Ransomware Groups Increasingly Deploy EDR Kill Techniques
Halcyon’s latest quarterly ransomware report showed that while ransomware attacks are declining, obfuscation techniques are getting harder to fight against
general
20 articles
Phishing the agent: Why identity controls are essential to secure and manage AIs
Guardrails cannot serve as the primary security boundary for AI agents. Identity controls impose firmer limits.
DentaQuest Data Breach Potentially Impacts Over 23 Million People
In May 2026, hackers stole personal and dental health information from DentaQuest’s computer network. The post DentaQuest Data Breach Potentially Impacts Ove...
AWS gives DevOps teams an AI investigator for firewall incidents
AWS DevOps Agent helps administrators inspect logs, review firewall rules and network paths, identify configuration changes that caused AWS Network Firewall ...
Exploring AI Network Protocols; Vulnerability Truths and Guarantees; and the News - O'Shea Bowens, Jeremiah Grossman - ESW #469
TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments
Cybersecurity researchers have flagged fresh malicious cyber activity by a threat actor with ties to East Asia targeting government entities in the Middle Ea...
Iranian Hackers Exploit Rockwell, Schneider and Siemens PLCs Across U.S. Critical Infrastructure
Iranian-affiliated advanced persistent threat (APT) actors are actively exploiting internet-connected programmable logic controllers (PLCs) from major indust...
Windows WalletService Flaw Lets Standard Users Gain SYSTEM Privileges
Microsoft Windows WalletService is affected by a local privilege escalation vulnerability tracked as CVE-2026-49176. This flaw could allow a standard authent...
New usbliter8 SecureROM Exploit Enables iOS 27 Jailbreak on iPhone 11 Pro
A new developer-focused project, usbliter8-fun, showcases an iOS 27 jailbreak workflow specifically for the iPhone 11 Pro. It combines the usbliter8 SecureRO...
GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption
GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a release is published before opening a pull...
Microsoft Introduces KMS Hardware-Secured for Windows Server Activation
Microsoft has introduced KMS Hardware-Secured, an upcoming enhancement to Windows Server activation that utilizes Trusted Platform Module (TPM)-based attesta...
AWS Launches Claude Opus 5 With Advanced Agentic Coding and Cybersecurity Capabilities
AWS has launched Anthropic’s Claude Opus 5 on Amazon Bedrock and the Claude Platform, introducing a groundbreaking model designed for agentic coding, complex...
Apple Biome Data Reveals Safari Activity, Wallet Transactions and Location Visits
Apple’s internal Biome framework is rapidly emerging as one of the most valuable sources of forensic intelligence on iOS, with newly analyzed data revealing ...
Claude Code Symlink Flaw Exfiltrates Sensitive Files Without User Approval
Claude Code has a flaw in its startup memory loader related to handling symbolic links (symlinks) that can unintentionally expose readable files from outside...
Marathon Petroleum’s CISO on OT security automation, supply chain risk
In this interview with Help Net Security, Mary Rose Martinez, CISO at Marathon Petroleum, talks about what happens to security when automation reaches deep i...
LockBit5 and Qilin Lead Ransomware Attacks Against Italian Organizations
A new report links 148 ransomware attacks to Italian organizations in H1 2026, with manufacturing the most targeted sector. Six months, 148 confirmed ransomw...
SparkKitty Monitors Mobile Photo Galleries and Exfiltrates Sensitive Images to C2 Servers
SparkKitty is a cross‑platform mobile stealer that weaponizes users’ photo galleries, using OCR to extract sensitive text from images and silently exfiltrati...
Nono: Open-source sandbox for AI agents
An AI coding agent opens a terminal, reads a config file, and finds a live cloud key sitting in plaintext. It runs with the permissions of the person who lau...
PyPI Blocks New File Uploads to Old Releases to Prevent Package Poisoning Attacks
PyPI has introduced a new supply-chain security control that prevents publishers from uploading additional files to package releases older than 14 days, redu...
BlueNoroff Fake Meeting Kit Captures Webcams, Disables Defender and Steals Cryptocurrency Credentials
BlueNoroff, a financially motivated threat cluster linked to the Lazarus Group, has been observed deploying a highly sophisticated “fake meeting” phishing ki...