What's happening: Cloudflare pushes agile SASE with Cloudflare One to replace legacy VPNs
Cloudflare announced a series of technical deep‑dives showcasing its Cloudflare One agile SASE platform, positioning it as a single‑pass solution to the fragmentation of legacy VPNs and hardware firewalls. The platform runs security checks across a global network spanning over 300 cities, eliminating service‑chaining bottlenecks and integrating zero‑trust controls.
Also developing:

A Larridin survey reveals a 16‑point visibility gap between executives and directors on AI usage, highlighting pervasive shadow AI and fragmented governance. Large enterprises run an average of 23 AI tools, yet only 38 percent maintain a comprehensive inventory, leaving many deployments unmanaged. The study shows that IT functions achieve the strongest ROI and confidence, while customer support and logistics lag behind. Formal AI training correlates with higher productivity and better ROI expectations, underscoring the need for real‑time measurement.

The Administrative Review Tribunal (ART) partially overturned the Australian Information Commissioner’s finding that Bunnings breached privacy law with its facial‑recognition trial. While the tribunal accepted Bunnings’ reasonable belief that the technology was necessary to combat retail crime, it cleared the...
Harvard University disclosed a November phishing attack that exposed alumni, donor and limited staff data, while the University of Pennsylvania confirmed a ShinyHunters intrusion that accessed Salesforce, SAP and other systems, compromising roughly 1.2 million students, alumni and donors. Both breaches...

In this Stormcast episode, the hosts discuss a multi‑stage malicious script that injects into Chrome, downloads a seemingly benign wallpaper image, and then installs additional payloads like Xworm to evade AV detection. They highlight a critical, unauthenticated web‑admin vulnerability (CVE‑2026‑1633)...
In this episode, Paul Benda explains the SCAM Act introduced by Senators Ruben Gallego and Bernie Moreno, which would impose new know‑your‑customer and ad‑takedown obligations on major tech platforms that profit from fraudulent advertising. He outlines why current market incentives...

Tenable Holdings posted a strong fiscal fourth‑quarter, reporting adjusted earnings of $0.48 per share and revenue of $260.5 million, both surpassing analyst expectations. Year‑over‑year revenue grew 11% to $999.4 million, while calculated billings rose 8% to $327.8 million. The company added 502 new...
Researchers at Datadog Security Labs report that threat actors are exploiting the React2Shell vulnerability (CVE‑2025‑55182) in React Server Components to compromise NGINX servers managed via Boato Panel, hijacking web traffic and redirecting users to malicious sites. The attacks target a...

Configuration drift—incremental, often unnoticed changes to security settings—has become a major hidden threat for enterprises. Modern, hyper‑configurable security platforms and frequent temporary exceptions cause the drift to accelerate, eroding a company’s security posture over time. High‑profile breaches such as Colonial...

Prosecutors allege that an Iowa bank employee colluded with Curtis Weston to create 66 fraudulent loans worth $22 million, exploiting customer information from a previous employer. The scheme used 26 stolen identities and cycled funds through multiple banks and an online...

Multiple critical flaws identified as CVE‑2026‑25049 let any authenticated n8n user execute arbitrary code on the host server. The vulnerabilities stem from weak sandboxing of user‑written JavaScript and bypass the prior CVE‑2025‑68613 fix. Versions prior to 2.5.2 and 1.123.17 are...

AT&T is rolling out autonomous AI agents to combat spam and fraud calls while streamlining internal processes. The network‑integrated digital receptionist, ActiveArmor, engages unknown callers in real time, disconnecting suspicious interactions or taking messages. Internally, the company’s partnership with Microsoft...

A critical vulnerability (CVE‑2026‑24512) in ingress‑nginx allows authenticated attackers to inject arbitrary Nginx directives via the rules.http.paths.path field, leading to code execution and secret disclosure in Kubernetes clusters. The flaw affects all ingress‑nginx releases before v1.13.7 and v1.14.3. Exploitation requires...

The 8th Street, founded by former cybersecurity experts, is launching its flagship Hidden Camera Detector to combat the surge of covert surveillance in homes, offices, and hotels. The compact device combines RF and GPS detection to locate hidden cameras with...

Malvertising—a form of malicious advertising—saw a 42% month‑over‑month surge in the first half of 2023, underscoring its rapid adoption by cybercriminals. A recent case involved Lowe’s employees being duped by spoofed Google ads that mimicked the MyLowesLife portal, leading to...

Researchers at DataBreach.com have uncovered that the new ransomware‑style group 0apt is not delivering real stolen data. The site lists high‑profile companies, but each download streams infinite random bits generated by /dev/random, producing only white noise. The tactic creates the...

Google released a Chrome update that patches two high‑severity vulnerabilities, CVE‑2026‑1862 and CVE‑2026‑1861, affecting the V8 engine and libvpx video decoder. The V8 type‑confusion flaw can enable arbitrary code execution, while the libvpx heap overflow may cause crashes or be...

.@defis_eu says @GalileoGNSS secure PRS service to get EU security accreditation 'soon;' @DLR_en preparing service to geo-locate global GPS/Galileo interference. #EuropeanSpaceConf. @GrudlerCh. https://t.co/BEoAxMEwVU https://t.co/CtsfxxkoYt

CISA confirmed that ransomware gangs are exploiting a high‑severity VMware ESXi sandbox‑escape flaw, CVE‑2025‑22225, which Broadcom patched in March 2025 alongside two related vulnerabilities. The vulnerability enables an arbitrary kernel write, allowing attackers with privileged VMX process access to break...

Nord Security announced it now holds over 400 patents worldwide, a four‑fold increase since 2023, underscoring a rapid escalation in its R&D efforts. The bulk of the filings target VPN protocols, advanced identity management, machine‑learning threat detection, and quantum‑resistant cryptography....

The forthcoming Advanced Cloud Firewall (ACFW) test reveals that a significant number of cloud firewall vendors are unable to block basic application‑layer attacks such as SQL injection, command injection, SSRF and API abuse, with detection rates often below 20%. While...

Researchers introduced a Trojan‑resilient Number Theoretic Transform (NTT) architecture that detects and mitigates control‑flow and timing faults on reconfigurable platforms. Implemented on an Artix‑7 FPGA, the design uses a clock‑cycle counter, control‑status register, and RENO‑based recomputation to correct anomalies. The...

SEALSQ Corp unveiled a "root‑to‑quantum" security platform that embeds a hardware Root of Trust into microcontrollers and TPM‑class devices, pairing it with post‑quantum cryptography and a proprietary quantum highway. The solution promises cryptographic agility, enabling seamless updates as quantum threats...

Silent Push has identified more than 10,000 active SystemBC infections across data‑centre and government servers in the US, Europe and Asia. The multi‑platform proxy malware turns compromised hosts into SOCKS5 relays, a technique frequently observed before ransomware campaigns. A previously unknown...

Marquis, a fintech provider, suffered a ransomware breach traced to misconfigured legacy SonicWall firewalls and exposed backup files. The attackers leveraged publicly accessible configuration data to map the network and deploy ransomware without triggering traditional alerts. The incident highlights how...

APT28, a Russia‑linked threat group, is exploiting a newly disclosed Microsoft Office zero‑day through crafted Office and RTF documents delivered via phishing emails. The vulnerability enables unauthorized code execution without macros, allowing lightweight loaders to establish command‑and‑control while evading traditional...

Google Ads has introduced multi‑party approval, a security layer that obliges a second administrator to sign off on high‑risk actions such as adding or removing users and changing roles. When an admin initiates such a change, an in‑product request is...

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered all federal agencies to patch the five‑year‑old GitLab SSRF vulnerability (CVE‑2021‑39935) after confirming it is being actively exploited. The flaw, fixed by GitLab in December 2021, allows unauthenticated users to access...

ConnectSecure unveiled a cross‑platform Linux patching capability that consolidates updates for Red Hat, Ubuntu, Debian, and CentOS into a single console. The tool automates kernel and OS patch identification and deployment, cutting manual effort by up to 80 %. It also introduces...

Flare’s 2025 analysis uncovered more than 10,000 Docker Hub images exposing API keys, cloud tokens, and AI model credentials. The leaks illustrate how non‑human identities—tokens, service accounts, and workload identities—are embedded in containers and can persist for years, as seen...

Group‑IB uncovered new technical markers that expand the ShadowSyndicate cybercrime infrastructure, adding two fresh SSH fingerprints and revealing server‑transfer tactics that link dozens of servers to a single operator. The cluster consistently reuses OpenSSH keys and hosts on the same...

Chinese‑linked hacking group Mustang Panda launched a covert espionage campaign in late 2025, distributing counterfeit US diplomatic briefings to government officials across Asia and Eastern Europe. The malicious PDFs triggered infection simply by being opened, deploying the PlugX DOPLUGS downloader...
BOXX Insurance launched Tech E&O by BOXX, a comprehensive errors‑and‑omissions policy tailored for technology firms ranging from startups to enterprises. The product combines traditional E&O with integrated cyber coverage, 24/7 incident response, and a risk‑management platform. It introduces novel protections...

TP‑Link disclosed nine critical authenticated command‑injection flaws in its Archer BE230 v1.2 router firmware, each assigned a separate CVE and scoring 8.5‑8.6 on the CVSS v4.0 scale. The vulnerabilities affect web, VPN, cloud, and configuration modules, allowing attackers with high‑privilege access to...

Cofense reports that phishing attacks doubled in 2025, with security filters catching one malicious email every 19 seconds, up from one every 42 seconds in 2024. The surge is driven by AI, which threat actors now use as a core...

ID.me announced the appointment of Mitch Melis as Field Chief Technology Officer for the public sector. Melis will act as a trusted advisor to government agencies, helping them scale digital identity solutions while meeting compliance and fraud‑prevention requirements. He brings...

Moltbook is a social platform where AI agents register, read, and post content autonomously, creating a hidden communication channel that bypasses traditional human‑centric security controls. Enterprises can deploy agents that interact with Moltbook long after an initial prompt, exposing data...
Businesses face escalating cyber threats, making comprehensive technology security essential. The article outlines a layered strategy that starts with regular risk assessments to pinpoint vulnerabilities and allocate defenses. It emphasizes strong password policies, multi‑factor authentication, and automated software patching as...
MomentProof, Inc. has deployed its patented MomentProof Enterprise platform for AXA, enabling cryptographically sealed, AI‑resilient digital assets in the insurer's claims process. The technology certifies images, video, audio and metadata at capture, providing deterministic authenticity verification. AXA reports eliminated probabilistic...

Operational threat intelligence is being overwhelmed by noise and slow manual processes, prompting a shift toward AI agents. Gartner highlights that most organizations lack end‑to‑end AI integration across the intelligence lifecycle, with only 43% reporting tangible benefits. AI agents can...

Microsoft has begun rolling out native Sysmon functionality to Windows 11 Insider builds in the Beta and Dev channels. The built‑in service mirrors the popular Sysinternals Sysmon tool, logging process, file and clipboard events to the Windows Event Log. It remains...
Former Nuance Communications employee Max Vance has been hit with two additional false‑statement counts after a superseding indictment revealed he lied to FBI agents about downloading protected health information. The indictment follows his original charge of unlawfully accessing data belonging...

Drainer‑as‑a‑Service (DaaS) platforms are industrializing crypto theft, letting low‑skill actors launch high‑value heists at scale. Traditional bank compliance, reliant on static blacklists, cannot keep pace with the real‑time, multi‑domain attacks these services enable. The author urges banks to shift from...
Financial infrastructure firm Noah has teamed up with identity‑verification specialist Sumsub to embed a reusable KYC framework across its platform. The integration enables users verified by any of Sumsub’s 4,000+ partner institutions to onboard on Noah‑powered wallets, exchanges and payment...

EasyDMARC now pushes DMARC and email‑authentication alerts straight into Slack, turning a traditionally passive control into an active operational signal. The integration delivers high‑signal events—such as DNS record changes, authentication‑failure spikes, and policy shifts—complete with domain, severity and rationale, while...

Microsoft has observed a rapid rise in information‑stealing malware targeting macOS, a shift from its traditional Windows focus. Since late 2025, threat actors have deployed macOS‑specific stealers such as DigitStealer, MacSync and Atomic macOS Stealer, often written in Python and...

SECNAP Network Security launched CloudJacket MXDR, a managed extended detection and response platform that unifies SOC, SIEM, and NDR functions under a single pane of glass. Built on the patented CloudJacket foundation, the solution adds multi‑tenant capabilities, AI‑augmented analyst workflows,...

Interlock ransomware has added a zero‑day exploit in a gaming anti‑cheat driver (CVE‑2025‑61155) to its arsenal, deploying a signed kernel driver called UpdateCheckerX64.sys. The new BYOVD tool, dubbed Hotta Killer, creates a demand‑start service and uses DeviceIoControl to terminate security...

The latest TollBit report, backed by Akamai data, shows AI‑driven scraping bots now account for a sizable share of web traffic, with one out of every 50 visits to monitored sites originating from such bots. AI bots are increasingly ignoring...

A sophisticated supply‑chain attack hijacked Notepad++'s update mechanism after a hosting‑provider breach, remaining active from June 2025 to December 2025. Attackers rotated command‑and‑control servers and deployed three distinct infection chains that delivered Cobalt Strike beacons and a custom Chrysalis backdoor. The...

Eric Zimmerman of the SANS Institute argues that incident response failures stem more from early‑stage decisions than from tool gaps. He defines the "first 90 seconds" as a repeatable decision window that recurs each time a new system enters scope,...