What's happening: Cloudflare pushes agile SASE with Cloudflare One to replace legacy VPNs
Cloudflare announced a series of technical deep‑dives showcasing its Cloudflare One agile SASE platform, positioning it as a single‑pass solution to the fragmentation of legacy VPNs and hardware firewalls. The platform runs security checks across a global network spanning over 300 cities, eliminating service‑chaining bottlenecks and integrating zero‑trust controls.
Also developing:

Researchers at Shenzhen University have unveiled a quantum‑safe key‑exchange protocol that modifies the Anshel‑Anshel‑Goldfeld (AAG) scheme by drawing private keys from Mihailova subgroups of braid groups. The security hinges on the unsolvable membership problem for these subgroups, making the protocol resistant to all known classical and quantum attacks. Experimental results confirm correct key agreement and a marked security improvement over the original AAG design. The work positions abstract group‑theoretic problems as practical foundations for post‑quantum cryptography.
Web development in 2026 is dominated by AI‑first tools, meta‑frameworks, and pervasive TypeScript, reshaping how code is written and deployed. AI agents now scaffold full‑stack applications from natural language prompts, while platforms like Next.js and Nuxt merge front‑end and back‑end...
“We are not making major progress on improving security for the normal person to feel comfortable putting their life savings into crypto.” https://t.co/JTgHPOAblZ

Researchers unveiled a functional blockchain prototype that can interchangeably employ three lattice‑based post‑quantum signature schemes—CRYSTALS‑Dilithium, Falcon and Hawk. The single‑node system decouples application logic from the cryptographic layer, allowing seamless algorithm swaps without altering core code. Comprehensive testing measured key...
The episode discusses TrajDeleter, a novel method for trajectory unlearning in offline reinforcement learning (RL) agents, presented by researchers from the University of Virginia and the Chinese Academy of Sciences. TrajDeleter trains agents to degrade performance on states from specific,...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a new infographic aimed at helping critical‑infrastructure operators and state, local, tribal and territorial (SLTT) governments manage insider threats. The guidance outlines a four‑stage model—plan, organize, execute, maintain—and stresses building multidisciplinary...

The new doctoral guide by Darlan Noetzold, Valderi Reis Quietinho Leithardt and co‑authors delivers a comprehensive overview of post‑quantum cryptography, mapping lattice, code, hash‑based, multivariate and isogeny schemes while dissecting the NIST standardisation process. It details the practical hurdles of...
“There’s a lot of money just sitting in random contracts that were tried to be returned to people affected by the hack.” https://t.co/JTgHPOAblZ
“I think it would be an easy argument to make that TheDAO really kickstarted the security industry in Ethereum.” https://t.co/JTgHPOAblZ
Payment processor Fiserv faces a lawsuit from FiCare Federal Credit Union alleging that its Virtual Branch Next platform lacked basic cybersecurity controls, allowing hackers to hijack customer accounts and steal hundreds of thousands of dollars. The complaint claims Fiserv failed...
EXCLUSIVE 🚨 Nearly 10 years after the DAO hack, unclaimed ETH is being used to create a $250M Ethereum security fund. https://t.co/JTgHPOAblZ

Unclaimed assets from the 2016 DAO hack are being pooled into a $220 million Ethereum security endowment called TheDAO Security Fund. About $13.5 million in DAO tokens and 69,420 ETH, which will be staked, form the core capital, generating roughly $8 million in annual...

EXCLUSIVE: Ethereum OGs and @VitalikButerin to create a $220 million Ethereum security fund 🤯 You'll never guess where the money comes from ... https://t.co/KbfuQI6FX3

Google and partners disrupted the IPIDEA residential proxy network, one of the world’s largest, by taking down domains, sharing intelligence, and enforcing Play Protect. The operation removed SDKs embedded in millions of Android, Windows, iOS, and WebOS apps, sharply reducing...

Apple’s new iPhone security feature limits cell networks from collecting precise location data, but appears to have very limited support in the U.S. at the moment. Here’s to hoping all the big carriers get on board too. https://t.co/tCJT63yJO3 https://t.co/PK9jhIlU18
Sodot unveiled its Exchange API Vault, a self‑hosted solution that secures cryptocurrency exchange API keys while keeping them instantly available for trading. The vault combines multi‑party computation and trusted execution environments to split keys, preventing plaintext exposure even during high‑frequency...

The Aisuru/Kimwolf botnet launched a hyper‑volumetric DDoS assault that peaked at 31.4 Tbps and 200 million requests per second, eclipsing its own 29.7 Tbps record. Cloudflare detected and automatically mitigated the attack on December 19, 2024, without triggering internal alerts. The campaign primarily hit...

Virtue AI has launched AgentSuite, a multi‑layer security and compliance platform designed for enterprise AI agents. The solution lets organizations test agents, enforce real‑time guardrails, and control tool access while providing full audit trails. IBM research shows 79% of enterprises...
The episode explores how employment fraud transforms hiring into a security risk, highlighting that in today’s remote, AI‑driven workforce, malicious actors can fabricate identities and gain trusted access before any internal controls engage. It explains that static background checks are...

Atos has been named Best‑in‑Class for IT/OT Cybersecurity Services in France for 2025 by PAC Innovation Radar. The award highlights Atos’ extensive portfolio, including auditing, consulting, field operations, and managed services, backed by dedicated OT Security Operations Centers and a...
Comstar LLC, an ambulance billing vendor, suffered a March 2022 ransomware attack that exposed the protected health information of roughly 585,621 individuals. Federal regulators settled for $75,000, while Connecticut and Massachusetts AGs imposed a combined $515,000 penalty and a detailed...

Druva launches Threat Watch, a zero‑touch, cloud‑native solution that continuously scans backup snapshots for dormant threats and indicators of compromise. The service runs inside Druva’s Data Security Cloud, eliminating the need for extra hardware or agents and delivering near‑real‑time detection...

ChatGPT now sees over 5.6 billion monthly visits, making its configuration a critical productivity lever. The platform offers a suite of settings—personalization, memory, tone, model choice, security, and app integrations—that shape how the AI responds and protects user data. Adjusting these...
Mesh Security announced a $12 million Series A round led by Lobby Capital, with participation from S Ventures and Bright Pixel Capital. The Palo Alto‑based startup claims to deliver the world’s first Cybersecurity Mesh Architecture (CSMA) platform, an execution layer that unifies...

In this episode, Dr. Adam Lowe of CompoSecure/Arculus and fraud analyst Suzanne Sando discuss the surge in AI‑driven financial fraud and why traditional passwords are no longer sufficient. They highlight how retailers like eBay and Amazon are moving to password‑less...

France's data protection authority (CNIL) has imposed a €5 million fine on the national employment agency, France Travail, for a massive data breach. The breach, discovered in early 2024, exposed personal details of up to 43 million job seekers, including names, birth...

The Hunt.io team uncovered an openly accessible directory on IP 38.255.43.60 that hosts the complete BYOB (Build Your Own Botnet) framework, a sophisticated post‑exploitation tool targeting Windows, Linux and macOS. The infrastructure includes five C2 nodes across the United States, Singapore...

The FBI’s seizure of the RAMP cybercrime forum underscores law‑enforcement pressure on underground marketplaces, while Meta confronts a U.S. lawsuit alleging unauthorized access to WhatsApp messages. CISA published its first list of post‑quantum cryptography‑compatible products, urging organizations to prepare for...

Agentic shopping leverages AI‑driven assistants to automate the checkout process, eliminating the manual steps that traditionally generate rich behavioral data. By bypassing page‑level interactions, these autonomous flows erase signals such as mouse movement, dwell time, and device fingerprinting that fraud...

The Identity Theft Resource Center’s 2025 breach report shows financial services endured 739 data compromises, the highest of any sector for a second straight year. Physical card‑skimming attacks resurfaced as “Skimming 2.0,” with Bluetooth‑enabled overlay devices driving incidents from four to...

The Identity Theft Resource Center recorded a record 3,332 data compromises in the United States for 2025, a 5 % rise over the previous year. Despite more incidents, victim notices fell sharply to 279 million, the lowest level since 2014, as the...

Databricks unveiled BlackIce, an open‑source Docker‑based toolkit that bundles 14 leading AI security utilities into a single, reproducible environment. By containerizing both static command‑line tools and dynamic Python‑driven frameworks, BlackIce removes the setup friction and dependency clashes that have long...

Microsoft announced that starting March 27 2026, Conditional Access policies in Microsoft Entra will be enforced during sign‑ins even when resource exclusions are configured, with a phased rollout through June 2026. The change specifically targets sign‑ins from client applications that request only OIDC...

N‑able unveiled AI‑enhanced capabilities across its endpoint management, security operations, and data‑protection suite. Leveraging telemetry from over 11 million managed devices and a network of 25,000+ service providers, the company now offers agentic AI that automates scripting, threat detection, and recovery...
Brian Honan’s article in the Irish Examiner warns Irish small businesses and families that dependence on US‑based technology platforms can jeopardise digital sovereignty. He cites scenarios where tariffs, sanctions or policy shifts could abruptly block access to email, documents or...
BH Consulting’s CEO Brian Honan was featured in Security Week, outlining the firm’s view of the top cybersecurity priorities for 2026. The piece highlights BH Consulting’s 20‑year track record, ISO‑27001 certification, and its portfolio of services including CISO/DPO as‑a‑service, audits...

Cybercriminals are leveraging Google Search Ads to distribute macOS malware by directing users searching for “mac cleaner” to counterfeit Apple‑styled landing pages. The ads, hosted on compromised Google Ads accounts, redirect to Google Apps Script pages that decode Base64 payloads...

Tosi has launched a purpose‑built OT platform that consolidates connectivity, visibility, and security into a single console. The offering includes Tosi Control for fleet management and real‑time status, with Tosi Insight adding traffic analytics and anomaly detection, and a full...

Sumsub has introduced AI Agent Verification, a new layer that ties AI‑driven automation to a verified human identity through its Know Your Agent framework. The solution detects automated activity, evaluates its risk, and triggers targeted liveness checks when needed, ensuring...

cside has launched VPN Detection, a solution that identifies and manages traffic routed through virtual private networks. Unlike traditional IP‑list methods, it analyzes network behavior, browser fingerprints, and packet timing across OSI layers three to seven. The tool aims to...

Enterprises face escalating operational downtime risk, prompting CISOs to prioritize three strategic decisions. First, adopt STIX/TAXII‑compatible threat intelligence feeds that deliver fresh, high‑quality indicators, boosting detection rates by up to 58 %. Second, eliminate noisy false positives to protect analysts from...

Google has agreed to a $135 million settlement to resolve a class action alleging Android devices transmitted system‑service data over cellular networks without user consent. The lawsuit, spanning over five years, claimed background data transfers drained users’ plans starting in November...

US neobank Kontigo, a stablecoin bank serving Latin America, suffered a cyber attack that impacted 1,005 users and resulted in the loss of 340,905.28 USDT. The breach exploited a flaw in the Auth provider’s Apple OIDC authentication flow, allowing attackers...

The UK cybersecurity workforce has exploded, rising 194% between December 2021 and June 2025 to reach 83,700 professionals. This makes cyber the fifth‑fastest‑growing occupation and the most rapidly expanding IT role, outpacing the sector’s average 9.6% growth. Despite the surge, a talent...
The European Union has launched the Global Cybersecurity Vulnerability Enumeration (GCVE.eu) database, aggregating advisories from over 25 public sources into a single, searchable platform hosted by Luxembourg’s CIRCL and co‑funded by the EU’s FETTA project. The initiative aims to mitigate...

Phone numbers are increasingly used as digital identifiers for account recovery, two‑factor authentication, and user verification, making them a prime target for attackers. The article outlines how numbers become publicly accessible through social profiles, directories, data breaches, and app permissions....

Email senders increasingly encounter DNS‑based Real‑Time Blackhole Lists that block IPs suspected of spam, phishing, or compromised servers. When an IP lands on a blacklist, major ESPs reject or filter messages, causing bounce errors, silent drops, and plummeting engagement metrics....

Cyber InsurTech at a crossroads ? → https://t.co/lkwru1czZC This reflects the largest round announced recently, which happened to come from a cyber InsurTech startup. https://t.co/NIanaOZPp2

A coordinated cyber‑attack wave hit Bumble, Panera Bread, Match Group and CrunchBase, with the hacker group ShinyHunters claiming responsibility. The intrusions stemmed from phishing and vishing tactics that compromised contractor or employee credentials, granting brief, limited access to internal networks....

A new Python‑based Remote Access Trojan, dubbed PyRAT, has been identified as a cross‑platform threat capable of compromising both Windows and Linux systems. The malware leverages Python’s portability, compiling into ELF and PE binaries, and employs lightweight persistence mechanisms—XDG autostart...