Arista patches VeloCloud Orchestrator zero-day exploited in attacks
Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in a...
general
20 articles
Microsoft debuts AI cybersecurity offerings as competition heats up
It includes the new agentic model MAI-Cyber-1-Flash and the Project Perception platform, with the tech giant claiming it’ll do a better job than its rivals a...
Trump asks Supreme Court to let him curtail mail-in voting ahead of midterms
In a Monday filing, the Justice Department said states sued before agencies even decided how the order would work. The post Trump asks Supreme Court to let h...
How to Design Segmentation That Actually Reduces Blast Radius
Does movement between these zones require explicit authorization or can it proceed on implicit trust?
Reuters: OpenAI Agent Hacked Hugging Face for Days Before Being Detected
Reuters says OpenAI failed to detect its AI agent hacking Hugging Face for days, discovering the breach only after FBI involvement.
GitHub and PyPI implement new security measures against supply-chain attacks
Based on information from Bleeping Computer, GitHub and the Python Package Index (PyPI) have introduced new time-based security mechanisms within their devel...
Russian hackers exploited Zimbra zero-day in espionage campaigns
Russian state-sponsored cybercriminals exploited a zero-day vulnerability in the Zimbra email and collaboration platform to conduct espionage against Western...
New Dysphoria DDoS botnet spreads to 200k devices worldwide
A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traf...
New Certighost PoC exploit lets attackers hijack Windows domains
A proof-of-concept exploit for "Certighost," a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated at...
Microsoft Fixes Certighost Flaw That Allowed Domain Controller Impersonation
Certighost allowed a low-privilege domain user obtain a valid Domain Controller certificate through AD CS. Microsoft patched the issue in the July security u...
Steam forums used for ClickFix cryptominer attacks
In a report by Bleeping Computer, threat actors are exploiting Steam discussion forums to distribute cryptominers through a social engineering tactic known a...
The enduring mystery of hacker Phineas Fisher
As outlined in TechCrunch, the enigmatic hacker known as Phineas Fisher remains one of the most elusive and impactful figures in cybersecurity, a decade afte...
Outdated VPNs should be purged from federal agencies, senator says
Intelligence Committee member Ron Wyden wants CISA, OMB and NIST to lead a federal effort to rout out obsolete VPNs from the U.S.
Malvertising campaign assembles malware in browser
A large-scale malvertising campaign is using fake websites for Solana, Luno, and TradingView, employing malicious JavaScript to assemble malware directly in ...
Phishing attacks on insurance companies evolve to real-time account hijacking
Phishing campaigns targeting financial institutions are evolving from credential harvesting for later use to real-time account hijacking, based on informatio...
Scammers impersonate ShinyHunters in new sextortion email campaign
Following insights from Bleeping Computer, threat actors are leveraging email addresses exposed in data breaches, previously leaked by the ShinyHunters extor...
Pope's prayer app leaks 700,000 user emails
The Click To Pray app, endorsed by the Pope and used by hundreds of thousands worldwide, was leaking user names and email addresses for months.
OnTrac parcel delivery company reports customer data breach
Bleeping Computer reports that the parcel delivery company OnTrac has experienced a data breach, potentially exposing customer personal details following a c...
Botnets powered by residential proxy networks are growing
Botnets powered by residential proxy networks are proliferating, enabling cybercriminals to evade detection by blending in with legitimate traffic, Lumen Tec...
Microsoft unveils MAI-Cyber-1-Flash, promises cybersecurity AI at half the cost
Microsoft has introduced MAI-Cyber-1-Flash, a security-focused AI model built into MDASH, the company’s multi-agent vulnerability identification and remediat...