Okta disclosed HollowByte, an 11-byte OpenSSL flaw that lets remote attackers exhaust server memory and trigger denial-of-service attacks. Okta’s Red Team disclosed a denial-of-service vulnerability in OpenSSL they named HollowByte, and the attack payload is exactly 11 bytes. A remote, unauthenticated attacker sends that payload and the server allocates up to 131 KB of memory…
Public exploits have been released for the critical “wp2shell” remote code execution vulnerabilities affecting WordPress Core, making it imperative that administrators patch their sites immediately. […]
The new Smart Play sets come with motion sensors, lights and sound. But does the legendary building system actually need this digital upgrade?
The 7.0.2 WordPress security release addresses one critical and one high severity security issue. The vulnerabilities reported to the WordPress security team include: CVE-2026-60137 – A facilitated SQL injection issue reported as a team by TF1T, dtro, and haongo CVE-2026-60137 – A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution…
Microsoft has observed a surge in attacks using the ACR Stealer malware to steal browser-stored passwords, authentication tokens, and sensitive documents from its enterprise customers. […]
Researchers found China’s Daxin rootkit and a new Stupig backdoor on a Taiwan firm’s network, suggesting a stealthy intrusion dating back to 2013. Symantec’s Threat Hunter Team found Daxin running on a compromised host at a Taiwan-based subsidiary of a multinational high-tech manufacturer in 2026. Daxin is a Windows kernel-mode rootkit that Symantec first documented…
As age verification laws expand worldwide, organizations face growing pressure to protect users’ privacy while meeting regulatory requirements. Incode explains how on-device age estimation verifies age without transmitting or storing facial images, reducing biometric privacy risks while supporting compliance. […]
The rise of products such as Moonshot’s Kimi K3 raises concern about the tech boom’s staying power.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-25089 (CVSS score of 9.8) Fortinet FortiSandbox OS Command Injection Vulnerability CVE-2026-39808 (CVSS score of…
The next iPad mini is rumored to feature an OLED panel and a more powerful processor. A new base iPad is also in the works.
Learn why Microsoft 365 security alerts are critical for detecting cyber threats, improving incident response, maintaining compliance, and protecting your organization’s cloud environment. Cybersecurity threats have become more sophisticated than ever before. From phishing campaigns and ransomware attacks to account takeovers and insider threats, organizations face a constant stream of security challenges. Businesses that rely…
The TRAC10 is a modern, efficient, and cost-effective flight training platform for professional flight schools
This post will discuss the fundamentals of insider risk management. Also, I will show you 10 security best practices for implementation. The frequency of security incidents caused by insiders is on the rise. The recent 2022 Cost of Insider Threats Global Report by the Ponemon Institute reveals that 67% of companies experienced between 21 and…
The startup is also raising capital at a $10 billion valuation in a separate round led by Sequoia.
Gemini, Google’s AI assistant, is supposed to make life easier for Android smartphone owners. But right now it may also be making life easier for anyone anyone who happens to pick up your phone. Read more in my article on the Hot for Security blog.
Zhuoying Chen, 27, and Haojie Zhang, 38, are accused of managing a network that transferred at least $43 million to China, based on information published by Bleeping Computer.
UAT-11795 utilizes novel tools, including the Python-based Starland RAT and the PowerShell-based WLDR agent, which operates entirely in-memory with encrypted beaconing and a Runspace execution engine.
The detained Russian, Aleksandr Yuryevich Ermakov, was apprehended in Armenia on June 28, based on a U.S. request.
The 2026 Cybersecurity Hygiene Report indicates that 64% of employees use unauthorized AI tools, expanding “shadow AI” and creating visibility gaps.
SoftBank’s “Patching as a Service” (PaaS), powered by a joint venture with OpenAI called SB OAI Japan, offers clients AI-infused remediation planning and vulnerability assessment.
New data from Lansweeper indicates that approximately 16.9% of Windows client devices, or one in six, continue to operate on Windows 10.
The macOS malware targets information stored locally on infected devices, including passwords, browser cookies, Apple Notes and Telegram Desktop session files.
Ernst & Young (EY) disclosed a data breach after attackers compromised a third-party IT support system containing client documents and tax information. Ernst & Young (EY) is disclosed a data breach linked to a compromised third-party support ticket system used by its IT teams. The platform stored support requests that may have included documents containing…
An anonymous HTTP request can run code on a WordPress site. The bug is in core, so a bare install with zero plugins is exploitable. Every 6.9 and 7.0 site was in range until Friday, when WordPress shipped 6.9.5 and 7.0.2 and enabled what it calls forced updates through its auto-update system. Adam Kues at…
The update, released on July 14, was halted after reports indicated that a number of Dell devices displayed a yellow exclamation point next to the Intel Innovation Platform Framework Processor Participant driver in Device Manager.
The breach was detected on April 23 when Ernst & Young noticed anomalous activity on its networks.
The medical device company stated that the breach did not affect other Abbott businesses, sites, or systems.
Attackers are repurposing an old spam evasion technique to bypass a new generation of AI-powered email security tools. Barracuda researchers say they have identified more than one million retail-themed phishing emails since April that use text salting — a method that hides large amounts of benign content inside messages to manipulate how automated security systems…
Abbott Laboratories is investigating two separate cybersecurity incidents after confirming unauthorized access to internal legacy Exact Sciences systems in its Cancer Diagnostics business, while also investigating a separate claim that attackers breached its LabCentral portal and stole company data. […]
As AI pumps up the volume of newly discovered vulnerabilities, continuous control validation lets security teams cut through the noise.
Eleven bytes will make an unpatched OpenSSL server set aside up to 131 KB of memory for a message that never arrives. On the glibc systems Okta tested, that memory is gone until the process restarts. OpenSSL shipped the HollowByte fix in June with no CVE, no advisory, and no changelog entry pointing at it.…
When chained together, the two vulnerabilities allow threat actors to gain root-level capabilities on SonicWall’s mobile access appliances.
The company would provide billions of dollars’ worth of data-center capacity under the arrangement, people familiar with the matter said.
Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack. The malicious package campaign, codenamed ViteVenom by Checkmarx, marks an expansion of ChainVeil, which was observed using an “unprecedented” four-tier blockchain-based command-and-control (C2) infrastructure spanning Tron,
IBM surprised investors Tuesday with an early warning that its second-quarter results will come in below expectations, sending the company’s stock plummeting roughly 25% and dragging other software and consulting names lower. For partners, this offers yet another data point about how enterprise customers make purchasing decisions in today’s market. Customers redirect spending toward scarce…
A vulnerability dubbed HollowByte allows unauthenticated attackers to trigger a denial-of-service (DoS) condition on OpenSSL servers with a malicious payload of just 11 bytes. […]
A cyberattack hit one of Japan’s largest food companies, Nichirei, disrupting logistics and shipments. The company is gradually restoring operations. Nichirei is one of Japan’s largest food companies, best known for its frozen food business. Founded in 1942 and headquartered in Tokyo, it operates globally through dozens of subsidiaries. The food giant confirmed that the…
When UltraViolet Cyber evaluated major trends across security threats in Q2, the landscape covered a lot of ground. Highly active threat actors, exploited vulnerabilities, ransomware operations, AI-driven social engineering, identity-based intrusions, and a fast-growing family of “Fix-type” attacks all shaped the quarter. But there was one pattern that kept showing up across categories that don’t…
CISOs at government organizations and universities have an unexpected ally coming to their aid: OnlyFans models. For some time, hackers have exploited weaknesses in the websites of universities or government departments to host scams or malware, using content stolen from the OnlyFans website as bait to attract victims. Now, according to security researchers at Upguard,…
A Go botnet called NadMesh turned up in early July hunting exposed AI services, and the operator’s own dashboard claims 3,811 unique AWS keys. A Shodan harvester keeps the scan queue stocked with ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio: the image generators, local model runners, and workflow builders that teams stand up fast…
OpenAI is selling its first hardware — without any help from Jony Ive. It describes the Codex Micro as a “command center for agentic work” but it’s really a 13-switch wireless keyboard customized to help developers keep tabs on what their Codex agents are doing. It costs $230. The keyboard has 13 mechanical switches (one…
Preventing these attacks requires collaboration across security, finance, HR, legal, and business leaders—not just the CISO
Cloud marketplace distributor Pax8 is advising Microsoft partners to prepare for a series of changes affecting Microsoft 365 pricing, cloud benefit redemption, and partner enablement as the company rolls out updates that could influence customer renewals and operational workflows. The guidance highlights Microsoft’s July 1 pricing changes, a new process for redeeming partner cloud benefits…
AI models left to both interpret and execute commands eliminate critical cybersecurity oversight.
Get cleaner air for less with the Blueair Blue Pure 211i Max air purifier for 20% off on Amazon right now.
Cybersecurity researchers have attributed the April 2026 DigiCert security incident to a threat activity cluster dubbed CylindricalCanine. Expel, which shared technical details of the event, described the threat actor as a sub-group of GoldenEyeDog (aka APT-Q-27, Dragon Breath, and Miuuti Group), a Chinese cybercrime group known for its targeting of the gambling and gaming sectors…
Dell’s XPS 16 screams ‘Premium laptop’ thanks to its sleek design, OLED screen, and powerful hardware.
Evaluation should start with the operating problem your organization needs solved
Microsoft addressed 722 CVEs this month once the 427 Chromium upstream relays are set aside — roughly three times a normal cycle and one of the largest single months in recent memory. Two vulnerabilities arrive under active exploitation: an elevation of privilege in Active Directory Federation Services (CVE-2026-56155), and an elevation of privilege in SharePoint…
State and local officials and election security experts largely panned a Thursday night primetime speech by President Donald Trump, saying it was reflective of White House “desperation” to find any credible evidence to support their claims that U.S. elections have been rigged against the two-term president. While the White House teased explosive new claims about…
Plus, the future of watching sports, how AI might actually help solve the next labor crisis and the woman mapping her biological data.
Government organizations are targeted by attackers who know agencies cannot afford disruption to public services
Ernst & Young is notifying customers of a data breach caused by the compromise of a third-party support ticket system used by its IT personnel. […]
WatchGuard Technologies, a unified cybersecurity organization for managed service providers (MSPs), recently unveiled new research which found that employee behavior has led to significant and sometimes unseen cybersecurity risks for small- and medium-sized businesses (SMBs). Unauthorized AI use creates visibility gaps The 2026 Cybersecurity Hygiene Report found that 64 percent of employees surveyed admit to…
The European Union is stepping up its actions against US tech giants under the Digital Markets Act, which is intended to ensure fair competition between digital platforms. On Thursday, the European Commission issued two rulings to limit Google’s dominance. The Commission ordered Google to open up the Android operating system to AI assistants other than…
The European Union is stepping up its actions against US tech giants under the Digital Markets Act, which is intended to ensure fair competition between digital platforms. On Thursday, the European Commission issued two rulings to limit Google’s dominance. The Commission ordered Google to open up the Android operating system to AI assistants other than…
23andMe has agreed to an $18m settlement with 42 US attorneys general over its 2023 data breach, including enhanced data protection requirements
A real three-day blackout revealed problems I never would’ve found on a power station’s spec sheet.
Cloud marketplaces are becoming one of the most important routes to market for enterprise technology. Omdia projects that hyperscaler marketplace sales will increase from $30 billion in 2024 to $163 billion by 2030 as more organizations use committed cloud spending, private offers, and consolidated billing to purchase software and services. For channel partners, however, AWS…
A pair of young men were sentenced to 66 months in jail for committing a cyberattack on the Transport for London that brought the network’s operations to a standstill in 2024, the United Kingdom’s National Crime Agency said Thursday. Thalha Jubair and Owen Flowers were arrested at their homes in September 2025, barely a year…
Linus Torvalds has a complicated relationship with AI, seeing both its good and bad points. But his latest remarks on the usefulness of AI may have raised a few eyebrows in open-source circles. Just a few weeks after the Linux founder complained that a “continued flood” of AI-generated vulnerability reports had made the Linux kernel…
I tested Samsung, Amazfit, and Doctor Fit blood pressure watches – and only one rivaled my Garmin Index BP Monitor.
Major Threats & Vulnerabilities Record Patch Releases and Actively Exploited Zero-Days Microsoft’s July 2026 Patch Tuesday addressed a record 570 vulnerabilities, including three zero-days and two under active exploitation. Of these, 59 were rated critical, many enabling remote code execution. Organizations are urged to prioritize patching actively exploited vulnerabilities, apply compensating controls, and validate patch…
Some of my favorite new features in iOS 27 are flying under the radar, but no less impactful.
Residential proxies are no longer the silver bullet they once were for carding. Flare explains why cybercriminals increasingly seek “clean” residential proxies and combine them with browser fingerprints, device profiles, and other identity signals to evade modern fraud detection. […]
The iPhone maker became the U.S.’s most valuable publicly traded company as investors are shifting focus from hardware supply to consumer execution.
An email that appears to contain a shipping document, payment request, or business proposal can infect a Windows…
North Korean threat actors linked to the Contagious Interview campaign have been observed employing steganography in SVG image files to conceal malicious payloads as part of a campaign using fake job postings and coding challenges. “Any user who ran the project ended up with a four-stage payload aligned with OTTERCOOKIE: a browser credential and crypto…
Dozens of former Apple employees now working at OpenAI have been put on notice after Apple reportedly sent legal letters ordering them to preserve documents and communications relevant to its trade secrets lawsuit against OpenAI. The Financial Times reports that “around 40” employees have been targeted with these letters, which repeat Apple’s claim that its confidential information…
China has created an international organization to set standards and introduce regulation for AI, inviting 28 other countries to join — but the US, a leading AI powerhouse is not part it. The World Artificial Intelligence Cooperation Organization (WAICO) was established by 29 countries, including China, Russia and Brazil, at a ceremony in Shanghai, China,…
Experts warn that an extinction event is coming for SaaS, thanks to AI disintermediation. Here’s why some vendors remain skeptical.
The White House launched Gold Eagle to coordinate vulnerability response in a new AI world, but multiple questions linger over how it’s being implemented.
Shark’s cloud-connected robot vacuums are currently exposed by an unpatched AWS (Amazon Web Services) IoT (Internet of Things) policy flaw that could turn one compromised device into a remote-control skeleton key for many others in the same region, with access to cameras, maps, and Wi‑Fi passwords. A researcher using the handle tokay0 took apart a…
A previously unknown ransomware strain called Spirals was used last month in an attack against an IT services company in South Asia, where attackers went from initial access to data theft and encrypting the network in less than 24 hours, according to Symantec’s Threat Hunter Team. Spirals encrypts files quickly after gaining a foothold Spirals…
Intelligence “too cheap to meter” could threaten the leading AI labs, while creating opportunity for their competitors.
Google Cloud incorporates key Wiz capabilities into an agentic defense platform to automate threat detection and remediation against AI attacks.
The European Commission on Thursday ordered Google to give rival AI assistants the same reach into Android that Gemini already has: the camera, the microphone, whatever is on screen, a wake word that fires with the display off, and the ability to drive other apps in the background by imitating taps and typing. Google has…
Military forces are under increasing pressure to field autonomous capabilities faster than ever before. Across the U.S., UK, and NATO, new investment, evolving defense strategies, and accelerated acquisition pathways are transforming how capability is delivered, rewarding programs that can move from concept to operational deployment at commercial speed. Now the focus shifts to the trusted
A security researcher using the “Nightmare Eclipse” handle has released a Windows zero-day exploit dubbed LegacyHive that allows attackers to escalate privileges on up-to-date Windows systems. […]
An automated chatbot working for Anthropic this month shot down a Wiz researcher’s security hole report, saying that it “falls outside of the Claude Code threat model.” That was news to the security researchers at Wiz. It also turned out to be news to Anthropic execs, who had a very different view. In reality, Anthropic…
Armenia has held a Russian tourist named Aleksandr Ermakov in a detention center since June 28, on a U.S. extradition request for a REvil ransomware suspect named Aleksandr Ermakov. His wife, Maria Yurova, told REN TV that border officers pulled him out of the departure hall at Yerevan’s Zvartnots airport, held up a phone with…
GitHub is rapidly becoming the go-to platform for sharing software. Originally built for developers to collaborate on code, it now hosts millions of projects ranging from hobby scripts to widely used applications. That popularity, however, has also made it an attractive delivery platform for cybercriminals. For most home users, GitHub is not something you need…
Apple is warning iPhone and iPad users that scammers are using FaceTime calls to trick them into handing over money and account details. The company says scammers use social engineering, posing as representatives of a trusted company or entity, and contacting people by phone or other means to talk them into giving up sign-in credentials,…
1Password has introduced 1Password for Claude, a beta integration that lets Anthropic’s AI assistant complete browser tasks requiring authentication without accessing users’ passwords or other secrets. The integration is available to paid Claude subscribers (Pro, Max, Team, and Enterprise) using Claude Desktop on macOS and to 1Password customers on individual, family, and business plans. It…
Microsoft announced that Windows Server 2022 will reach the mainstream end date in October 2026, but will switch to extended support and continue receiving security updates for five more years. […]
