Your incident count is missing a few incidents
If you run security for a brand with hundreds or thousands of locations, the tools you’ve bought may have little to do with whether an attack stays at one st...
general
20 articles
New infosec products of the month: September 2026
Here’s a look at the most interesting products from the past week, featuring releases from Akeyless, Akuity, Bitsight, BugBase, Cloud Range, Cohesity, Datami...
Bitget Confirms $351.6 Million Hack, Suspects North Korea’s Lazarus Group
Bitget confirms a $351.6 million theft, suspends withdrawals and says North Korea's Lazarus Group may be involved as investigators examine the breach in detail.
Private GitLab email addresses exposed in public documentation
These email addresses, part of GitLab's "Email work item to this project" feature, contain long-lived tokens that act as credentials.
New classical computing attack weakens RSA encryption
The newly discovered attack allows for RSA signature forgery without factoring the encryption key, a method previously thought impossible or prohibitively ex...
New ransomware group n0n escalates threats by targeting backups
Researchers at CyberXTron first observed n0n activity on September 18, with the group quickly establishing a Tor-hosted leak site and claiming over a dozen v...
Federal agencies fail to meet cloud security directive deadline
The inspector general for the Department of Homeland Security reported that 86% of agencies did not implement all mandatory SCuBA policies by the June 2025 d...
F5 patches critical zero-day flaw exploited in BIG-IP APM
The vulnerability, identified as CVE-2026-94127, is a heap-based buffer overflow affecting BIG-IP APM systems configured as OAuth Authorization Servers with ...
New EDR evasion technique proves difficult to detect
The technique, termed "process parameter poisoning," allows attackers to hide malicious code within the legitimate startup parameters of a Windows process.
Scammers impersonating police and government officials have stolen $1.6 billion
These sophisticated scams often involved unsolicited phone calls and sometimes video calls, with victims losing an average of $26,000 each.
Vicarius launches AI engine to write software flaw remediation scripts
ScriptAI addresses what Vicarius describes as a capacity issue in vulnerability remediation, rather than a discovery problem, citing the rapid emergence of e...
New Windows botnet offers AI credit draining and other attack methods
The botnet, sold by WraithTools, includes capabilities for credential theft, SOCKS5 proxying, and an AI module for malware persistence, Qrator Research Labs ...
Lookout launches social engineering protection for mobile devices
Mobile security company Lookout Inc. has launched Social Engineering Protection, a new module designed to analyze text messages and phone calls for signs of ...
House and Senate members propose legislation for CISA to step up cyber defenses for biotech
Biotechnology doesn’t have its own critical infrastructure designation, so the bipartisan group of lawmakers wants to make sure it’s protected like it. The p...
AI Will Save Us, or Not? - PSW #945
MacSync malware uses public iCloud calendars to deliver new payloads
A new variant of the MacSync malware targeting macOS systems now uses public iCloud calendar events to deliver new native payloads. [.
Ryuk Member Karen Vardanyan Sentenced to Two Years in U.S. Prison
Ryuk member Karen Vardanyan was sentenced to 24 months in U.S.
Autonomous AI Hacks Raise Thorny Questions of Legal Accountability
The prospect of legal accountability is unclear. Lawsuits are a possibility, but some legal experts believe any criminal investigations would face an extreme...
Digital forensics firm with US federal contracts covered up ties to Russia, DOJ alleges
Two executives at a data extraction and digital forensics company that sold several U.S.
Lawmakers introduce bill for voluntary telecom cyber rules after Salt Typhoon hacks
U.S.