Know What's Happening in Cybersecurity
Know What's Happening in Cybersecurity
Cybersecurity Pulse
EMAIL DIGESTS
Daily
Every morning
Weekly
Tuesday recap
EMAIL DIGESTS
Daily
Every morning
Weekly
Tuesday recap
Ransomware and supply‑chain breaches surge across sectors
The Cyber Express reports a sharp rise in ransomware incidents and supply‑chain compromises. High‑profile attacks include a ransomware intrusion at Hasbro, a malicious package update that hit AI startup Mercor via the LiteLLM project, and a North Korean‑linked attack on the Axios JavaScript library.
Also developing:
A new research paper compares the EMBA firmware analysis tool on a local workstation and an Azure virtual machine, measuring execution time, repeatability, and cost. Identical configurations and a common firmware set were used, revealing that scan duration depends more on firmware structure than size. Cloud runs incurred several hundred dollars in usage charges, while local systems offered stable performance without ongoing billing. The authors propose a hybrid workflow that leverages cloud for bulk triage and on‑premises hardware for deep investigation.
California Privacy Protection Agency appointed Nicole Ozer to its board, reinforcing the state’s privacy agenda. Ozer, former ACLU tech director and executive at UC Law San Francisco, brings extensive experience in privacy law, AI, and digital civil liberties. Her appointment...
A new study shows that commercial text‑to‑image models can be coaxed into generating political propaganda by replacing explicit names with descriptive profiles and fragmenting prompts across multiple low‑risk languages. Researchers tested GPT‑4o, GPT‑5 and GPT‑5.1, achieving bypass rates up to...
The episode reviews Microsoft’s January Patch Tuesday (113 fixes, including one actively exploited and eight critical bugs), Adobe’s updates for ColdFusion and Acrobat Reader, and two Fortinet advisories covering an unauthenticated heap overflow and an SSRF issue. It also highlights...
Taiwan’s National Security Bureau reported an average of 2.63 million cyber attacks per day in 2025, a 6 percent rise from the prior year. Energy utilities faced a ten‑fold surge in malicious traffic while hospitals and emergency services saw attacks climb 54 percent....
A whistleblower allegedly released personal data on roughly 4,500 ICE and Border Patrol employees, including about 2,000 frontline agents, after the Jan. 7 shooting of Renee Nicole Good. The leak, posted on the volunteer‑run ICE List site, contains names, work emails,...
Scraping has migrated from web sites to mobile apps as AI‑driven bots target richer, structured API data. Attackers decompile Android APKs, extract endpoints and credentials, then replay authenticated requests without using the UI. Traditional defenses—rate limits, CAPTCHAs, and token‑based authentication—fail...
Chief Information Security Officers are facing unprecedented turnover, with average tenure now 18‑26 months. Rapid M&A activity forces CISOs to juggle integration, risk, board advising, and crisis management, leading to burnout and a 66% report of excessive expectations. Surveys show...
Ukraine’s Defense Forces were hit by a charity‑themed malware campaign from October to December 2025 that delivered the PluggyApe backdoor. The attacks arrived via Signal or WhatsApp messages promising charitable documents, but instead provided password‑protected PIF archives containing malicious payloads. Ukrainian...
Southold, New York, has kept its Laserfiche online record‑keeping system offline for more than six weeks after a cyberattack on Nov. 24 compromised its servers. The town announced that public access will remain suspended with no clear restoration timeline. To remediate,...
Central Maine Healthcare suffered a cyber intrusion that lasted from March 19 to June 1, 2024, exposing the personal and health information of 145,381 individuals. The breach affected patients, current and former employees, revealing names, dates of birth, treatment details,...
Researchers at NDSS 2025 presented the first systematic memory‑safety study of bootloaders, revealing a growing attack surface as these low‑level programs add features. By surveying prior vulnerabilities and building a dedicated fuzzing framework, the team examined nine popular bootloaders and...
Microsoft has begun automatically replacing expiring Secure Boot certificates on eligible Windows 11 24H2 and 25H2 devices. The certificates, which protect the pre‑boot environment, are set to expire in June 2026, prompting a phased rollout through Windows quality updates. High‑confidence devices receive the...
Fortinet disclosed a heap‑based buffer overflow in the cw_acd daemon of FortiOS and FortiSwitchManager that allows unauthenticated remote code execution. The flaw can be triggered via crafted network requests, especially on exposed fabric interfaces, and affects versions from 6.4.17 up...
Nicholas Moore, a 24‑year‑old from Springfield, Tennessee, is set to plead guilty to unauthorized access of the U.S. Supreme Court’s electronic filing system on 25 separate days between August and October 2023. Prosecutors allege he obtained information from a protected...
Microsoft released the Windows 11 KB5074109 and KB5073455 cumulative updates for 25H2/24H2 and 23H2, delivering the January 2026 Patch Tuesday security patches. The updates raise build numbers to 26200.7623 (or 26100.7462) and 226x1.6050, and they address a range of vulnerabilities, driver compatibility,...
Microsoft released its January 2026 Patch Tuesday update, addressing 114 security flaws across Windows and related services. The bundle includes eight critical vulnerabilities—six remote code execution and two elevation‑of‑privilege bugs—plus one actively exploited information‑disclosure flaw in Desktop Window Manager. Two publicly...
The Domain Name System (DNS) remains a critical yet vulnerable internet backbone, with 88% of organizations reporting at least one DNS attack in 2023. Attacks such as hijacking, cache poisoning, and DDoS floods can redirect users, cause service outages, and...
JPMorgan Chase disclosed to the Maine Attorney General that a data breach at law firm Fried Frank exposed personal information of 659 investors in a private‑equity fund. The breach involved unauthorized copying of files containing names, contact details, account numbers,...
The Salt Typhoon espionage campaign compromised email accounts of U.S. congressional staff by exploiting stolen credentials rather than deploying malware. Attackers blended into normal email and cloud traffic, maintaining persistent, low‑noise access to sensitive communications. The breach underscores that identity systems...
GitGuardian reported record ARR growth in 2025, fueled by rapid enterprise adoption across North America and Europe. The platform now safeguards over 115,000 developers, monitors more than 610,000 repositories and 210,000 collaboration‑tool sources, a seven‑fold increase from the prior year....
Scammers are posting fake LinkedIn reply comments that mimic official policy‑violation notices and direct users to malicious links. The fraudsters leverage LinkedIn’s own lnkd.in URL shortener, making the phishing URLs appear legitimate. Impersonated company pages also use the LinkedIn logo...
AZ Monica hospital in Antwerp suffered a cyber attack on Tuesday, forcing a shutdown of computer systems at its Deurne and Harmonie campuses. The breach was detected at 6:30 am, prompting staff to power down servers and initiate an investigation by...
A Wired investigation uncovered that Google’s ad service hosted audience segments tied to highly sensitive groups, allowing marketers and potential adversaries to target mobile devices linked to government employees and executives. The article warns that modern ad‑tech pipelines collect granular...
F5 has introduced F5 NGINXaaS for Google Cloud, a managed, cloud‑native application delivery‑as‑a‑service that unifies load balancing, security and observability. Developed with Google Cloud, the service is available through the Marketplace and targets containerized, AI‑enabled workloads. It offers programmable traffic...
Silent Push researchers have uncovered a global Magecart campaign that has been skimming credit‑card data from all major networks since 2022. The attackers host malicious JavaScript on innocuous domains such as cdn‑cookie.com and erase the code when a WordPress admin bar...
Concentric AI has added Private Scan Manager support for AWS GovCloud (US), allowing federal agencies, contractors, and partners to run its Semantic Intelligence platform within isolated, U.S.-only cloud regions. The extension follows earlier 2025 announcements of private‑cloud scanning for Azure...
![[Webinar] Securing Agentic AI: From MCPs and Tool Access to Shadow API Key Sprawl](/cdn-cgi/image/width=1200,quality=75,format=auto,fit=cover/https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2N9qZuwkcslheNUOsWaTDrMYeXiBUfw1y-hItTvuGo71srarOm7AWzq3o7ro9E0x_CnC7XmJGXKl1tfkc6gTMK288y6M_zN6Yg1FATduXSQmMlp_jnHESxVYZDuJnNozO_Ff-r-lWIyG5AikC8AwrOckeYVYcCQv2RjeLof2bxV_TrcbvRvZqrTIcjD0/s2600/ai-agent.jpg)
The Hacker News webinar spotlights the emerging security gap as agentic AI tools like Copilot, Claude Code, and Codex move from code generation to full‑cycle software deployment. Central to the risk are Machine Control Protocols (MCPs), which dictate which tools,...
Researchers have uncovered the SHADOW#REACTOR campaign, a multi‑stage Windows malware chain that starts with an obfuscated VBS script and escalates through a PowerShell stager, text‑only payloads, and a .NET Reactor‑protected loader. The loader reflectively injects a Remcos RAT payload entirely...
Running Java on a free, unsupported JVM carries hidden risks as exploit timelines have accelerated dramatically. In 2023, attackers began leveraging newly disclosed Java flaws within five days, and some incidents occurred in under an hour. Without commercial support, organizations...
ServiceNow’s Virtual Agent API and Now Assist AI Agents contain a critical broken‑authentication flaw (CVE‑2025‑12420) that lets unauthenticated attackers impersonate any user using only an email address. The vulnerability exploits a static provider secret and email‑only auto‑linking to bypass MFA...
Researchers from Shanghai Jiao Tong University, UIUC and Zhejiang University introduced HoneyTrap, a deceptive‑defense framework that counters multi‑turn jailbreak attacks on large language models. The system employs four specialized defensive agents to mislead attackers, prolong interactions, and drain computational resources...
Armenian authorities have launched a probe after a hacker identified as dk0m claimed to be selling eight million government records on a dark‑web forum. The data allegedly originates from a state notification system that distributes legal and administrative notices. Officials...
Poland’s power grid endured its biggest cyberattack in years during the last week of December, according to Energy Minister Milosz Motyka. The operation attempted to sever communication links between renewable energy installations and distribution operators, but was ultimately thwarted with...
Noction launched Intelligent Routing Platform (IRP) v4.3, adding Automatic Anomaly Detection (AAD) that spots abnormal traffic and triggers edge‑level DDoS mitigation. The system can automatically apply BGP FlowSpec filters or blackhole traffic, with optional operator review. IRP v4.3 also upgrades Commit Control...
Android banking trojan deVixor, active since October 2025, is distributing through counterfeit automotive‑sale websites targeting Iranian users. The malware harvests SMS OTPs, banking credentials, and cryptocurrency exchange data, and can remotely lock devices with a ransomware command demanding 50 TRX. Its...
Doctor Web’s Q4 2025 mobile‑malware report reveals a modified Telegram X app delivering the Android.Backdoor.Baohuo.1.origin backdoor, compromising roughly 58,000 Android devices across phones, tablets, smart TVs and in‑car systems. The same period saw a 65% surge in Android banking trojans and the re‑appearance...
ColorTokens announced that its Xshield Enterprise Microsegmentation Platform has received a FedRAMP® Moderate Authority to Operate, confirming compliance with hundreds of NIST SP 800‑53 controls. The authorization, validated by an accredited third‑party assessment organization, allows the solution to handle Controlled Unclassified Information...
Canonical has launched Minimal Ubuntu Pro images for public cloud platforms, delivering a leaner base OS with only essential components. The images retain Ubuntu Pro’s extended security maintenance, covering core packages and critical cloud functionality. They are now available through...
Forty years ago, Loyd Blankenship—known as The Mentor—published “The Conscience of a Hacker” in the underground magazine Phrack, creating what is now called the 1980s Hacker Manifesto. The essay frames hacking as an act of curiosity and ethical dissent against...
The Black Duck Cybersecurity Research Center identified a high‑severity vulnerability in Broadcom’s wireless chipset used in ASUS RT‑BE86U routers. A single over‑the‑air frame can render the 5 GHz Wi‑Fi network unresponsive, forcing a manual router reset and potentially corrupting ongoing data...
Black Duck Cybersecurity Research Center (CyRC) disclosed high‑risk Wi‑Fi vulnerabilities in ASUS and TP‑Link routers that allow network disruption with a single malformed frame. The flaws were identified through Defensics fuzz testing and bypass WPA2/WPA3 encryption, highlighting protocol‑level weaknesses. Vendors...
Check Point Research has uncovered VoidLink, a sophisticated, cloud‑native Linux malware framework designed for long‑term stealth in cloud and container environments. First seen in December 2025, the platform includes custom loaders, rootkits, and more than 30 plug‑in modules written in Zig,...
Occasionally, someone takes issue with me flagging a data breach as "sensitive" such that the email addresses can't be publicly searched because they want to dox the users. That's a *really* bad idea, for many reasons: https://t.co/rEtQPHkxf7
Troy Hunt reflects on the Ashley Madison breach, noting how public doxing caused suicides, broken marriages and job losses. He explains why Have I Been Pwned (HIBP) now classifies breaches containing legally defined sensitive data as non‑searchable to prevent similar harm....
The UK Parliament’s Public Bill Committee has opened a consultation for the Cyber Security and Resilience Bill (CSRB), the successor to the 2018 NIS Regulations and a NIS2‑style overhaul for critical infrastructure. After its second reading, the bill now enters...
Application security is moving beyond isolated scanners toward a unified posture, provenance, and proof framework. Gartner and OWASP now emphasize Application Security Posture Management (ASPM) that aggregates SAST, DAST, SCA, MAST and IaC findings into a single, context‑aware view. Provenance...
Security firm Silent Push uncovered a long‑running Magecart skimming operation that has been active since 2022. The campaign injects malicious JavaScript into e‑commerce sites, targeting six major payment networks – American Express, Diners Club, Discover, JCB, Mastercard and UnionPay. Victims see a...
Threat actors are leveraging weaponized PDF attachments to install legitimate Remote Monitoring and Management (RMM) tools such as Syncro, SuperOps, NinjaOne, and ScreenConnect. The campaign, uncovered by ASEC, began with deceptive PDFs that display error messages or images, prompting users...
AccuKnox and Hexaware Technologies announced a strategic partnership to deliver a comprehensive Zero Trust cloud security platform for enterprise clients managing hybrid, multi‑cloud, and AI‑driven environments. The collaboration combines AccuKnox’s CNAPP, CSPM, Kubernetes security, and runtime enforcement tools with Hexaware’s...
