Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks
Apache Tomcat 11.0.
general
20 articles
Fake Firefox Extension Hijacks Google Accounts Without Stealing Passwords First
A malicious Firefox extension masquerading as a PDF identity-verification utility has been found targeting Google accounts through session-cookie theft and a...
What to do first when you get 90 days to secure AI agent data
In this interview with Help Net Security, Kelly Herrell, CEO at Nol8, explains where AI agents create exposure inside organizations. The first thing to exami...
Your security program knows about the firewall, but does it know about the elevator?
By early August, attackers had hit water systems in at least seven U.S.
Ubuntu kernel CVE fixes are moving to a weekly release schedule
Ubuntu kernels will ship every week under a new release schedule from Canonical, which is merging its four-week cycle for regular Stable Release Updates (SRU...
Europe’s technology backbone is becoming a cyber target
Disruptive attacks on public-facing services, financially motivated cybercrime and compromises of shared technology providers are increasing cybersecurity ri...
Okta: Let's collaborate, not compete, on agentic AI security
Okta CEO Todd McKinnon called on the cybersecurity industry to develop common standards for agentic AI security.
CISA outlines improvement plan for CVE program
The white paper is the latest step in trying to create a “Quality Era” for the Common Vulnerabilities and Exposures (CVE) program as the number of CVEs surge...
Malicious bot traffic surges 124%, overwhelming website defenses
The "State of Bot & Agent Security Report" analyzed over a trillion requests, finding that scraping accounted for 70.9% of malicious bot traffic, increas...
D-Link warns of critical vulnerabilities in legacy DIR-822A routers with public exploit code
The first vulnerability, CVE-2026-86296, is a stack-based buffer overflow in the DHCP server component.
Okta enhances AI agent security with new platform features and Blueprint Alliance
Okta's new features, Agent Gateway and Shadow AI Agent Discovery for Endpoints, address the growing risks associated with AI agents gaining excessive access ...
Ransomware group PAYLOAD weaponizes Microsoft Active Directory for disruption
The PAYLOAD ransomware group targeted a manufacturing organization in the Middle East, gaining initial access via a compromised VPN account, Kaspersky reported.
Smashing Security podcast #486: Vibe-coded shops, and hackable Flock cameras
A store in Auckland vibe-coded itself a new website. Within hours, its inventory had somehow expanded to include a pair of crusty socks, an $850 banana, and ...
SideCopy threat actor targets Indian academic institutions with new attack methods
SideCopy, an advanced persistent threat group originating from Pakistan and active since at least 2019, has historically targeted Indian defense forces and g...
Worker stress increases due to AI-driven security threats
A recent report by Object First indicates that 91% of workers feel uncomfortably stressed by IT security risks, a seven percentage-point increase from last y...
Placeholder domain used in dev docs now serves ClickFix attacks
The "third-party.com" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page tha...
ZTE SmartLife platform vulnerabilities allow account takeover
Security researcher Mina Nageh Salama disclosed four critical vulnerabilities in the SmartLife platform, with the most severe, CVE-2026-86553, rated 8.8.
Americans’ views on data centers have turned more negative
American attitudes toward data centers have turned noticeably more negative over the course of 2026, according to a new Pew Research Center survey. 54% of U.
New RemControl Android banking malware targets users in Europe and Canada
A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV applic...
U.S. CISA adds Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its Known Exploited Vulnerabilities catalog
U.S.