Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Sponsored
AWS experts offer a guide to choosing cloud security tools. Explore how to integrate third-party tools into your AWS stack for threat protection. Read the guide now [18] to find the best security solutions for your AWS environment.
Inotiv, a pharmaceutical research company, was hit by a ransomware attack attributed to the Qilin group that disrupted operations and potentially exposed data.
Windows 10 support will end in October, after which the operating system will no longer receive security updates unless users purchase Extended Security Updates or upgrade to Windows 11.
Europol has denied offering a $50,000 reward for help capturing Qilin ransomware members, calling the announcement in a Telegram group a scam.
Sponsored
Security UIs feel great when you have a handful of rules to manage. Then you start to notice the cracks: no version control, no testing, poor collaboration… Sound familiar?
Threat actors are exploiting a two-year-old critical Apache ActiveMQ vulnerability (CVE-2023-46604, CVSS 10.0) to deploy DripDropper malware on cloud Linux systems, then patching the flaw post-compromise to block other attackers and evade detection. The attackers use the PyInstaller-based DripDropper to establish persistence through modified SSH configurations and cron jobs, while leveraging legitimate services like Dropbox and Cloudflare Tunnels for command-and-control communications.
A vulnerability in Ollama Desktop v0.10.0 allowed drive-by attacks where malicious websites could bypass CORS controls to reconfigure victims' local AI settings remotely, intercept all chat messages, and even serve poisoned models. GitLab's Chris Moberly discovered the flaw by exploiting incomplete cross-origin controls—removing the Content-Type header to trick the app into treating malicious requests as "simple" and bypassing preflight checks. The vulnerability was patched within hours in v0.10.1 after Moberly disclosed it on July 31. Users are urged to update immediately as exploitation would be "trivial," according to the researcher.
Push Security researchers found a new phishing attack using legit office.com links combined with ADFS to redirect users to a phishing page that steals Microsoft 365 logins. The attack starts when users click on malicious sponsored links in Google search results for Office 265 (likely typosquatting), which leads to Microsoft's office.com, then to a harmless-looking page that redirects to the phishing site. The attackers are using a custom Microsoft tenant with ADFS to receive authorization requests for the fake domain.
Cryptoagility, defined as the ability to replace cryptographic algorithms, keys, and certificates quickly, has become vital for organizations managing critical infrastructure, as shown by Google's Chromecast failure that affected millions when a certificate expired. Organizations must shift from reactive to proactive certificate management, using modular infrastructure, centralized PKI/HSM, and automated rotation aligned with PCI DSS v4.0 and DORA. This forward-looking approach makes cryptographic flexibility a strategic advantage, ensuring operational continuity and compliance before vulnerabilities or expirations cause system failures.
The author of this post uncovered several vulnerabilities at McDonald's, like weak app and portal security, exposed API keys, and user data leaks. Despite attempts to report the issues, finding someone to listen was nearly impossible—the process required calling HQ and guessing employee names. Most bugs were fixed once reported, but communication and security practices at McDonald's were deeply flawed.
This post details an attack path from an Entra service principal with `Files.ReadWrite.All` permissions to admin. The attacker exploited OneDrive for Business's Known File Move feature to load a PowerShell profile with a beacon from OneDrive into admins' filesystems. It concludes with defender tips on detection and credential protection.
Sponsored
AWS experts offer a straightforward guide to help you choose cloud security tools for your applications. Explore how to integrate third-party tools into your AWS stack to guard against threats. Read the guide now [12]and explore more solutions in AWS Marketplace [12].
Microsoft's Entra Private Access now allows organizations to apply cloud-based conditional access and MFA to on-premises Active Directory domain controllers, replacing legacy VPNs with Zero Trust Network Access. It requires networks to be NTLM-free and Kerberos-only, Windows 10+ devices that are Entra or hybrid joined, opening TCP port 1337 on domain controllers, and extensive NTLM auditing and removal. Organizations must audit NTLM usage via Group Policy, transition to NTLMv2 or Kerberos, and possibly retire legacy apps before implementing this security framework.
TURN tunneler (TURNt) is a red-team tool designed to tunnel interactive C2 traffic, such as hidden VNC and SOCKS traffic, over legitimate meeting protocols used by Zoom and Teams.
YARAAST (YARA Abstract Syntax Tree) is a Python library and CLI tool for parsing, manipulating, and analyzing YARA rules through AST representation.
The Dire Wolf ransomware has affected 16 organizations across 11 countries since it emerged in May, using double-extortion tactics, such as encrypting data while threatening leaks. The Golang-based ransomware uses anti-forensics techniques and multi-stage attack chains to evade detection, mainly targeting manufacturing and technology sectors through phishing and credential stuffing attacks.
Accounts of project maintainers publishing software on PyPI are linked to email addresses, which in some cases may be tied to a custom domain name. Historically, attackers have been able to take over some projects by resurrecting an expired domain that was attached to a maintainer's email and resetting the account. PyPI has added new checks that will mark an email as unverified if a domain is expired or is about to expire.
A UAE-based startup is offering huge bounties—up to $20 million—for hacking tools that exploit zero-day flaws in all major smartphone systems. The firm, which serves governments and intelligence agencies, is secretive about its clients. The offer reflects rising demand and prices for cyber-espionage tools.
Sponsored
Join luminaries like Justin Lam (451 Research) and Amir Khayat (Vorlon) on the new converged AI+SaaS attack surface. See trends and an analysis of real-world attacks like ShinyHunters Salesforce breach. Get practical frameworks and ask your toughest questions live.
A cyberattack at Allianz Life in July compromised the personal details of 1.1 million customers, including Social Security numbers, after hackers accessed a Salesforce database.
A 22-year-old Oregon man was arrested for operating the “Rapper Bot” botnet, which was used to launch massive DDoS attacks on global targets.
Vulnerabilities in Intel's internal websites exposed personal details of 270,000 employees worldwide, but no sensitive data, such as Social Security numbers or salaries, was leaked.
EVERY BREACH STARTS WITH WEAK CREDENTIALS. Protect your business with Bitwarden—built on a trusted open source foundation, recommended by
Sponsored
Join award-winning WIRED journalist Andy Greenberg and leading security experts, including Upwind CSO Rinki Sethi (formerly Twitter CISO), at the free, virtual Open Source Security Summit [4] sponsored by Bitwarden.
There are over 35 Docker Hub images that still contain the XZ-Utils backdoor (CVE-2024-3094). Discovered in March 2024, the vulnerability allows attackers with a specific private key to bypass SSH authentication and execute commands as root. Debian has refused to remove the backdoored images, citing low exploitation risk and archival continuity, despite the danger of accidental pulls in CI/CD pipelines. Organizations should verify that their containers use XZ-Utils version 5.6.2 or later to avoid inheriting this supply chain compromise.
The Business Council of New York State (BCNYS), the largest employer association in the state, revealed that attackers stole personal, financial, and health data of over 47,000 people in a February breach. The data included full names, SSNs, birth dates, IDs, financial info, payment card details, and e-signatures. BCNYS said it didn't detect the breach until August 4, but cut off access immediately.
Bragg Gaming Group reported a cyberattack that affected only its internal systems. No customer or personal data was accessed. Operations continue normally, although key details about the attack method and duration are still unclear, leaving some questions about the incident's full impact.
Kaspersky and BI.ZONE analyzed PipeMagic backdoor's evolution from 2022 to 2025, revealing new infections in Saudi Arabia and Brazil using fake ChatGPT apps, exploiting CVE-2025-29824 for privilege escalation. The malware now includes enhanced modules for asynchronous communication, payload injection, and .NET execution, with attackers using LSASS memory dumping for lateral movement across compromised networks.
Malware analysis environments have complex requirements as they must allow analysts to effectively analyze potentially malicious code while it is executing in the environment. This post proposes a process in which a security analyst gains access to an EC2 instance with no outbound connectivity via AWS Systems Manager Session Manager. The analyst then connects to malware samples through a gateway endpoint for S3 to download the malware and detonate it, and then they can use services such as CloudTrail and GuardDuty to monitor the behavior. The post provides a detailed setup checklist that covers policy, account setup, VPC design, instance configuration, storage, monitoring, IAM, and lifecycle considerations.
The Noodlophile Stealer malware has evolved. It is now conducting targeted phishing campaigns impersonating copyright claims, mainly against organizations with large social media presences. The attackers steal browser and login data, adapting tactics for better success, and concentrate on enterprises with significant Facebook activity, highlighting the need for stronger cybersecurity and anti-phishing measures.
Sponsored
Discover how high-performing organizations use SANS to improve retention, cut external security costs by nearly $900K, and detect threats 4.2x faster. Download the IDC white paper, sponsored by SANS [12], and explore training and tools designed for measurable impact with SANS Cybersecurity Training [13].
Okta has open-sourced ready-made Sigma queries for Auth0 customers to detect account takeovers, misconfigurations, and suspicious behavior in event logs. Auth0 is an IAM platform used by organizations for login, authentication, and user management services. Organizations can utilize the rules by cloning the GitHub repo and using a Sigma converter (such as sigma-cli) to translate the rules into a query syntax that their SIEM supports.
Warren is an AI-powered security alert management system that reduces noise and accelerates response time. It ingests alerts from existing tools and enriches them with AI and threat intel.
SimpleCrypt is a powerful command-line tool designed for securely encrypting and decrypting files and directories using AES-256 encryption. It aims to provide users with a straightforward and efficient way to protect sensitive information directly from their terminal.
AWS changed Kiro's pricing from reasonable plans to a split request model with "vibe" at $0.04 and "spec" at $0.20. Developers report monthly costs of $550-$1,950, far above the promised 1,000 interactions for $19. The free tier offers only 50 vibe requests, with no spec requests, requiring immediate payment for actual code execution. Open-source developers use 4-6 requests per action, making Kiro more expensive than AWS's Amazon Q ($40 for 3,000 requests) or competitors with unlimited plans.
XProtect comprises YARA detection rules employed by Gatekeeper checks to identify known malware. Over six years, the number of rules has quadrupled, and the total size has grown to 22 times its original. This expansion results in longer scan times. However, removing older rules is risky, as it could leave newer Macs vulnerable to malware, especially if they still support x86 execution.
Mozilla has raised concerns about a recent ruling by Germany's Federal Supreme Court (BGH) in a case brought by online media company Axel Springer against Eyeo, the makers of the Adblock Plus browser extension. Axel Springer claimed that a website's HTML/CSS is a protected computer program, and therefore, ad blockers that interact with in-memory structures such as DOM, CSSOM, and the rendering tree should be considered unlawful reproduction and modification. The lawsuit has significant implications for other types of browser extensions that alter the DOM, as well as ad blockers.
Black Hat USA 2025 returns to Las Vegas August 2-7.
Linktree has been inaccessible in India for several days across all ISPs.
The UK government has dropped its demand for Apple to provide backdoor access to encrypted iCloud data following US pressure.
Sponsored
While security teams wrestle with NVD backlogs and CVE delays, threat actors are having their best year yet. Flashpoint's midyear threat intelligence report [4] analyzed 3.6+ petabytes of data to reveal:
AI chatbots can easily be manipulated to harvest personal data by tweaking system prompts. Even people with little technical skill can weaponize these bots, making privacy risks greater for users. Regulators and companies need stronger safeguards to protect personal information.
Workday disclosed a breach on August 6 where attackers accessed business contact information (names, emails, and phone numbers) from its third-party CRM platform through social engineering, though customer tenants remain unaffected. The attack is linked to ShinyHunters' ongoing campaign targeting Salesforce instances via OAuth app social engineering, which has affected multiple major companies, including Adidas, Google, and luxury brands. Attackers pose as HR or IT staff via phone/text to trick employees into revealing credentials, then use malicious OAuth apps to exfiltrate databases for extortion purposes.
N-central is a popular platform, developed by N-able, that is used by managed services providers (MSPs) and IT departments to monitor and manage networks and devices from a centralized web-based console. N-able has announced two vulnerabilities that allow authenticated attackers to inject commands due to improper sanitization of user input and execute commands on unpatched devices by exploiting an insecure deserialization weakness. The vulnerabilities are reportedly under active exploitation.
Hundreds of TeslaMate setups are exposed online with no authentication, leaking GPS, vehicle, and charging data. Attackers can track vehicle locations and patterns, presenting serious privacy and physical security risks for Tesla owners. The fix is to secure deployments with authentication and firewalls.
Researchers found critical vulnerabilities in Axis Communications' surveillance camera systems that could allow hackers to remotely access, control, and disable cameras at thousands of organizations. Axis has released security patches, and users are advised to update their systems right away to prevent exploitation.