, and convincing AP staff to redirect bank details. The city recovered $721,000, but cannot recover $803,000 despite insurance claims and reissued payments. This is Baltimore's third instance of vendor fraud since 2019, highlighting ongoing weaknesses in financial controls following losses of $62,000 in 2019 and $376,000 in 2022.
Researchers discovered an authentication bypass (CVE-2024-28080) in Gitblit's SSH service that allows attackers to log in without requiring a user's private key or password, only needing the username and public key. This post analyzes how the vulnerability arose, detailing the SSH login handshake and highlighting where the implementation deviates from secure best practices with Apache MINA SSHD.
Traditional CVSS scores fail to address the unique risks posed by autonomous AI agents. The new AIVSS framework extends CVSS by evaluating behavioral factors—such as autonomy, tool access, and memory use—enabling security teams to measure and manage the risks of agentic AI systems more effectively, aligning with modern security frameworks like NIST AI RMF.
The Gayfemboy botnet exploits vulnerabilities in DrayTek, TP-Link, Raisecom, and Cisco devices to deploy a Mirai-variant that uses modified UPX packing, custom architecture naming schemes, and hardcoded process termination lists to eliminate competing malware infections. The malware implements sophisticated evasion techniques, including 50-nanosecond sandbox delays, utilizes public DNS servers (1.1.1.1, 8.8.8.8) to bypass local filtering, and scans 15 predefined ports for C2 communication with domains such as cross-compiling[.]org and i-kiss-boys[.]com. Organizations should implement network monitoring for unusual DNS queries to public resolvers, deploy IPS signatures for the listed CVEs, and monitor for processes attempting to bind to UDP port 47272 or exhibiting the malware's distinctive process termination behavior.
Sponsored
IT and InfoSec are technically on the same side… but it sometimes doesn't feel like it. In this 30-minute session [11], you'll learn how to start working as one team:
CatSniffer is an original, multiprotocol, and multiband board designed for sniffing, communicating with, and attacking IoT (Internet of Things) devices using the latest radio IoT protocols. It is a highly portable USB stick that integrates TI CC1352, Semtech SX1262, and an RP2040 for V3 or a Microchip SAMD21E17 for V2.
Cortex Cloud ASPM is a prevention-first application security module that integrates with AppSec tools, such as Snyk, GitLab, and Checkmarx, to block vulnerabilities before they reach production. The platform offers automated remediation, inline IDE fixes, and correlates findings across code, cloud, and runtime to prioritize risks over false alarms. In early access, with general availability in H2 2025, it claims to be 10 times faster and more cost-effective than traditional reactive security.
Two tools written in C that block network traffic for blacklisted EDR processes, using either Windows Defender Firewall (WDF) or Windows Filtering Platform (WFP).
The Chinese hacking group Salt Typhoon has infiltrated U.S. telecoms, stealing personal data from nearly every American and millions globally since 2019. FBI officials say the scale and indiscriminate nature of the campaign are unprecedented, affecting at least 80 countries, 200 U.S. organizations, and high-profile political figures.
North Korean APT37 (ScarCruft) carried out Operation HanKook Phantom using spear-phishing emails with malicious LNK files disguised as PDFs to deliver RokRAT malware to South Korean research targets. The attack utilized fake newsletter lures from the National Intelligence Research Association, employing PowerShell scripts and fileless techniques to exfiltrate data via Dropbox, Google Cloud, and Yandex. This campaign shows APT37's focus on espionage against the South Korean government, research, and academic targets.
A whistleblower at the Social Security Administration (SSA) stated that a former senior DOGE official, now at the SSA, copied the Social Security Numbers (SSNs), names, and dates of birth of over 300 million Americans to a private section of the agency's AWS cloud environment. The complaint states that the cloud environment was set up for DOGE-affiliated Social Security staffers but lacks independent security, monitoring, and oversight. The complaint also alleges that cybersecurity officials within the SSA described the decision to copy the data as “very high risk” and discussed the possibility of having to reissue SSNs in the event of a breach.
OpenSSH 10.1 will warn users when connecting to servers that use non-post-quantum key agreement schemes, encouraging migration to quantum-resistant cryptography such as mlkem768x25519-sha256 and sntrup761x25519-sha512 to protect against future "store now, decrypt later" attacks.
Spanish police arrested a 21-year-old suspected hacker in Seville for allegedly compromising at least 13 university professors' accounts on the Andalusia region's Séneca educational platform to alter his own and classmates' high school and university entrance exam grades.
Sponsored
DNSFilter [4] protects more than 43,000 organizations worldwide by blocking 200 million threats every day - like malware, phishing, and botnets - before they hit.
WhatsApp has released an emergency security update to patch a critical zero-click exploit that allows attackers to remotely compromise iOS and macOS devices without any user interaction. The vulnerability affects WhatsApp's voice calling feature, allowing attackers to execute malicious code by simply initiating a call, even if the target doesn't answer. Users are strongly urged to update their WhatsApp applications immediately to protect against potential attacks exploiting this serious security flaw.
Threat actors are using the Velociraptor forensic tool to deploy Visual Studio Code for command and control tunneling. The attackers are exploiting Velociraptor's endpoint monitoring to download and run Visual Studio Code, likely to establish persistent backdoor access. This follows the trend of cybercriminals exploiting trusted tools to evade detection and maintain covert channels.
There is a malware campaign that uses Meta ads offering a free version of the TradingView Premium app to spread the Brokewell malware for Android. The malicious ads direct users to a webpage that mimics TradingView's site and prompts users to download an APK file, which installs the Brokewell malware. The malware scans for crypto wallets and bank accounts, steals 2FA codes, steals accounts by overlaying fake login screens, records screens and keystrokes, steals cookies, activates the camera and microphone, tracks the device location, hijacks the default SMS apps, and provides remote control capability.
The TamperedChef infostealer malware is being distributed through fake PDF editing applications promoted via Google ads across multiple malicious websites. The fraudulent PDF editor appears legitimate but secretly installs the TamperedChef malware designed to steal sensitive information from infected systems. This campaign demonstrates how cybercriminals continue to exploit trusted advertising platforms and standard software to deliver malware to unsuspecting users.
This post analyzes how attackers bypass macOS' built-in security mechanisms, including Keychain, SIP, TCC, File Quarantine, and Gatekeeper, through techniques such as TCC Clickjacking, quarantine attribute removal, and social engineering attacks that require context menu execution. The analysis provides detection rules in Sigma format to identify malicious activities, such as keychain dumping, SIP status discovery, quarantine removal, and Gatekeeper disabling, through command-line utilities. Organizations should implement third-party EDR solutions in conjunction with native macOS protections, as attackers continue to adapt and circumvent Apple's security frameworks through techniques such as privilege escalation and user manipulation.
Attackers frequently utilize shortcut files as an initial access vector, as they can obscure malicious commands from a user. In this post, the author compiled a corpus of 614 malicious LNK files using the VirusTotal API and employed frequency analysis to extract common command-line arguments from malicious shortcuts that execute PowerShell or CMD. The author then utilized KQL to construct threat hunting queries that search for malicious LNK files using this corpus of data.
Sponsored
Almost anything worth doing creates some level of risk. But without mapping or monitoring, your company security posture is constantly under pressure. Grab this OneTrust infographic [11] for a quick overview of the gap between regulations and resourcing, and how you
Founding is a tool that processes shellcode in .bin, .exe, or .dll formats, applying advanced obfuscation or encryption techniques to generate stealthy binaries with sophisticated execution methods.
JamfHound is a Python 3 project designed to collect and identify attack paths in Jamf Pro and import them as JSON object files into BloodHound.
FT3 is Stripe's adaptation of ATT&CK-style security frameworks designed explicitly for fraudulent activities.
The Lab Dookhtegan hacking group allegedly disrupted communications systems on 60 Iranian ships, including 39 tankers and 25 cargo vessels operated by sanctioned companies National Iranian Oil Tanker Company (NITC) and Iran Shipping Lines (IRISL). The cyberattack targeted the maritime communication infrastructure of these state-linked shipping firms, potentially impacting their ability to coordinate operations and maintain contact with shore-based facilities. This incident demonstrates the growing trend of hacktivists targeting critical maritime infrastructure as part of geopolitical cyber operations.
The author of this post reflects on his time as an AppSec engineer in various organizations and divides AppSec roles into three buckets: AppSec Engineer in a Centralized Organization, Dedicated AppSec Engineer, and Security Partner Engineer. The author also classifies AppSec Engineers as either orchestrators, builders, specialists, or rapid responders. The post concludes with a mapping of the roles each archetype excels in and the prime traits essential for each archetype to succeed.
A security researcher demonstrates how LLM-generated code can contain serious security flaws, such as exposing an email API with hardcoded parameters in client-side JavaScript. This allows attackers to spam recipients with simple curl commands. LLMs learn from insecure internet examples and replicate these patterns, often prioritizing functionality over security. Organizations require human oversight for security reviews and threat modeling when utilizing AI-generated code, as LLMs lack an understanding of security risks and potential for abuse.
US and Dutch authorities have seized the VerifTools marketplace, which sold counterfeit identity documents for as little as $9 to facilitate cybercrime.
Amazon disrupted a Russian APT29 watering hole campaign that injected malicious JavaScript into compromised websites, redirecting visitors to fake Microsoft device authentication pages designed to harvest credentials from academics and Russian critics.
Meta developed flirtatious AI chatbots impersonating celebrities such as Taylor Swift, Scarlett Johansson, Anne Hathaway, and Selena Gomez without their permission.
Sponsored
Forget the idea that email is fading. Nearly 9 IN 10 IT LEADERS say direct email is still critical to how their business communicates—more than Slack, Teams, or even collaboration tools. Why? Because email is auditable, reliable, and built for messages that matter.
There is an actively exploited zero-day vulnerability affecting systems with exposed Administrator Control Panel (ACP). Hackers have exploited it since August 21, compromising servers and affecting thousands of SIP extensions, allowing attackers to run commands as the Asterisk user. Sangoma has released emergency EDGE module fixes. It recommends blocking ACP access, restoring from pre-August 21 backups if compromised, and rotating all credentials.
Hackers accessed the personal data of over 4.4 million TransUnion customers through a breach in a third-party application, although the credit data itself was not compromised. Stolen information included names, birth dates, and Social Security numbers. This incident is part of a recent wave of major corporate data breaches in the US. Companies like Google and Allianz Life were also affected.
Attackers are increasingly using Microsoft Teams for the delivery of malware. Impersonating IT support, they send direct messages or calls from fake or compromised accounts, tricking users into installing remote access tools or running malicious PowerShell payloads. These sophisticated campaigns leverage social engineering, exploit the trust in Teams' internal messaging, and use advanced techniques to steal credentials, maintain persistence, and evade detection. Defenders are advised to remain vigilant for unusual Teams activity and impersonation attempts and to recognize the signs of such malware attacks for improved response and mitigation.
This post provides an overview of how to utilize CloudTrail, VPC Flow Logs, GuardDuty, ALB Logs, and AWS Config for threat detection in AWS. It lists sample alerts for each data source, as well as cross-service alerts, and demonstrates how these alerts can inform automated enforcement actions. Continuous validation is important for ensuring that rules remain consistent with an organization's environment.
Threat hunting follows the scientific method in which analysts observe logs, develop hypotheses, test the hypotheses, and iterate, but this model is crumbling under the vast amount of logs present in modern environments. To augment security teams, AI agents can be used to monitor vast amounts of logs and develop initial hypotheses to augment security teams. SOCs can begin leveraging agentic AI by developing explicit hypotheses, pairing with AI for investigations, centralizing data in a SIEM or data lake, setting appropriate guardrails for the agents, and then automating repetitive tasks.