Know What's Happening in Cybersecurity
Know What's Happening in Cybersecurity
Cybersecurity Pulse
EMAIL DIGESTS
Daily
Every morning
Weekly
Tuesday recap
EMAIL DIGESTS
Daily
Every morning
Weekly
Tuesday recap
Reality Defender partners with Orange Business to embed deep‑fake detection
U.S. AI‑security firm Reality Defender has signed a deal to integrate its multimodal deep‑fake detection technology into Orange Business, the enterprise arm of French telecom giant Orange. The solution will protect Orange’s video‑conferencing, contact‑center and voice‑telephony services through real‑time, API‑driven analysis of audio, video, images and documents.
Supply‑chain attacks have evolved from passive typosquatting to active worms, exemplified by the Shai‑Hulud malware. Shai‑Hulud steals developer credentials, republishes infected npm packages, and can trigger a dead‑man switch that erases evidence. The worm’s ability to move across languages and CI/CD pipelines creates polyglot attacks that bypass traditional security silos. Regulators such as the EU Cyber Resilience Act and NIS2 now mandate SBOMs and stronger identity controls to mitigate these risks.
A malicious Android app posing as a document reader amassed over 50,000 downloads on Google Play before being removed. The app functioned as a dropper for the Anatsa banking trojan, which can harvest credentials and execute unauthorized transactions. ThreatLabz identified...
A ransomware group breached the servers of secondary school Onze‑Lieve‑Vrouwinstituut Pulhof in Berchem, forcing a shutdown of internal systems. The school refused to pay the initial ransom and the attackers escalated by demanding €50 per child from parents, threatening to...
In a February 2026 interview, Ashley Burkle, Director of Business Development at Identiv, outlined the company’s push to embed secure digital identities into consumer packaging through NFC, BLE and UHF RFID technologies. Identiv’s solutions turn everyday products into connected data sources,...
Identity Threat Detection & Response (ITDR) has become a core security pillar in 2026 as enterprises shift to cloud, remote work, and SaaS ecosystems, making compromised credentials the primary breach vector. Traditional defenses miss malicious activity that occurs after successful...
The Cybersecurity Maturity Model Certification (CMMC) is becoming the mandatory standard for Department of Defense contractors to demonstrate protection of Federal Contract Information and Controlled Unclassified Information. CMMC 2.0 streamlines requirements into three levels, with Level 1 covering basic cyber hygiene,...
The Chinese APT group Lotus Blossom has been linked to a sophisticated supply‑chain attack on the Notepad++ distribution platform. Attackers delivered a custom backdoor dubbed Chrysalis via a malicious NSIS‑based update.exe that sideloaded a forged Bitdefender Submission Wizard DLL into...
The author argues that AI did not break cybersecurity; longstanding governance failures did. AI merely amplified existing shadow‑IT practices and unclear risk ownership, exposing gaps that boards and CISOs have ignored. The piece calls for a shift from treating security...
Exposure monitoring relies on unverified breach feeds, leading to duplicate, fabricated, and stale alerts. Without validation, teams waste time triaging false positives and lose confidence in their programs. Verified breach data, as offered by Constella, provides source confirmation, de‑duplication, timestamps...
VeriBin is a novel system that automatically verifies whether a binary‑level patch is safe to apply by checking functional equivalence between the original and patched executables. It leverages symbolic execution to isolate patch‑introduced changes and validates them against properties that...
Rubrik warned that inadequate cloud resilience is turning ransomware attacks into costly ransom payments. The company showcased a tabletop exercise, “Zero Hour Horizon Retail,” which simulated a breach that escalated because backups were compromised and identity misconfigurations granted attackers full...
The long‑standing njRAT remote‑access trojan was observed delivering the credential‑stealing malware MassLogger via its C2 traffic. Using NetworkMiner Professional, analysts decoded PCAP data, extracting screenshots, command parameters and gzip‑compressed executables. The “CloudServices.exe” payload, identified as MassLogger, exfiltrates credentials by emailing...
A multi‑stage phishing campaign is targeting business users by sending clean‑looking procurement emails that contain PDFs with hidden clickable buttons. The PDFs exploit AcroForms and FlateDecode to redirect victims to a second file hosted on legitimate Vercel Blob storage, bypassing...
Cybersecurity vendors are shifting from point products to AI‑driven unified platforms that combine SIEM, XDR, SOAR and threat intelligence. Companies like Seceon illustrate this trend by offering a fully integrated, machine‑learning‑based solution that scales across cloud, on‑prem and MSSP environments....
The Notepad++ developer confirmed that state‑linked Chinese hackers hijacked the editor’s update mechanism from June to December 2025, delivering malicious payloads to a limited set of users. The attackers exploited a vulnerability on a shared‑hosting server to redirect update requests...
Mozilla announced that Firefox 148, releasing on February 24, will include a global “Block AI enhancements” toggle, letting users disable all generative AI features or manage them individually. The AI controls panel covers five specific tools—browser translations, PDF alt‑text generation, AI‑enhanced tab...
Between Jan 8‑13 2026 a global sports organization faced a coordinated ticket‑scalping attack that generated over 16 million malicious requests from 3.9 million unique IPs. DataDome’s Galileo Threat Research team identified the threat in real time and deployed AI‑driven detection that blocked every request...
Microsoft confirmed that a shutdown bug introduced by the January 15 cumulative update affects Windows 11 23H2 devices with System Guard Secure Launch and extends to Windows 10 22H2, Enterprise LTSC 2021 and 2019 when Virtual Secure Mode (VSM) is enabled. Emergency...
Outtake announced a $40 million Series B round led by ICONIQ, with participation from CRV, S32 and a slate of high‑profile tech executives. The funding will accelerate its unified digital‑trust platform that protects enterprises from AI‑driven impersonation and identity abuse. Outtake reported...
The Scattered Lapsus ShinyHunters (SLSH) extortion gang blends data theft with aggressive personal harassment, including swatting, DDoS attacks, and media pressure. Operating through chaotic Telegram channels linked to The Com cyber‑crime network, they target executives via phone‑based phishing and MFA...
In this episode, Dennis Chow, Director of Detection Engineering at UKG, discusses the shift from static LLM chatbots to autonomous AI agents within a modern SOC, outlining a three‑tier model that treats agents as application‑level logic requiring robust identity, authorization,...
CTM360’s new report reveals a sharp global rise in fraudulent high‑yield investment programs, or HYIPs, promising unrealistic returns such as 40 % in 72 hours. Over 4,200 scam sites were cataloged in the past year, with December 2025 alone seeing 485 incidents—about 15...
A ransomware group infiltrated Gulshan Management Services, the operator of about 150 Handi Plus and Handi Stop gas stations across Texas, exposing personal data of 377,082 individuals. The attackers accessed the network through a phishing email and remained undetected for several days,...
Crypto‑related “wrench attacks” surged 75 % in 2026, reaching 72 confirmed incidents worldwide, while physical assaults tied to cryptocurrency theft rose 250 %. Europe now accounts for over 40 % of these violent crimes, with France leading at 19 reported cases—more than double...
Malwarebytes has launched Malwarebytes in ChatGPT, embedding its threat‑intelligence engine into OpenAI’s chatbot to let users instantly assess scams, phishing links, and suspicious domains. The service draws on a continuously updated database that protects millions of devices, offering point‑by‑point analysis...
A recent data breach at Panera Bread compromised roughly 5.1 million unique user accounts, far fewer than the 14 million records initially reported. The breach was carried out by the ShinyHunters extortion gang, which accessed Panera's systems through a Microsoft Entra single...
CertiK, a blockchain security leader valued at over $2 billion, is positioning itself as the trust backbone for the rapidly maturing Web3 ecosystem. Highlighted at the 2026 World Economic Forum, the firm is adopting public‑company practices to boost accountability and durability....
Quantum computing is moving from theoretical research to commercial opportunity, with startups already delivering products in cybersecurity, networking, middleware, and sensing. Andy Leaver of Notion Capital argues that waiting for fault‑tolerant, cryptography‑breaking machines is unnecessary; viable markets exist today. He...
Commvault has launched Geo Shield, a sovereign‑data protection suite that lets enterprises dictate where data resides, who controls access, and who holds encryption keys. The offering spans four deployment models—from local hyperscaler SaaS to private sovereign clouds—supporting both BYOK and HYOK...
A newly disclosed flaw (CVE‑2025‑0921) in Iconics Suite’s Pager Agent lets a non‑admin attacker manipulate file‑system permissions to overwrite critical Windows driver files. By redirecting log output via symbolic links, the exploit can corrupt the cng.sys driver, causing the system...
A Chrome extension called Amazon Ads Blocker, marketed as an ad‑hider, was found to silently replace creator affiliate tags on Amazon product links with its own identifier (10xprofit‑20). Socket researchers discovered the extension injects the tag on page load and...
Russian‑linked group Fancy Bear leveraged the high‑severity CVE‑2026‑21509 Office flaw days after Microsoft disclosed it, targeting Ukrainian ministries and EU bodies. The malicious Word document triggered a WebDAV call that installed a DLL via COM hijacking, ultimately launching the Covenant...
Span Cyber Security Arena 2026 will be held May 20‑22 in Poreč, Croatia, at the five‑star Pical Resort. The event features three days of conference sessions plus two pre‑conference masterclasses on May 18‑19 for engineers, architects, and consultants. Keynote speakers include...
Point Wild researchers uncovered a new Windows campaign deploying the Pulsar RAT, a .NET‑based remote access trojan that lives entirely in memory. The infection chain starts with a per‑user Registry Run key that launches a PowerShell loader, which decodes Donut‑generated...
In this episode, Cole Horsman, Field CTO at Sonrai Security, recounts his three‑year journey trying to apply shift‑left and just‑in‑time (JIT) models to cloud identity, ultimately concluding that both approaches failed because they target the wrong layer. He explains how...
A pilot survey of 112 security researchers and journalists was conducted from December 20 2025 to January 18 2026 to gauge legal and criminal threats they face. The study reveals that many respondents encounter litigation warnings, criminal investigations, and intimidation from cyber‑criminals. Findings are...
Mid‑market firms face tight budgets and lean security teams, making traditional, siloed tools costly and inefficient. The article advocates a full‑lifecycle approach—prevention, protection, detection, and response—delivered through integrated platforms such as Bitdefender GravityZone. By unifying endpoint, cloud, identity, and network...
Microsoft has resolved a lock‑screen bug that hid the password sign‑in icon after Windows 11 updates released since August 2025. The issue primarily affected users with multiple authentication methods and was linked to the KB5064081 preview update and subsequent 24H2/25H2 builds. Microsoft...
Colocation is emerging as a pragmatic alternative to building private data centers, offering enterprises robust physical safeguards while offloading power and cooling overhead. Providers secure the facility with layered access controls, surveillance, and environmental protections, but customers retain responsibility for...
Britain and Japan announced a new cyber strategic partnership during Prime Minister Keir Starmer's Tokyo visit, following his stop in Beijing. The agreement pairs cybersecurity cooperation with joint efforts to secure critical mineral supply chains essential for advanced manufacturing and...
NationStates, a browser‑based government simulation game, confirmed a data breach after a player exploited a critical Remote Code Execution flaw in its new Dispatch Search feature. The attacker accessed production servers, copying email addresses, MD5‑hashed passwords, IP logs, and possibly...
Cybercriminals are gearing up for the Milano‑Cortina 2026 Winter Olympics, exploiting the event’s global visibility with a surge of phishing, fake ticket sites, malicious streaming platforms, and counterfeit apps. Past Games have seen state‑aligned actors deploy wiper malware and hacktivists...
The episode examines the recent breach of the BreachForums marketplace, which exposed the real identities, emails, IPs, and registration data of roughly 324,000 cyber‑criminals. Experts from Keeper Security, ColorTokens, and Fenix24 explain how the leak provides a rare intelligence goldmine,...
The episode examines a critical vulnerability in Broadcom Wi‑Fi chipsets that lets an attacker disrupt 5 GHz networks with a single unauthenticated frame, forcing a router reboot and potentially enabling evil‑twin phishing attacks. Experts from Black Duck, BeyondTrust, Qualys, and Cequence...
ACTFORE announced the USPTO has granted its second patent for a Template Identification and Matching technology that fingerprints documents at the pixel level. The solution converts each page into image‑based signatures, enabling detection of structural similarities across massive, unstructured breach...
Jumping onboard the OPSEC train: Don't rely on cute tricks to stop security forces from accessing important data. Have a better system architecture that is secure against basic coercion. If you are a journalist working with someone who is committing treason,...
Between June and December 2025, a “likely Chinese state-sponsored group” compromised the infrastructure used by Notepad++ and served malicious updates to selectively targeted users. https://t.co/w5kp0kyy5z https://t.co/rug70afvgL
In this episode Adrian Bridgwater discusses StrongestLayer’s new threat‑intelligence report, which analyzed 2,042 advanced email attacks that slipped past Microsoft Defender E3/E5 and leading secure email gateways. The findings reveal a shift toward attackers exploiting trusted platforms such as DocuSign,...
After all the hacks, I massively improved the operational and environmental security of Logan the exit liquidity lobster to include an HSM key management system and a two container docker system running on WSL https://t.co/UX8XmZJQfo https://t.co/L4icr9zsqJ
Responsible disclosure is increasingly failing as organizations delay acknowledgment, dispute severity, and provide little compensation, turning ethical research into unpaid labor. The recent React2Shell (CVE-2025-55182) case shows coordinated response can work, yet exploitation still spread quickly. In contrast, unbacked open‑source...
