Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts
The U.S.
general
20 articles
Storm-1175 Launches StormEncryptor Ransomware Attacks Using N-able Security Flaw
Microsoft Threat Intelligence has identified a new ransomware campaign attributed to the financially motivated threat actor Storm-1175 that began deploying a...
Bugcrowd's Braden Russell on launching Pathseeker
Russell on launching Savant Pathseeker, the first product in its new Agentic Offensive Testing line.
Forcepoint's Ronan Murphy on securing the data layer AI just set on fire
Murphy on why data trust is the foundation of the agentic era.
Fortra's Josh Davies on the evolving exploitation of trust
Davies shares insights from original FIRE research, while also digging into trends.
Keyfactor's Ellen Boehm on enterprise AI at scale
Boehm discusses why organizations need to build a resilient foundation for securing AI across increasingly dynamic environments.
Friday Squid Blogging: Arctic Bobtail Squid Video
Nice video of the Arctic bobtail squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Sci-Fi, PKD, Greatness, Passkeys, AgentBreaker, Rockwell, Flock, Josh Marpet - SWN #605
Metabase SQLi zero-day exploited in customer data-theft attacks
A critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft attacks, known to impact Framewo...
Unlimited Technology Systems breach impacts 3.8 million people
Healthcare software company Unlimited Technology Systems reported that more than 3.8 million people were impacted by a data breach incident that occurred in ...
Vishing group UNC6671 now focuses on extorting M&A firms
Experts urge managed-device logins and audit log monitoring to stop phishing-led cloud data theft.
Water utilities group partners with DEF CON offshoot for Water Watch Center
The National Rural Water Association and a group of cybersecurity experts have formed a program to help cash-strapped utilities face the increase in threats ...
Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware target...
ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets
ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCl...
UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
A recent wave of cyber attacks targeting financial services, private equity, and professional services is attributed to a data extortion group known as UNC66...
US cyber ambassador nominee Cassady confirmed in Senate
NTIA official Adam Cassady becomes the second person confirmed to be the State Department's ambassador-at-large for cyber policy.
Researchers bypass Spectre v2 mitigations
The attack exploits a time-of-neutralization to time-of-use (TONTOU) window in Spectre v2 defenses, where a gap exists between when the branch predictor is i...
Zbtlink denies backdoor claims amid firmware download pause
VulnCheck CTO Jacob Baines claims that Zbtlink routers are intentionally designed to communicate with command and control servers, a feature he calls a "phon...
Walmart faces lawsuit over alleged secret voiceprint collection in Illinois
The lawsuit, filed in the U.S.
AI coding tools vulnerable to malicious GitHub issues
Novee Security researchers discovered flaws in Anthropic's Claude Code, Google's Gemini CLI, and OpenAI's Codex.