Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
CloudSEK scours the surface, dark, and deep web to identify cyber risks, data leaks, identity theft, and other threats and helps organizations assess their cybersecurity posture from the attacker's perspective.
Ensure your password safety by scanning in real data breaches.
GhostLine is an AI-powered vishing operative. When a user feeds it a phone number, GhostLine uses a cloned voice to build rapport, gather intel, and extract credentials.
Research reveals AI-powered crypto trading bots can be manipulated through prompt injection attacks on ElizaOS, an open-source framework. Attackers can plant false memories in the bot's database, causing it to redirect payments to their wallets.
Researchers discovered dangerous default IAM roles in AWS services that grant excessive permissions like full S3 access. These roles enable attackers to escalate privileges and move laterally across services, potentially compromising entire AWS accounts. AWS has modified the AmazonS3FullAccess policy in response.
KrebsOnSecurity was hit by a huge 6.3 Tbps DDoS attack, likely as a test by a new botnet called Aisuru. The botnet uses hacked Internet of Things (IoT) devices and is linked to a person known as "Forky" who sells DDoS services online. Experts say releasing the botnet's code might weaken its power by creating more, smaller botnets.
A 19-year-old student was convicted of hacking PowerSchool, stealing data on millions, and extorting a ransom while threatening to leak the information.
The LockBit ransomware gang operates like a business by using affiliates for attacks, but most victims don't pay ransoms, and affiliates often fail to achieve results despite employing threats and pressure.
Sponsored
Whether you're starting from zero or trying to make sense of an inherited environment, this tactical web series [4] will take you on a step-by-step journey to fully secure your environment.
The UK's Ministry of Justice confirmed that cybercriminals stole extensive personal data from legal aid applicants dating back to 2010. The April attack exposed contact details, addresses, financial information, and criminal histories. Since 2010, all applicants have been advised to be vigilant against suspicious activity following the breach.
Serviceaide disclosed to HHS that 483,000 Catholic Health patients' personal and medical data were potentially exposed due to an unsecured Elasticsearch database between September and November 2024. While no confirmed data theft occurred, affected individuals will receive free credit monitoring and identity protection services.
Georgia's Harbin Clinic reported over 210,000 patients affected by a July 2024 cyberattack on its debt collection vendor, Nationwide Recovery Services. The breach exposed names, addresses, SSNs, birth dates, and financial information.
RAM can be a goldmine of real-time data for forensics experts. MemProcFS is a tool that organizes memory data in a virtual file structure that can be browsed and extracted. Volatility is another memory forensics tool that provides advanced capabilities such as advanced memory carving techniques, more detailed malware analysis, and reconstructing deleted or hidden processes. Tools like grep, strings, and bstrings can be used to identify artifacts in memory dumps.
When developing MCP servers, it is essential to understand the use case and identify the potential risks before delving into the design. This post provides a checklist of security considerations for designing and utilizing an MCP server and client. It walks through a lab environment testing an augmented LLM for threat detection, which uses VirusTotal and Alien Vault for threat intel, the ELK stack, and a series of Windows hosts, and tests the MCP Server in three threat scenarios.
On Azure, security teams can utilize log analytics and storage accounts to analyze logs and subscription groups and Entra ID for containment and conditional access. In AWS, CloudTrail and Athena can be used for log analysis, and separate accounts with cross-org access can be used for containment and conditional access. In GCP, logs explorer can be used for log analysis.
Sponsored
Nudge Security discovers every GenAI app in your org without the need for prior knowledge of an app's existence.
Twyn is a security tool that compares the names of your dependencies against a set of the most popular ones to determine if they are similar, preventing you from using a potentially illegitimate one.
The new Have I Been Pwned 2.0 website has launched with many improvements and new features. It includes a better search function, a dedicated breach information page, and a user-friendly dashboard. The site focuses on maintaining its helpful services while enhancing overall professionalism.
A collection of jailbreaks for all AI flagship models.
NHS England launched a cybersecurity charter asking suppliers to implement eight security commitments to combat increasing ransomware threats. Requirements include patch management, multi-factor authentication, 24/7 monitoring, immutable backups, and following the software code of practice. The NHS will support compliance through tools and contractual frameworks.
OpenAI published a new Safety Evaluations Hub, a web page showing how the company's models score on various tests for harmful content generation, jailbreaks, and hallucinations. OpenAI has stated that it may add additional evaluations in the future.
White hat hackers have been awarded $1,078,750 for 28 previously unknown vulnerabilities across operating systems, AI products, container software, browsers, virtualization software, and servers.
Hackers created a fake version of the KeePass password manager to steal data and install ransomware and spread it using ads and fake websites resembling real software pages.
Mozilla has addressed two critical vulnerabilities in Firefox discovered during the Pwn2Own Berlin 2025 contest, which could allow attackers to access data or execute malicious code, urging users to update immediately for safety.
Sponsored
Infostealers infected 23M+ devices in 2024, harvesting 2.1B stolen credentials. That's just one insight from Flashpoint's data-rich 2025
The report delivers expert-curated intelligence on adversary playbooks, including the TTPs of the five major ransomware-as-a-service groups responsible for nearly half of all attacks. On the solution side, it reveals how security teams can cut critical vulnerability patching workloads by 83% [4] by focusing on exploitability rather than severity scores.
A September 2024 ransomware attack on Business Systems House (BSH), ADP's Middle Eastern partner, resulted in the theft of Broadcom employee data. El Dorado/BlackLock claimed responsibility. Stolen data potentially included personal information, financial details, and employment records. ADP confirmed that only a small subset of clients in the Middle East countries were affected.
North American steel giant Nucor halted some production after hackers accessed its computer systems. The company is working with experts and police while restarting operations. No one has claimed responsibility for the attack, and the financial impact is still unknown.
A security researcher from Tenable discovered that a new release of its Mac desktop client included an AssemblyAI API key. This API key could be retrieved from the Electron app to enumerate and download any user's private meeting transcript. The researcher notified Granite, whose CEO responded by removing the offending API key and notifying the researcher that the vulnerability had only affected a smaller group of TestFlight users.
The European Union's cyber agency ENISA launched the European Vulnerability Database (EUVD), a new vulnerability tracking system with a numbering format that includes CVE references. Experts debate whether this additional database will help create redundancy or further fragment the vulnerability tracking landscape.
Busywork generators are solutions that create a disproportionate amount of busywork compared to the security value they add. They can be introduced due to not fully understanding the root cause of a security issue, prioritizing the wrong solution, and lacking organization-wide mechanisms to enforce the solution. Security teams can avoid busywork generators by introducing security guardrails and adopting a reasonable threshold of acceptable alerts.
Microsoft discovered a vulnerability in macOS that allowed applications to escape the App Sandbox without user interaction while researching macro exploit detection for Microsoft Office in April 2024. Security-scoped bookmarks are a macOS mechanism that bypasses the App Sandbox using explicit, persistent user choices. Microsoft researchers discovered that the Keychain entry used for security-scoped bookmarks can be overwritten to sign new bookmarks.
Sponsored
Stay ahead of evolving threats with actionable insights into our innovative tools that minimize risk, ensure compliance, and provide comprehensive visibility across your cloud environment.
Greenmask is a powerful open-source utility designed for logical database backup dumping, anonymization, synthetic data generation, and restoration.
A proof-of-concept reverse shell that abuses Windows' ClickOnce feature.
The dfc tool helps you migrate your Dockerfiles to use Chainguard Images.
The FBI warns of an ongoing scam where criminals use AI-generated voice deepfakes to impersonate senior US officials. The scam has targeted government officials and their contacts since April 2025. The attackers establish rapport before sending malicious links. Officials advise verifying identities independently and watching for subtle imperfections in communications.
If passed, the Kids Online Safety Act (KOSA) would hold social media platforms accountable for protecting minors from various harms. Human rights groups fear censorship implications, while companies like Apple, Microsoft, and X support the legislation. Google and Meta remain opposed.
A Russian hacking group called Sednit is spying on Ukraine and its allies using email bugs and fake messages. It sends phishing emails that sneaks malware into webmail systems like RoundCube, Zimbra, and Horde.
Defendnot is a tool that deceives Windows into disabling Microsoft Defender by masquerading as a legitimate antivirus using a concealed Windows feature.
Hackers bribed Coinbase staff to steal personal data from some users, demanding $20 million, but Coinbase refused and instead offered the same amount for tips to arrest the criminals.
DevSecOps is transforming software delivery in the Department of Defense by enhancing agility, security, and effectiveness through software factories, continuous integration, and cultural changes.
The Australian Human Rights Commission reported that around 670 documents were accidentally made public, with at least 100 documents accessed by search engines. The documents come from submissions to its complaint form and feedback forms from the Speaking from Experience Project, Human Rights Awards 2023 nominations, and the National Anti-Racism Framework concept paper. The potentially impacted data includes full names, email addresses, residential addresses, phone numbers, employers and roles, work contact information, PHI, schooling information, religion, and photographs.
Security researcher Jeremiah Fowler discovered a publicly accessible, unencrypted, and non-password-protected database belonging to PrepHero, which is a platform to assist high school athletes with securing scholarships. The database contained over 3M records that included full names, phone numbers, physical addresses, and passport data of students, as well as contacts of parents and college sports coaches. Fowler also discovered a CSV file containing links to passport images of student athletes and a mail archive that included PII sent to coaches.
Coinbase reported that rogue contractors stole data from less than 1% of users and demanded a $20 million ransom. The breach included personal and account information but did not affect passwords or funds. Coinbase refused to pay and fired those involved. It is starting to boost security and support to protect users.
Sentinel One details some of the threats it faces as a security vendor. It has faced North Korean threat actors trying to infiltrate its organization via workers, threat actors probing its network and tools to develop bypasses, and Chinese state-sponsored threat actors targeting supply chains that impact Sentinel One customers. Sentinel One urges practitioners to distribute threat intel information across operational stakeholders to expand detection, integrate context into attribution activities, and expand supply chain threat monitoring.