Attention: You are using an outdated browser, device or you do not have the latest version of JavaScript downloaded and so this website may not work as expected. Please download the latest software or switch device to avoid further issues.
A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thous… More...
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it's unclear how the key… More...
A developer's GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting users. More...
Those closest to executives must match their security postures because the weakest link in a family can become the entry point for attacks. More...
A bug in Claude Code Desktop's preview pane can allow adversaries to quietly steal credentials from developers, including SSH private keys, AWS creden… More...
Don't buy the hype! AI has been dumbing down cyberattacks, and serious threat actors are barely touching it. More...
Organizations don't need better vulnerability scanners; they need to know who owns their assets and has the authority and capacity to actually fix the… More...
Threat actors are now hiding payloads by using DNS TXT records and browser cache pre-fetching, making it tougher to spot early attack stages. More...
A purported ad-blocker exfiltrates reams of sensitive information and benefits from having Google's stamp of approval despite researcher warnings. More...
The "third-party[.]com" domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while disp… More...
Microsoft seized 50 websites and disabled more than 150 domains as part of a coordinated disruption effort against a phishing-as-a-service platform ta… More...
A process parameter-poisoning technique evades EDR by injecting code into process initialization structures without using the Windows APIs that EDR to… More...
MFA is essential, but it cannot replace OAuth governance, least-privilege scopes, consent monitoring, and rapid revocation. More...
Threat actors behind the "Phantom Deal" campaign are studying companies in extreme detail, aiming to dupe midlevel employees into initiating large fin… More...
The "Spring Ring" operation aims to compromise users of the collaboration suite to remotely access their sessions, spread malware, and even take over … More...
Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Te… More...
OpenAI's Hugging Face attack postmortem shows agents don't care about rules — they need strong controls. More...
An untold number of ZBT routers sold around the world as white-label products come with several implants built by the manufacturer. More...
The latest version of the Android malware has new features that expand its global reach and put more than users' financial applications at risk. More...
The new AI security controls follow the Hugging Face incident last month, though experts say many of these additions should have been in place prior t… More...
A lack of technical details could make it hard for organizations running self-managed GitLab versions to detect potential exploitation of CVE-2026-194… More...
