Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
The UK Government announced that it plans to roll out passkey support for all its digital services this year as an alternative to the current SMS-based verification system. The UK's NCSC views passkeys as vital for transforming national cyber resilience.
The FBI alerts that the Silent Ransom Group is attacking law firms with scam calls and phishing emails to steal sensitive information.
Operation ENDGAME shut down major ransomware systems worldwide, removing 300 servers and 650 domains.
Chinese hackers took advantage of a critical vulnerability in Cityworks software used by U.S. local governments, allowing them to execute malicious code and remain undetected in affected systems.
…all led by a team of expert certified testers.
Sponsored
As a 5 star rated, global certified CREST provider, ThreatSpike offers top-quality penetration testing at an unbeatable price. Get unlimited penetration testing for just $1,500 per month [4] and ensure your business is always protected.
Opexus, which provides software services for processing US government records, was compromised by two employees in an insider threat attack. The two brothers at the center of the breach had destroyed more than 330 databases and removed more than 1,800 files related to one government project. The FBI and other government agencies are investigating the incident.
West Lothian Council's education network suffered a ransomware attack by group "Interlock," affecting 143 schools and nurseries. Less than 10% of data was stolen, including personal information from lesson planning and potentially medical/social work records. The schools remain open with contingency plans.
Brazilian researchers scraped over 2 billion public Discord messages and published the anonymized data online. They anonymized the data by replacing usernames with pseudonyms, hashing user identifiers, and removing identifying features, yet some are concerned about its efficacy. The researchers intended to offer a message corpus for other studies. However, a Discord spokesperson noted that scraping violates the platform's terms of service.
GitLab's AI assistant "Duo" contained an indirect prompt injection vulnerability that allows attackers to manipulate it through hidden prompts in code. This could enable source code theft, phishing attacks, malware distribution, and data exfiltration. Duo's deep DevSecOps integration and browser-rendered Markdown responses create an unusually wide attack surface compared to typical AI coding assistants.
Agentic AI has changed how threat actors approach systems, enabling more customized, patient, and persistent campaigns. This post identifies ways that threat actors use AI agents across every stage of the attack chain from reconnaissance and initial access to pivoting, persistence, and exfiltration. It highlights the need for defensive tooling to adopt more agentic workflows to combat this threat.
A solution post from AWS on utilizing AWS Transfer Family and GuardDuty to scan files uploaded to an SFTP server. The workflow utilizes Lambda functions with Step Functions to move uploaded files to an S3 bucket, scan them with GuardDuty, clean infected files, and then notify the user via SNS. Terraform files are provided to deploy the solution.
Monkey365 is an Open-Source security tool that can easily conduct security configuration reviews for Microsoft 365, Azure subscriptions, and Microsoft Entra ID without the significant overhead of learning tool APIs or complex admin panels from the start.
QTap is an eBPF agent that captures traffic flowing through the Linux kernel before and after TLS/SSL encryption and then passes it to plugins to add additional context.
FBI Watchdog is a cyber threat intelligence OSINT tool that monitors domain DNS changes in real-time, specifically detecting law enforcement seizures (ns1.fbi.seized.gov and ns2.fbi.seized.gov). It alerts users via Telegram and Discord and captures screenshots of seized domains.
Signal is blocking Windows 11's Recall AI feature from screenshotting its app by default, using a DRM API intended for copyrighted content. Recall captures screenshots every three seconds, potentially exposing private conversations. Signal took this step because Microsoft does not provide proper developer tools to prevent apps from being indexed by Recall.
Ireland's Data Protection Commission approved Meta's plan to use European users' public social media posts for AI training starting May 27, despite ongoing legal challenges. Privacy group noyb and German courts are fighting the decision, arguing Meta's "legitimate interest" justification violates GDPR requirements for explicit user consent.
After a security researcher purchased a new Volkswagen and found that they were locked out of connecting to the app, they decided to attempt to brute-force the app and discovered further vulnerabilities after succeeding. The researcher discovered that the app leaked credentials for other services, such as Salesforce and the owner's personal details and vehicle service history, which could be accessed with only a VIN. The researcher coordinated with Volkswagen, and as of May 6, they were able to verify the fix.
Microsoft and law enforcement seized 2,305 domains operating Lumma info-stealer malware found on 394,000 Windows PCs globally, stealing passwords and cryptocurrency wallets from infected systems.
A hacker known as ByteBreaker has purportedly offered for sale 1.2 billion Facebook user records obtained via an API, though experts have noted discrepancies in the figures and sample data, leading to skepticism.
Cloudflare has launched 13 new MCP servers that let users access tools, data, and features through natural language.
Sponsored
Heard of LUCR-3 — AKA Scattered Spider, UNC3944, or Roasted Oktapus? You should: this threat actor has recently infiltrated the cloud environments of multiple Fortune 1000s.
Distributed Denial of Secrets published 410 GB of data that it stole from TeleMessage, an Israeli firm that makes modified versions of chat apps such as Signal and centrally archives messages. Some heap dumps include plaintext metadata, while others only include metadata, including sender and recipient information, timestamps, and group names. Due to the sensitive nature and PII in the messages, DDoSecrets only shared the data with journalists and researchers.
After a former developer for the Ransomware-as-a-Service operator VanHelsing attempted to sell the source code for the VanHelsing affiliate panel, data leak Tor sites, and builders for the Windows and Linux encryptors, VanHelsing proactively released the source code itself. The leaked source code includes the Windows encryptor, which will require modifications for other threat actors, and the source code for the affiliate panel and blog site, which can be run as is. The data VanHelsing leaked was only a subset of what the former developer attempted to sell, as it did not include any databases or the Linux builder.
Coinbase reported that 69,461 customers had personal and financial data stolen during a six-month breach. Hackers bribed support staff, stealing names, addresses, ID documents, account balances, and transaction histories. Despite a $20 million ransom demand, Coinbase refused to pay.
In AWS IAM, trust policies reference ARNs in their JSON but reference an underlying, immutable principal ID, so if a role is deleted and recreated, the trust policy will also need to be recreated, even if the ARN is unchanged. This provides a security benefit in that if a role is deleted but the trust policy is unintentionally not updated, the role cannot be stealthily recreated and assume the same level of trust. Users can get around this issue by using a complete account as the principal in a trust policy with a condition block that restricts access to the specific role ARN.
In the era of AI agents, not all bot traffic is malicious. Cloudflare proposed two mechanisms for “good bots” to self-identify. The first is HTTP Message Signatures, which adds a Signature-Input header with a signature, validity period, usage tag, and a Signature-Agent header to locate the key. The second option is a new TLS flag, req_mTLS, which allows clients to indicate support for mutual TLS and identify the bot.
CI/CD pipelines automate software development but introduce security risks like supply chain attacks and misconfigurations. Wazuh, an open-source security platform, enhances CI/CD security through log collection, file integrity monitoring, custom security rules, and more. This post dives into how to use it.
Sponsored
Keep up to date with the latest developments, threats, and solutions in Industrial Control Security: Register for 3 days of immersive content at ICS Security Summit & Training [11] ($795 for in-person, FREE online), then download the free white paper to learn about the Five ICS Cybersecurity Critical Controls [12] - your field-tested framework for building a stronger, threat-informed defense strategy.
A collection of detection rules for security monitoring with detailed descriptions of log fields used for threat analysis within Okta environments.
WPAUDIT is a hyper-configurable, modular WordPress security auditing suite engineered to automate and streamline identifying vulnerabilities and security weaknesses in WordPress installations.
Pocket ID is a simple OIDC provider that allows users to authenticate services with their passkeys.
This post reflects on budgeting issues with security products and shares an experience with negotiating vendors down to under 10% of initial quotes. It recommends using Google Ads to uncover competitor concerns and obtain competing quotes while downplaying the proposed solution's value. The post also highlights tactics like applying pressure and providing the sales rep with the hope of a purchase.
Marks & Spencer expects a £300 million hit to next year's profits from its ongoing cyberattack, partially offset by insurance and cost mitigation. The month-long breach will force online sales offline until July, impacting food availability and operations.
With user consent, Chrome will soon automatically change weak passwords, helping improve security on supported websites without requiring manual updates.
Microsoft and global law enforcement dismantled Lumma Stealer, a significant malware, by seizing over 2,300 web domains to prevent it from accessing infected devices.
Russia intends to require foreign residents in Moscow to install a tracking app on their phones to gather data such as location, fingerprints, and facial images.
Sponsored
Infosec and IT professionals experience the same concerns, but often hold them in silos. PDQ set out to break down the barriers and share insights amongst aligned allies.
After receiving a new direct-to-film printer from China-based Procolored, YouTuber Cameron Coward engaged with cybersecurity researcher Kirsten Hahn after his computer was infected by malware. Hahn discovered that 39 files for products on Procolored's Mega.nz account triggered malware detections for a cryptocurrency wallet stealer and an XRed backdoor for Windows PCs. Hahn suggested that the company may not have intentionally introduced the malicious files, as the C2 server for XRed backdoor is offline.
A threat actor tracked as Hazy Hawk is hijacking abandoned DNS CNAME records pointing to abandoned cloud services to distribute scams, fake apps, and malicious apps. Hazy Hawk scans for domains with dangling CNAME records, then registers a new cloud resource with the same name as the abandoned CNAME, and finally creates hundreds of malicious URLS under it that redirect users to scam sites. It has hijacked subdomains from cdc[.]gov, ted[.]com, nyu[.]edu, and unicef[.]org among others.
UK telecom Virgin Media O2 fixed a security flaw in its 4G calling that revealed users' location data to callers. Researcher Daniel Williams discovered that call signaling messages contained IMSI, IMEI, and cell ID data that could pinpoint recipients' locations within 100 square meters in urban areas.
Artist Antoine Schmitt describes a phishing attack that he was a victim of which led to installing the AMOS infostealer. Schmitt was contacted by a threat actor masquerading as a very professional journalist for a magazine called Artscope Magazine. The journalist had Schmitt download and install a trojanized video app that executed an AppleScript payload to download and run the infostealer.
While SCCM gets security attention, Microsoft Deployment Toolkit (MDT) often exposes similar vulnerabilities. Misconfigured MDT deployment shares frequently allow unauthorized access to credentials stored in configuration files, task sequences, and scripts. These credentials can potentially grant domain admin access or control over deployed systems.
Many MCP environments rely upon long-lived credentials such as API keys, but they store them incorrectly in world-readable files or get leaked via chat logs. The community-provided MCP server for Figma even stores its credentials in a world-readable and world-writeable file that attackers can use for session fixation attacks. OAuth should be implemented in MCP servers for apps that support it, and other MCP servers should consider using OS native credentials stores such as macOS Keychain and Windows' Credentials Storage API.
Sponsored
Drata delivers the world's most advanced Trust Management platform – making risk and compliance accessible, continuous, and 10x more automated than ever before.