Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Gene sequencing company Illumina agreed to pay $9.8 million to settle Justice Department accusations that it sold cybersecurity-vulnerable genomic sequencing systems to federal agencies between 2016 and 2023. The company allegedly lacked proper security programs and falsely claimed its software met cybersecurity standards.
Meta is co-sponsoring Pwn2Own Ireland 2025 (Oct 21-24), offering $1M for zero-click WhatsApp RCE exploits - registration closes on October 16.
Google's AI bug hunter, "Big Sleep," discovered its first 20 security vulnerabilities in open-source software such as FFmpeg and ImageMagick.
Over the weekend, a Redditor discovered that Proton's new Authenticator app for iOS was logging TOTP secrets to the local device.
Sponsored
Drawing from +3.6 petabytes of data [4], Flashpoint's 2025 Midyear Threat Index reveals a sharp acceleration in malicious activity and spotlights critical threats defenders must prioritize.
Chinese state-sponsored threat actor CL-STA-0969 conducted a 10-month espionage campaign that targeted Southeast Asian telecom networks. The campaign used custom malware, including AuthDoor, GTPDOOR, and ChronosRAT, to enable remote control and location tracking. The group deployed advanced evasion techniques, including DNS tunneling and traffic routing through compromised mobile operators, while maintaining high operational security. There was no evidence of data exfiltration despite the attackers installing multiple backdoors and scanning tools across critical telecommunications infrastructure.
Akira ransomware attacks targeting SonicWall SSL VPN connections have surged since July. Exploiting CVE-2024-40766 (CVSS 9.3) and unpatched SonicOS devices with disabled MFA, attackers rapidly escalate from VPN access to system encryption within hours, affecting hundreds of thousands of devices across multiple SonicWall generations. Organizations must immediately patch to the latest firmware, enable MFA on all VPN accounts, and restrict firewall management access to trusted IP ranges.
Cloudflare's Email Security team observed a new campaign in which threat actors abuse link-wrapping services from Proofpoint and Intermedia to phish users for Microsoft 365 credentials. Attackers abused Proofpoint link-wrapping in various ways, including multi-tiered redirect abuse with URL shorteners via compromised accounts. In the Intermedia campaign, threat actors sent a message impersonating a “Zix” secure message notification or a Teams notification that would redirect users to a fake login page to harvest Teams credentials.
An emerging pattern in kernel level attacks is to use a signed kernel loader to load a signed second stage kernel driver or reflectively load an unsigned kernel driver. These signed drivers are often signed via the Windows Hardware Compatibility Program (WHCP). The WHCP requires an extended validation (EV) certificate, which is designed to increase the security of the program. However, the EV certificate application process requires little human interaction, and there are dark web sellers of EV code-signing certificates.
Kubernetes handles authorization by utilizing multiple authorization providers in the cluster requested in the order specified to the kube-server as flags on startup. Each provider can explicitly approve or deny the request or respond with “no opinion.” If all providers respond “no opinion,” the request is denied. Providers include AlwaysAllow and AlwaysDeny, which allow or deny every request; Node Authorizer, which restricts the access of the kubelet user; Attribute-Based Access Controls (ABAC), which enables cluster-admins to define authorization rules based on the request's characteristics statically; Role-Based Access Controls (RBAC), which is the most commonly used provider and maps permissions to roles; and Webhook, which is widely used in cloud provider clusters like AKS, GKE, and EKS.
In this interview, Silent Push CEO Ken Bagnall discusses tracking Funnull, a Philippines-based company providing infrastructure for financial scams that cost US victims $200 million. The firm maps criminal networks for law enforcement but faces challenges when groups adapt to surveillance. Bagnall compares state-tolerated cybercrime to historical privateering, requiring national-level responses.
Docker Compose has announced the release of Provider services, which enables users to extend the capabilities of Docker Compose files by calling provider plugins that can interact with external services. This post includes an example of how to use the Telepresence traffic manager for a Kubernetes cluster.
Echo offers CVE-free container base images in a similar space to Chainguard or recently Wiz. Customers simply need to replace their Dockerfile base image with Echo's secure version without any other changes.
Playbook-NG is a stateless web-based application that matches incident findings with countermeasures for adversary containment and eviction. Users can export the results in numerous formats such as JSON, Microsoft Word, Excel, and Markdown. The application does not save information about the users or their inputs. Work is cleared when the user browses off or clears the playbook.
Anthropic revoked OpenAI's access to the Claude API after discovering ChatGPT engineers were using Claude Code tools ahead of GPT-5's expected launch next week. The incident highlights competitive tensions in AI development, with Anthropic's spokesperson noting that Claude Code has become the “go-to choice for coders everywhere,” including OpenAI's technical staff. Whether OpenAI used Claude Code to enhance GPT-5's coding capabilities remains unclear, but the timing suggests potential competitive intelligence gathering.
Lovense fixed two security vulnerabilities that exposed user emails and enabled account takeovers. CEO Dan Liu is considering legal action over disclosure reports, claiming no data was compromised despite the security hole.
Aim Labs has discovered "CurXecute," a high-severity vulnerability (CVE-2025-54135, 8.6 rating) in Cursor IDE that enables remote code execution through prompt injection. While fixed in version 1.3, earlier versions remain vulnerable, and attackers can exploit developer privileges via poisoned MCP data for ransomware, theft, or AI manipulation.
In a 59-35 Senate vote, Sean Cairncross has been confirmed as the Trump administration's first Senate-approved cyber official.
Shade BIOS is a UEFI malware technique that runs entirely in BIOS memory after OS startup, bypassing all security software, and operates as a parallel system.
Sponsored
Groups like FunkSec now use AI and LLMs to enable less technical actors to launch sophisticated campaigns, contributing to over $724 million extorted via TrickBot malware alone.
Everest ransomware group claims to have breached Mailchimp, stealing 767 MB of data containing 943,536 lines, including business information, domain names, company emails, and technology stack details. The leaked data appears to be structured business information from marketing or CRM exports rather than Mailchimp's internal systems, suggesting the breach may have targeted customer data rather than core infrastructure. Everest follows the double extortion model and previously breached Coca-Cola in May, though it remains a relatively obscure ransomware strain compared to major groups.
Apple patched CVE-2025-6558, a high-severity vulnerability in the ANGLE graphics layer that was actively exploited in Chrome zero-day attacks and allows remote code execution via malicious HTML pages. Google's Threat Analysis Group discovered the flaw in June, with Google patching Chrome on July 15 and CISA adding it to the Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by August 12. The vulnerability affects iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, and other Apple platforms, marking the sixth zero-day Apple has patched this year.
The UNC2891 hacking group (LightBasin) physically planted a 4G-equipped Raspberry Pi on a bank's ATM network switch to create covert remote access into the internal network. The attackers used this device as a pivot point to move laterally through the bank's systems, deploying backdoors and attempting to install their Caketap rootkit to spoof ATM authorization and steal cash. The heist ultimately failed, but demonstrated advanced anti-forensics techniques, including filesystem mounting to hide malicious processes from security tools.
SentinelOne's analysis of DOJ indictments revealed China's sophisticated tiered contractor ecosystem for cyber operations. Hafnium/Silk Typhoon operates through at least three companies directly tasked by the Shanghai State Security Bureau rather than opportunistic access brokers. Shanghai Firetech holds 10+ previously unknown patents for offensive tools, including Apple device forensics, smart home appliance control, and encrypted data recovery—capabilities far exceeding publicly attributed Hafnium TTPs and suggesting broader operational scope across multiple MSS regional offices. The research exposed critical attribution gaps where threat actor tracking focuses on behavioral clusters rather than organizational structures, with companies potentially selling capabilities to other MSS offices while remaining unattributed despite shared corporate ownership.
Bug bounty programs allow vendors to expand their security testing efforts with community hackers who can receive payment for their work. One issue with this approach is that, particularly in private programs, vendors control the disclosure timeline and may create an information gap. Government organizations should step in to regulate vulnerability disclosure with NIST drafting standards and metrics for bug bounty programs, CISA establishing a voluntary vendor accreditation program, as well as requiring federal agencies to comply with the standards, and the SEC to require publicly traded companies to report their bug bounty metrics.
Sponsored
Only one in 10 businesses could claim no identity-related incidents in the last year. Duo's _Ultimate Guide to MSP Operations_ [12]shows you how to:
The Kali Linux team has launched a Kali container that can be run through Apple's new container virtualization platform. The team has stated that there are some known bugs as well as limitations with hardware passthrough.
Thorium is a scalable file analysis and data generation platform that allows users to orchestrate arbitrary docker/vm/shell tools at scale. It was developed as a partnership between CISA and Sandia Labs.
Proton Authenticator is a free standalone 2FA app for Windows, macOS, Linux, Android, and iOS that doesn't require an account and features end-to-end encryption with cross-device syncing. The app supports easy import/export functions for TOTP seeds (including from Google Authenticator), automatic encrypted backups, and biometric/PIN locking. Unlike competing apps, it operates without ads, trackers, or vendor lock-in. The source code will be released on GitHub within weeks.
CISA has committed to releasing its suppressed 2022 U.S. Telecommunications Insecurity Report after Sen. Wyden blocked CISA director nominee Sean Plankey's confirmation until the document is made public. Wyden claims the report contains “shocking details” about telecom vulnerabilities that could have prevented the Salt Typhoon espionage campaign if released when written initially. The Senate passed legislation requiring the report's release within 30 days, while CISA provided no timeline beyond saying it needs “proper clearance.”
Google's Threat Intelligence Group has identified a wave of data breaches as being linked to the ShinyHunters group, debunking the belief that it was associated with ScatteredSpider. In these attacks, the attackers impersonated IT support staff in targeted vishing calls to persuade employees into visiting Salesforce's connected app setup page and then entering a “connection code” that linked a malicious version of Salesforce's Data Loader OAuth app.
A common metric of security program success is how much leadership is prepared to stick with the work over the long term. Security work tends to follow a cycle in which security issues are increasing so the company hires a security engineer to fix them, the engineer begins fixing the low hanging fruit and the number of issues declines, the engineer digs deeper and implements more logging, monitoring, etc and discovers more issues, management wonders why the issues have increased and fires the engineer. This can be mitigated by communicating that the situation will get worse in the short-term before it gets better in the long-term.
Sponsored
The managed services market is accelerating—projected to grow from $275 billion in 2023 to $372 billion by 2028. READY TO WORK SMARTER?
Microsoft is rolling out a new default background image for all authentication screens (personal accounts in August, Entra work accounts September 29) as part of its Fluent design modernization effort - this requires no admin action and existing company branding overrides will be preserved.
Dropbox has announced that it will shut down its password manager in a phased shutdown, with the service becoming read-only at the end of August followed by the mobile app being shutdown in September, and a full shutdown in October.
Sponsored
M&A deals move fast, but security can't be an afterthought. In this on-demand webinar, security leaders with experience handling over 30 M&As share insights on what every acquirer needs to know to protect their organization before and after the deal closes.
Lenovo is warning users about new high-severity BIOS flaws that could allow attackers to bypass Secure Boot on some IdeaCentre AIO and Yoga AIO models. The vulnerabilities may enable local attackers to execute arbitrary code in System Management Mode (SMM), a CPU mode that operates independently from the OS and hypervisor, allowing them to plant “undetectable” malware that bypasses OS-level defenses.
WordPress security firm Wordfence has reported an actively exploited, critical unauthenticated arbitrary file upload vulnerability in the premium WordPress theme ‘Alone.' The vulnerability stems from the theme's `alone_import_pack_install_plugin()` function, which lacks nonce checks, is exposed via a `wp_ajax_nopriv_hook`, and permits plugin installation via AJAX. Attackers exploit the flaw by sending a POST request with a remote source URL pointing to an attacker-controlled file with webshells or other payloads.
The SafePay ransomware group is threatening to leak 3.5TB of Ingram Micro data on August 1, nearly a month after the attack. Although Ingram Micro claimed containment and restored operations by July 9, the company's appearance on SafePay's leak site suggests that no ransom was paid.
IBM's 2025 breach report shows that global breach costs fell to $4.44 million while US breach costs reached a record high of $10.22 million. AI is emerging as both an attack vector and a defense mechanism, with 13% of breaches involving AI models due to inadequate access controls. Phishing has overtaken stolen credentials as the most common initial attack vector.
Reflectively loading modules is a technique to hide malware payloads injected via shellcode. Traditionally, the call stack cannot be convincingly spoofed due to missing unwind information. This post introduces a technique called DreamWalkers, which parses the PE structure to register unwind information via `RtlAddFunctionTable`, creating clean and convincing call stacks.
Sponsored
Looking to meet rising expectations? Unlock the next level of MSP efficiency with Duo's_ __Smarter Security Toolkit for MSPs_ [10].
Sponsored
Meet rising expectations and unlock the next level of MSP efficiency with Duo's_ __SMARTER SECURITY TOOLKIT FOR MSPS_.
shade is a system for detecting shadow SaaS and securely recording the credentials involved. It consists of a browser extension that reports SaaS logins to a backend server, enabling security teams to monitor and manage shadow SaaS.