Squid proxy vulnerability dubbed Squidbleed discovered
Squidbleed allows an attacker to read beyond the boundary of a memory buffer within Squid's FTP parser.
SC Media
20 articles
Attackers stopped fighting MFA. They are now targeting the enrollment step nobody monitors.
Attackers are bypassing MFA by targeting enrollment and trust workflows.
Veeam's Shiva Pillay: Ensuring data trust and contextualization for AI security
Veeam's Shiva Pillay discusses ensuring data trust and contextualization for AI security.
AI fuels faster, more convincing messaging scams, report finds
Nearly two-thirds of scam victims globally, or 64.5%, believe AI tools played a role in the fraud attempts.
Signal president warns about AI chatbot privacy risks
Per TechCrunch, Signal President Meredith Whittaker has voiced significant concerns regarding the privacy implications of widely used AI chatbots, emphasizin...
New Prinz Eugen ransomware targets recent files, avoids ransom notes
The Prinz Eugen threat actor employs a hands-on-keyboard approach, leveraging legitimate remote monitoring and management (RMM) software and living-off-the-l...
WordPress plugin Gravity SMTP exploited for sensitive information disclosure
The vulnerability resides in an exposed REST API endpoint within the Gravity SMTP plugin.
Federal data center law set to expire without a replacement
The Federal Data Center Enhancement Act of 2023, which currently governs federal facilities nationwide, mandates protections for uptime, power reliability, p...
Lessons from Identiverse 2026
The big lesson: too many organizations still don’t understand how identity works inside their applications.
Navigating Shadow AI in the Enterprise, Verizon's SECOND 2026 report, and the news - Ankita Gupta - ESW #464
LLMS, Identity, EDR, JiGong, QiLin, Warlock, with Rob Allen from Threatlocker... - Rob Allen - SWN #591
Malware campaign uses VirusTotal manipulation, legitimate news sites to gain reputation
The clipboard hijacker campaign also uses “ghost networks” on social media to boost engagement.
Agentjacking attack exploits AI coding tools with fake error reports
The Agentjacking attack bypasses the need for stolen credentials or direct network access.
Cloudflare blocked 38.5 billion cyberattacks against civil society organizations
The majority of attacks against these organizations were DDoS floods, with a notable difference in duration compared to attacks on Cloudflare's broader custo...
Icarus threat actors exploit Klue OAuth breach to steal Salesforce data
The attack involved the theft of OAuth credentials from Klue's Battlecards integration, which threat actors then used to access and exfiltrate data from cust...
Law enforcement disrupts SocGholish botnet and Evil Corp servers
Authorities from the Netherlands, Canada, the United States, and Germany removed the SocGholish malware and backdoors from 14,971 compromised WordPress websi...
Apple releases security update for Beats Studio Buds vulnerability
The vulnerability, identified as CVE-2025-20701, was discovered by researchers Dennis Heinze and Frieder Steinmetz of ERNW GmbH.
Nintendo confirms employee survey data stolen from third-party service
The Shadowbyt3$ threat group claimed responsibility for the incident, alleging the exfiltration of sensitive employee data, including bank statements and W-9...
BlackFog launches AI detection for macOS
The new ADX Vision for macOS targets the increasing use of unsanctioned generative AI tools within organizations.
Texas Parks & Wildlife data breach exposes millions of driver's licenses, passport numbers
The Texas Parks & Wildlife department disclosed that hackers gained access to its license system vendor, which processes hunting and fishing license sales.