Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
As part of Trump's One Big Beautiful Bill, $1B has been allocated for offensive hacking operations. These funds can be used for carrying out attacks using 0-days and installing spyware, but also for everyday expenses such as infrastructure and intelligence gathering. Critics note that the bill slashes funding from defensive operations such as the CISA, potentially leaving the U.S. unable to defend itself.
Broadcom has patched VMware vulnerabilities from Pwn2Own Berlin 2025, where researchers earned $340,000+ exploiting critical bugs in ESXi and Workstation, allowing code execution.
Operation Eastwood, a coordinated international law enforcement effort led by Europol, shut down over 100 servers belonging to the Russian pro-Putin DDoS group NoName057(16), arrested two individuals, and issued seven international arrest warrants targeting the group's 4,000+ members who conducted politically motivated attacks against Ukrainian and NATO-supporting websites.
Sponsored
SentinelOne has just released the 2025 Cloud Security Risk Report [4]. Learn the 5 latest cloud security risks and how to protect against them along with in-depth case studies and insights into attackers' methods and mindsets to uplevel your cloud security posture.
Episource, a UnitedHealth subsidiary, suffered a ransomware attack between January 27 and February 6 that exposed the data of 5.4 million patients, including medical records, diagnoses, medications, and insurance info. This is the second major breach for UnitedHealth in 13 months, following the Change Healthcare attack that affected 190 million Americans in February 2024. The attack suggests that threat actors are now targeting third-party healthcare providers to access large amounts of protected health information across multiple organizations.
Fitify, a popular fitness app, exposed 373,000 files, including 138,000 progress photos, via an unsecured Google Cloud storage bucket. Many of the photos showed users in minimal clothing, making the exposure highly sensitive. Additionally, private data was accessible without passwords or security keys, and the app contained hardcoded secrets that could have allowed attackers to access more user information.
Mobile Notary Zone (MNZ), a third-party notary service vendor, reported a highly sensitive data breach. The compromised data includes full names and addresses, SSNs, dates of birth, government-issued IDs, bank account and payment details, loan, employment, and escrow data. The breach also affected clients served by MNZ, prompting at least one provider (New American Funding) to terminate its relationship with them.
Hackers target home routers to use as residential proxies, command-and-control servers, and botnets. Recent ASUS breaches demonstrate that backdoors can survive updates. These attacks often brute-force default passwords or exploit vulnerabilities, then install SSH backdoors. Defenses include disabling WAN management and SSH, changing default credentials, enabling automatic updates, and auditing configs for unauthorized access.
Android malware "Konfety" employs sophisticated evasion tactics, including dual-app deception (same package name for benign and malicious versions), ZIP-level tampering to break analysis tools, dynamic code loading with encrypted assets, stealth techniques such as icon hiding, and the use of the CaramelAds SDK for ad fraud.
Matanbuchus, a Malware-as-a-Service (MaaS) loader that has been active since 2021, has evolved to version 3.0 with enhanced capabilities. Recent campaigns have used Microsoft Teams impersonation and Quick Assist for deployment. Updates include improved communication protocols, in-memory stealth, enhanced obfuscation, indirect system calls, broader execution support, and enriched data collection targeting EDR controls.
Sponsored
Watch 1Password's on-demand webinar [11] exploring proactive approaches to managing the sprawl of unapproved SaaS apps and AI tools.
The Go programming language has introduced native FIPS 140-3 compliance support directly into its standard library and `go` command, starting with Go 1.24. Developers can enable FIPS 140-3 mode by setting the `fips140=on` GODEBUG option (either as an environment variable or in go.mod), and can build against validated cryptographic modules using `GOFIPS140=v1.0.0 go build`. This native integration eliminates the need for unsupported third-party solutions, providing a seamless developer experience with cross-compilation support and no performance overhead from foreign function interfaces.
VulnerableCode is a free and open database of open source software package vulnerabilities.
SSH-Snake is a tool designed to perform automatic network traversal using SSH private keys discovered on systems with the goal of creating a comprehensive map of the network and its dependencies.
Cloudflare blocked 7.3 million DDoS attacks in Q2 2025, including a record-breaking 7.3 Tb/s attack. Most attacks were small and brief, but intense attacks are increasing. Attackers are using increasingly powerful botnets and targeting new industries and countries.
Hackers are concealing malware in DNS records, particularly TXT records, by converting binary files to hexadecimal and splitting them across multiple subdomains. This technique evades security defenses as DNS traffic is often unmonitored and has been used to deliver malware like Joke Screenmate and malicious PowerShell scripts.
UK cybersecurity firm Adarma has entered administration, the UK equivalent of bankruptcy, after investor Livingbridge withdrew funding three months earlier due to major contract losses. All 173 employees were made redundant with immediate effect on July 14. The company struggled financially despite charging daily rates of £740-£2,380 and serving clients with a combined turnover of £150 billion.
A Chinese state-sponsored hacking group known as Salt Typhoon breached a U.S. Army National Guard network, stealing sensitive data, including passwords and network diagrams.
Google patched CVE-2025-6558, a high-severity sandbox escape vulnerability in Chrome's ANGLE graphics layer that was actively exploited by attackers, marking the fifth zero-day Chrome fix in 2025.
Co-op's CEO confirmed that hackers stole the personal data, including names, addresses, and contact details, of all 6.5 million customers during a cyberattack in April.
Sponsored
Remote hiring, deepfakes, and interview-cheating tools create a dangerous opportunity for bad actors. Rigid identity verification at every step solves it, but makes life hell for your honest employees.
Murphy Law Firm is investigating a class action lawsuit against Century Support Services following a November 2024 data breach that compromised the personal information of 160,759 individuals. Exposed data includes Social Security numbers, financial account information, medical records, and driver's licenses. The firm is seeking damages for affected individuals whose sensitive information may now be available to cybercriminals.
The ransomware group DragonForce attacked US department store chain Belk in May, compromising the names and Social Security numbers of customers. The attack disrupted online and physical operations for days, with Belk's website still offline. DragonForce claims to have exfiltrated 156GB of data and made it publicly available, suggesting no ransom was paid.
The CISA is warning users of a new critical (CVSS 10/10) vulnerability in the Wing FTP software that is under active exploitation. The vulnerability stems from Wing FTP software not sanitizing usernames that contain a NULL byte and then constructing a Lua session file from the username, which can potentially include Lua code after the NULL byte. Huntress and Arctic Wolf have both recorded that they have seen attackers exploiting exposed servers to download and execute malicious files, perform reconnaissance, and install remote monitoring and management software.
This article introduces a four-part cybersecurity playbook on analyzing and exploiting Windows kernel drivers. It highlights the rising threat of BYOVD (Bring Your Own Vulnerable Driver) attacks, where attackers exploit legitimate but flawed signed drivers to bypass kernel protections.
The first part of Zach Allen's Detection Engineering Field Manual introduces the concept of detection engineering, which primarily focuses on detecting when a threat actor circumvents controls. Allen models SOC operations in three loops: Loop 1 identifies assets and utilizes controls to protect them, Loop 2 employs rules to detect threats and responds with containment, and finally, Loop 3 focuses on recovering and learning from incidents. A detection engineer can focus on one loop or all of them and should, at a minimum, possess some coding expertise and a customer-centric mindset.
Typage 0.2.3 introduces passkey-based file encryption using the WebAuthn PRF extension, allowing users to encrypt files that can only be decrypted with biometric authentication or hardware security keys. The implementation creates a new age recipient format (fido2prf) that binds each encrypted file to specific hardware credentials, requiring both the encrypted file and physical access to the authenticator for decryption. Files encrypted on one device can be decrypted on another through synced passkeys. A companion CLI plugin also enables this functionality with FIDO2 hardware tokens outside the browser.
Zip Security helps organizations implement security best practices and achieve compliance, while also managing their IT infrastructure to reduce service overhead and costs.
Falco is a cloud native runtime security tool for Linux operating systems. It is designed to detect and alert on abnormal behavior and potential security threats in real-time.
Patchman is a Django-based patch status monitoring system for Linux servers.
Meta fixed a security bug that allowed users to access other users' private AI prompts and responses by manipulating unique prompt numbers. Security researcher Sandeep Hodkasia discovered the vulnerability in December and received a $10,000 bug bounty. Meta deployed the fix in January after finding no evidence of malicious exploitation of the flaw.
On Tuesday, it was revealed that in 2022, a British official accidentally leaked data of Afghans who had applied to move to the UK under the Afghan Relocations and Assistance Program (ARAP). ARAP was set up for Afghans who feared reprisal from the Taliban. The impacted individuals are now being notified after a “super injunction” that prohibited discussion of the leak was lifted on Tuesday.
The UK's NCSC announced the launch of a new Vulnerability Research Initiative (VRI) to partner with external cybersecurity researchers. Researchers who partner with the program will be given objectives to identify flaws in specific projects of interest, assess proposed mitigations, and then disclose the flaws through the “Equities Process” procedure.
DOGE employee Marko Elez accidentally committed an xAI API key that had access to at least 52 different LLMs, an oversight that raises concerns, as Elez has access to various government databases, including SSNs.
Abacus Market, the largest Western darknet marketplace that facilitated an estimated $300 million in illegal drug transactions, has suddenly gone offline in what appears to be an exit scam where operators vanished with users' escrowed funds.
Scammers are tricking UK pet owners with fake emails asking for microchip renewal fees using real pet details stolen from insecure databases.
Sponsored
_Happening on __July 29th:_ [4] Join Brad Rumph, Tines' Field CTO, and John Vasanth, Principal Security Architect at Black Rifle Coffee Company, for a webinar [4] focused on the recent evolution of IAM and how orchestrating IAM processes drives measurable impact for your team. You'll learn:
Louis Vuitton suffered a cyberattack on July 2 that compromised the personal data of UK customers, including names, contact details, and purchase histories. Its Korean division was also targeted. This marks the third LVMH breach in three months, following attacks on Christian Dior Couture. No financial data was stolen, but experts warn the luxury brand's high-net-worth clientele faces heightened risks.
CISA revealed a critical vulnerability (CVE-2025-1727) in railroad End-of-Train and Head-of-Train protocols that allows attackers to send unauthorized brake commands via software-defined radio. Affecting all U.S. rail industry versions, the vulnerability stems from weak BCH checksum authentication that can disrupt operations or cause sudden stops. The American Railroads are developing new systems, while manufacturers like Hitachi Rail, Wabtec, and Siemens should adopt network isolation and secure remote access controls.
A serious SQL injection vulnerability (CVE-2025-25257) has been identified in Fortinet FortiWeb. The flaw allows unauthenticated attackers to execute remote code by writing malicious files to the server's filesystem, potentially leading to full remote code execution. Fortinet has issued patches for versions 7.6.4, 7.4.8, 7.2.11, and 7.0.11. Immediate application of these updates is strongly recommended due to publicly available exploits.
The security researcher in this blog analyzes CVE-2024-30088, a Windows kernel vulnerability that allows privilege escalation. They successfully chained it to escape Chrome's renderer sandbox by bypassing integrity level checks and job object restrictions. The exploit overwrites security descriptors to gain system privileges, then spawns a privileged shell with full control.
Anvil Secure's PQCscan is a free scanner that identifies SSH and TLS servers supporting Post-Quantum Cryptographic (PQC) algorithms. The tool scans for standardized PQC algorithms, such as X25519MLKEM768, and generates HTML reports to help organizations prepare for mandatory PQC compliance deadlines between 2030 and 2035. Available on GitHub under a BSD license, it currently performs capability detection without full handshake testing.
Frictionware is security tooling that forces security teams to spend more time onboarding the tool than focusing on generating results. Some anti-patterns that lead to frictionware are: complex onboarding, weak value proposition, and a lack of integration with existing tools. Frictionware can be avoided by avoiding onboarding altogether, focusing on build-in instead of opt-in, using forcing functions to compel onboarding when required, and working within existing centers of data and attention.
Sponsored
SafeBase and Drata are unveiling the next wave of Agentic AI innovation — designed to reshape how security teams scale trust, automate workflows, and move faster. Attending Black Hat this August?
Huginn Net combines p0f TCP fingerprinting with JA4 TLS client analysis, achieving the same detection accuracy as the original p0f tool while adding modern TLS fingerprinting capabilities.
AWS' Cyber Incident Response Team (CIRT) has launched a new catalog of tactics, techniques, and procedures that it has observed attackers using in AWS environments.