Know What's Happening in Cybersecurity
Know What's Happening in Cybersecurity
Cybersecurity Pulse
EMAIL DIGESTS
Daily
Every morning
Weekly
Tuesday recap
EMAIL DIGESTS
Daily
Every morning
Weekly
Tuesday recap
Ransomware and supply‑chain breaches surge across sectors
The Cyber Express reports a sharp rise in ransomware incidents and supply‑chain compromises. High‑profile attacks include a ransomware intrusion at Hasbro, a malicious package update that hit AI startup Mercor via the LiteLLM project, and a North Korean‑linked attack on the Axios JavaScript library.
Also developing:
The 2025 Year in Review product spotlight showcases six security‑focused solutions targeting education, enterprise, and financial sectors. Connect ONE’s ERP consolidates school data and grants first‑responder‑only access, while Genetec embeds cloud‑native audio into its Security Center SaaS for real‑time coordination. Johnson Controls debuts the Simplex 4017ES fire alarm unit with multi‑tone alerts, and Oncam introduces a cloud‑first AI video platform that unifies cameras with IoT devices. Suprema’s Q‑Vision Pro AI module tackles voice‑phishing and ATM fraud, and VIVOTEK’s Think Search turns video footage into searchable, AI‑driven insights.
The episode covers three security topics: TLS callbacks (Thread Local Storage) used by malware to execute code before a program's main function, a critical FreeBSD remote code execution flaw in the rtsold daemon that parses unsanitized DNS search lists from...
Hackers from the ShinyHunters subgroup of the Com stole more than 200 million PornHub user records and began extorting the site. At the same time, a critical Cisco AsyncOS zero‑day has been exploited since November with no patch available, threatening enterprise...
ESET has identified a new Chinese‑backed advanced persistent threat group, LongNosedGoblin, conducting cyber‑espionage against Japan and other Southeast Asian governments since 2023. The group leverages custom C#/.NET malware and uniquely abuses Windows Group Policy to drop payloads and move laterally...
The Trump administration’s 2025‑2026 policy agenda has dramatically reshaped U.S. cyber, privacy and law‑enforcement priorities. New directives such as NSPM‑7 and a FBI cash‑reward program broaden the definition of domestic terrorism to include political dissent, while travel‑screening rules force tourists...
Home‑care workers are increasingly sending unqualified friends or relatives to patient visits under false identities, a trend highlighted by recent fraud convictions and court cases in the U.S. and U.K. The Department of Health and Human Services reported 298 personal‑care...
TechCrunch’s 2025 cyber‑horror review highlights unprecedented breaches across government, enterprise and consumer sectors. The U.S. federal system faced multiple intrusions, culminating in the DOGE operation led by Elon Musk that accessed citizen records. ransomware gang Clop exploited a zero‑day in...
The episode announces the integration of AI‑powered threat intel platform Criminal IP into Palo Alto Networks’ Cortex XSOAR, enabling real‑time exposure intelligence and multi‑stage scanning within automated playbooks. It explains how this AI‑driven enrichment—covering IP/domain behavior, port exposure, CVE links, and SSL...
Artificial intelligence now powers 60 % of enterprise security stacks, accelerating data collection, anomaly detection, and risk scoring across the NIST CSF identify and detect functions. However, the article warns that AI’s nondeterministic nature makes it unsuitable for direct enforcement actions...
INE Security announced a strategic expansion across the Middle East and Asia, adding new academy partners in Saudi Arabia, the United Arab Emirates, Egypt, and other high‑growth markets. The company’s subscription‑based, hands‑on training platform—featuring unlimited virtual labs and the Skill...
The episode highlights a positive trend of fewer publicly exposed industrial control system devices and a roughly 50% drop in SSL 2.0/3.0 exposure, indicating improved server hygiene. It warns about a critical, unauthenticated remote‑code‑execution flaw in Hewlett‑Packard Enterprise OneView (CVSS 10.0) that...
SonicWall disclosed a medium‑severity zero‑day vulnerability, CVE‑2025‑40602, affecting the SMA1000 access platform’s management console. The flaw, rated 6.6 CVSS, is being actively exploited in chained attacks that also leverage the critical CVE‑2025‑23006 vulnerability. SonicWall released hotfixes in firmware versions 12.4.3‑03245...
Immigration and Customs Enforcement is renewing its Cyber Defense and Intelligence Support Services contract to broaden digital surveillance of employee activity. The updated agreement mandates continuous network monitoring, automated anomaly detection, and systematic archiving of logs from servers, workstations, and...
Iran’s long‑standing state‑level threat group, known as Prince of Persia or Infy, has resurfaced after years of apparent inactivity. SafeBreach’s latest report shows the APT has been continuously spying on Iranian citizens and dissidents across Iraq, Turkey, India, Europe and...
ESET has identified a previously unknown China‑aligned advanced persistent threat (APT) group, dubbed LongNosedGoblin, targeting governmental entities in Southeast Asia and Japan. The group’s hallmark is the abuse of Windows Group Policy to distribute a suite of custom C#/.NET tools,...
The FBI transferred a list of 630 million stolen credentials to Troy Hunt of Have I Been Pwned after seizing devices from a single suspect. Approximately 46 million of those passwords were new to HIBP, expanding its breach database. Security experts say...
The episode covers the latest social engineering threats, from AI‑driven virtual kidnapping extortion and celebrity impersonation scams to Google’s dual strategy of suing phishing operations while supporting new anti‑scam legislation and AI tools. It offers practical home‑network advice, emphasizing IoT...
The episode highlights evolving React2Shell attacks that now target less‑common endpoints and non‑Next.js applications, urging operators to assume compromise if systems remain unpatched. It also covers active exploits in Cisco Secure Email Gateway (UAT‑9686) and a SonicWall SMA1000 local privilege...
Cellik is a Remote Access Trojan offered as a service that automatically wraps malicious payloads around legitimate Android apps downloaded from the Google Play Store. The RAT provides full device control, including screen streaming, keylogging, file system access, and encrypted...
Enterprise computing is rapidly moving to the edge, with analysts forecasting more than $100 billion in annual edge spend by 2030. The proliferation of IoT, AI, 5G and data‑sovereignty mandates is pushing workloads beyond centralized clouds, creating latency, cost and compliance...
Exploitation attempts have surged around the React2Shell vulnerability, a CVSS 10.0 flaw in the popular React UI library. While researchers have published roughly 145 public exploits, many are AI‑generated proof‑of‑concepts that fail to trigger the flaw. These fake PoCs mislead...
_jvphoto_Alamy.jpg?width=1280&auto=webp&quality=80&disable=upscale)
Quantum key distribution is transitioning from laboratory‑scale, point‑to‑point links to multi‑node, carrier‑grade networks. Recent pilots in London and Paris, led by BT, Toshiba, HSBC and Orange Business, demonstrate real‑world QKD deployments combined with post‑quantum cryptography. Industry groups such as ETSI’s...
Cisco disclosed that Chinese‑linked hackers are exploiting a critical zero‑day vulnerability in its AsyncOS software, specifically targeting the Secure Email Gateway and Secure Email and Web Manager appliances. The flaw, active since at least November 2025, allows full device takeover and...
The blog highlights the growing convergence of cybersecurity and intelligent transportation, emphasizing that autonomous vehicles and connected infrastructure are becoming "data centers on wheels." It outlines three core risk areas—V2X communication vulnerabilities, AI‑driven sensor attacks, and infrastructure resilience—and presents strategic...
Attackers compromised AWS Identity and Access Management (IAM) credentials and used them to launch cryptomining workloads on Amazon EC2 and ECS within ten minutes of initial access. AWS GuardDuty flagged the activity, revealing a coordinated campaign that leveraged dry‑run API...
Edge AI is moving real‑time inference workloads from centralized clouds to embedded devices, demanding far greater compute, memory, and energy efficiency at the silicon level. Infineon’s Thomas Rosteck explains that this shift forces a redesign of trust models, embedding hardware‑root‑of‑trust...
Law‑enforcement officials from more than 40 African countries gathered in Algiers for Afripol’s sixth heads‑of‑national‑liaison meeting, focusing on cross‑border cybercrime, equipment standardisation, and investigator training. The forum highlighted a surge in digital adoption that has produced an average of 3,153...
A California high‑school junior, Vaishnav Anand, built an AI model to detect manipulated satellite imagery after becoming a victim of a personal deepfake. He presented his research at MIT’s IEEE Undergraduate Research Technology Conference, highlighting a largely unexplored field known...
The article likens SOC development to triathlon training, urging teams to boost data coverage, standardize evidence, and apply AI selectively. It highlights that limited retention (7‑14 days) hides attacker dwell time, and that inconsistent log definitions stall investigations. By extending...
Link11’s European Cyber Report identifies five 2026 cybersecurity trends that will reshape defense strategies across Europe. The report warns that DDoS attacks will increasingly act as diversion tactics, while API‑first architectures expose new misconfiguration and business‑logic abuse risks. It predicts...
Scattered Lapsus$ Hunters, linked to the ShinyHunters gang, announced an extortion attempt against Pornhub after stealing personal data of premium members through a breach at analytics provider Mixpanel. The stolen information includes email addresses, location, and detailed viewing activity such...
Researchers at Infoblox discovered that more than 90% of parked domains now redirect visitors to scams, malware, or unwanted software. The malicious redirects are triggered primarily for users on residential IP addresses, while VPN traffic often receives a harmless parking...
Link11 forecasts five cybersecurity trends that will shape European defense in 2026, highlighting a surge in DDoS attacks used as diversion tactics, growing exposure from API‑first architectures, and the shift toward integrated WAAP platforms. The report stresses that AI‑driven DDoS...
The second half of 2025 saw AI‑driven malware become operational, highlighted by PromptLock, the first known AI‑generated ransomware. Lumma Stealer’s presence faded dramatically, with detections dropping 86% after its May disruption. CloudEyE (GuLoader) exploded in prevalence, increasing thirty‑fold and serving...
The episode defines microsegmentation as a zero‑trust security method that isolates individual application workloads, enabling granular protection for each. It highlights how this approach reduces lateral movement risks within networks and supports compliance by enforcing policy at the workload level....
The episode reviews recent activity around the React2Shell exploit, noting that while variants continue to appear in SANS honeypots, the technique is largely mature and even Iranian actors are now merely scanning for it. It then delves into ongoing SAML...
The episode covered four main topics: how malware can exploit DLL entry points that run on load, the resurgence of ClickFix attacks using the obsolete finger command over port 79, a massive Apple patch addressing 48 vulnerabilities—including two actively exploited...
Xfinity’s xFi Complete is a premium add‑on for existing Xfinity Internet customers that bundles whole‑home mesh Wi‑Fi, advanced cybersecurity, unlimited data, and automatic gateway upgrades. The service relies on xFi Pods to eliminate dead zones and provides real‑time threat detection...
The FBI has supplied Have I Been Pwned (HIBP) with an additional 630 million compromised passwords, expanding the service’s corpus beyond the 1.26 billion monthly searches it already handles. Roughly 7.4% of these passwords—about 46 million—were previously absent from HIBP, boosting the database’s...
In this episode, the host recounts a recent phishing campaign that initially attracted many victims but was abruptly terminated, highlighting how even well‑executed attacks can fail due to unforeseen factors. The discussion underscores the importance of understanding the broader attack...
Credit‑check provider 700Credit disclosed a breach that compromised personal data of at least 5.6 million individuals, including names, addresses, dates of birth and Social Security numbers. The intrusion, traced to an unidentified actor, affected information collected from auto‑dealership customers between May...
The author argues that cybersecurity has failed to demonstrate value because it talks to the wrong audience with the wrong metrics. Instead of chaotic activity logs, security programs need products that convey safety and calm through concise narratives and evidence....
A Home Depot employee inadvertently posted a private GitHub access token, exposing hundreds of internal source‑code repositories and cloud‑based order‑fulfillment and inventory systems for roughly a year. Security researcher Ben Zimmermann discovered the token in early November, tested its privileges,...
A security researcher discovered that Hama Film, a photo‑booth maker owned by Vibecast, left customer photos and videos publicly accessible due to a flaw in its file‑storage website. The issue was reported in October, but the company has not remedied...
At Black Hat Europe 2025, Zero Science Lab highlighted a building‑management system used in over 1,000 global facilities that runs on an 18‑year‑old, publicly‑exposed software platform riddled with vulnerabilities. The talk traced the problem to a series of acquisitions that left security...
The episode covers three main topics: running the Gemma 3 AI model locally on modest hardware, a newly patched but undisclosed Chrome zero‑day vulnerability, and the SOAPwn flaw that lets attackers exploit .NET SOAP services via malicious file:// URLs. Guy Bruneau’s...
Enterprises are reallocating Q4 learning‑and‑development budgets toward hands‑on, performance‑based training as AI reshapes cybersecurity, cloud, and IT operations. INE reports a surge in demand for immersive labs, simulations, and AI‑adaptive pathways that promise faster competency and measurable ROI. The shift...
At Black Hat Europe 2025, Max Smeets dissected LockBit’s ransomware‑as‑a‑service operation, revealing 194 affiliates and 80 successful ransom payments between 2022‑2024. He argued that reputation drives both victim and attacker behavior: companies that pay attract more media scrutiny, while ransomware...
The episode announces that 1inch has become the exclusive swap provider for Ledger Multisig, integrating its Swap API to eliminate blind signing and enable clear, human‑readable transaction approvals via EIP‑712. This partnership enhances treasury security for DAOs, funds, and enterprises...
Freedom Chat, a secure‑messaging app launched in June, was found to expose users' phone numbers and PIN codes through two critical backend flaws. Researcher Eric Daigle demonstrated that nearly 2,000 phone numbers could be enumerated and that PINs were broadcast...
