The European Space Agency (ESA) disclosed a December‑era hack that it described as limited, but new reports reveal a far larger breach. Security researchers say attackers gained initial access in September via an unpatched public CVE and exfiltrated roughly 500 GB of highly sensitive data, including spacecraft designs, mission procedures, and proprietary information from partners such as SpaceX, Airbus and Thales Alenia Space. ESA confirmed the intrusion remains active and has opened a criminal investigation. The agency’s repeated security lapses raise questions about its cyber‑defense posture.
XM Cyber uncovered two privilege‑escalation flaws in Google Vertex AI where default configurations let a low‑privileged "Viewer" user hijack high‑privilege service‑agent identities. Google responded that the behavior is "working as intended," echoing similar stances from other cloud providers. The issue...
A new survey by DataBreaches.net and Zack Whittaker seeks to document threats faced by cybersecurity researchers and journalists, closing on January 18. The call follows recent high‑profile incidents, including an FBI raid on Washington Post reporter Hannah Natanson and court‑ordered injunctions that...

The episode explores how the rollout patterns of biometric authentication and digital ID cards can inform expectations for agentic commerce adoption, noting that none of these technologies are yet ubiquitous but will see broader real‑world pilots in 2026. Analyst Christopher...

Researchers identified five malicious Chrome extensions that masquerade as HR and ERP tools such as Workday, NetSuite, and SuccessFactors. The add‑ons steal authentication cookies, block security‑admin pages, and enable session hijacking by injecting stolen tokens. While most have been removed...

Pacific Northwest National Laboratory unveiled ALOHA, an AI‑driven system that reconstructs cyber attacks in hours instead of weeks. Leveraging Anthropic’s Claude LLM and MITRE’s Caldera framework, ALOHA translates threat reports into full attack playbooks and automatically tests them against simulated...

Print devices are emerging as high‑risk edge nodes, with 2025 attacks exposing blind spots in firmware, default credentials, and network exposure. In 2026 organizations must adopt continuous, automated monitoring of printer fleets to curb IoT‑related breaches. Simultaneously, the rollout of...

Enterprises are abandoning perimeter‑based defenses in favor of zero‑trust architectures that continuously verify identity, intent, and behavior. AI‑driven detection platforms now ingest authentication logs, network flows, and telemetry to spot anomalies in real time. Automated remediation isolates suspicious devices or...

A critical Windows Admin Center Azure SSO vulnerability (CVE‑2026‑20965) enables an attacker with local administrator rights on a single Azure VM or Arc‑connected system to forge a WAC.CheckAccess token and a PoP token, impersonating privileged users across the entire tenant. The...

Swimlane has joined the Wiz Integration Network, linking its Turbine agentic AI automation platform with Wiz’s cloud risk visibility. The integration streams real‑time misconfiguration and vulnerability data from Wiz into Turbine, which automatically enriches, prioritizes and remediates findings. Custom playbooks...

DataDome announced the appointment of Pradheep Sampath as Chief Product Officer, bringing extensive identity, authentication, and fraud‑prevention expertise. Sampath has helped protect over $200 billion in digital transactions and previously led product strategy at Entersekt and ID.me. His role will steer...

Microsoft is investigating a January Windows 11 security update (KB5074109) that causes the classic Outlook desktop client to freeze for users with POP email accounts. The problem affects devices running the 25H2 and 24H2 builds, preventing Outlook from exiting cleanly and...

The TamperedChef campaign uses malvertising to deliver trojanized PDF manuals that install a backdoor-infostealer on victim networks. Researchers at Sophos observed widespread targeting across Europe, especially in Germany, the UK and France, focusing on firms that rely on specialized technical...

Cybersecurity venture funding surged to $18 billion in 2025, a 26% increase over 2024 and the third‑largest total in a decade. Seven mega‑rounds of $400 million or more, highlighted by Cyera’s $940 million and Saviynt’s $700 million raises, drove the headline growth. Despite higher...

eSentire’s 2025 Year in Review reports a 389 % year‑over‑year surge in account compromise, now accounting for 55 % of all attacks. Credential theft dominates, representing 75 % of malicious activity, with Microsoft 365 as the prime target. Phishing‑as‑a‑Service (PHaaS) kits drove 63 % of...

China’s government has ordered domestic companies to cease using cybersecurity software from U.S. and Israeli vendors, naming more than a dozen firms including CrowdStrike, Palo Alto Networks, and Check Point. Most of the listed companies say they have little or no...

Dropzone AI announced an explosive 2025 performance, scaling its annual recurring revenue eleven‑fold and securing a $37 million Series B round led by Theory Ventures. The company now serves over 300 enterprises, achieving 370% net revenue retention and expanding into regulated sectors...
The 2026 review evaluates five leading e‑signature platforms—pdfFiller, Scrive, OneSpan, Adobe Sign, and DocuSign—tailored for financial institutions. It outlines each solution’s core features, compliance focus, and pricing structures, highlighting pdfFiller’s low‑cost integration and OneSpan’s bank‑grade security. The analysis shows how...

A critical vulnerability was discovered in StellarWP’s Membership Plugin – Restrict Content, exposing Stripe SetupIntent client_secret values. The flaw lets unauthenticated attackers retrieve these secrets without any login or capability checks. Rated 8.2 (high) on the CVSS scale, it affects all releases...

Blue Mantis announced the promotion of Adam Caponigro to Senior Vice President of Services, effective Jan. 1, 2026. In his expanded role he will oversee Managed Services, Professional Services, and Global Delivery Centers across the U.S., Canada, and India, supervising more...

Cisco has released a patch for the critical AsyncOS zero‑day (CVE‑2025‑20393) affecting Secure Email Gateway and Secure Email and Web Manager appliances with internet‑exposed Spam Quarantine. The flaw allowed remote attackers to execute arbitrary commands with root privileges. Cisco Talos...

Check Point Research has identified a coordinated exploitation campaign by the Linux‑based RondoDox botnet targeting HPE OneView’s critical CVE‑2025‑37164 vulnerability. The flaw, scored 10.0 on the CVSS scale, allows unauthenticated remote code execution via the ExecuteCommand REST endpoint. In early...

Microsoft confirmed that the January 13, 2026 cumulative update KB5073455 causes Windows 11 23H2 Enterprise and IoT devices with System Guard Secure Launch to fail shutting down, forcing a restart instead. The bug does not affect consumer editions and also blocks hibernation, leaving machines...
Trusted Smart Chain announced the successful completion of a comprehensive security audit by CertiK, a leading blockchain audit firm. The audit examined smart‑contract logic, permissioning and threat resilience, confirming the network’s readiness for tokenized securities and real‑world asset issuance. By...
Enterprises are racing to deploy generative AI models, but lab performance alone isn’t enough. Generative AI red teaming flips traditional testing by deliberately provoking models with adversarial prompts to uncover hidden failure modes. This process reveals security leaks, bias, hallucinations,...

Chinese‑linked APT group UAT‑8837 has been exploiting a critical Sitecore zero‑day (CVE‑2025‑53690, CVSS 9.0) to breach American critical‑infrastructure networks. The attackers gain initial access via the vulnerability or stolen credentials, then deploy open‑source tools such as GoTokenTheft, SharpHound and Rubeus to...
illumynt announced a 60% year‑over‑year revenue increase for 2025, driven by demand from hyperscalers and data‑intensive enterprises. The company expanded its Columbus, Ohio, site to over 190,000 square feet and designated it as a Global Innovation Center of Excellence. The...
Cursor’s Bugbot, an AI‑driven code‑review agent, has evolved from a prototype to an agentic architecture that now scans over two million pull requests each month. By introducing a custom resolution‑rate metric and running 40 systematic experiments, its bug‑resolution rate climbed from...
Banks face soaring transaction volumes and increasingly complex payment corridors, expanding the fraud surface. Experts argue that merely reacting to bad transactions is insufficient; banks must detect “bad journeys” using predictive AI. When combined with a stream‑first architecture, AI can...

A new NTT global study finds AI integration outpaces enterprise security and governance. Companies expand AI deployments but many lack infrastructure readiness, data integrity controls, and mature governance. Only a small share can support AI at scale; performance drives design,...

The Anchorage Police Department (APD) disclosed a cybersecurity incident on Jan 7, 2026 involving its third‑party data‑migration vendor, Whitebox Technologies. APD reported no evidence that its systems or data were compromised and immediately shut down affected servers while revoking vendor access....

A TransUnion study of U.S. gig workers reveals that 34% have been defrauded by customers, while nearly half admit to renting or selling their accounts. Victims demand stronger identity checks, yet confidence in existing safety tools remains low. The research...

Google is embedding its Gemini generative‑AI engine into Gmail, launching an AI Inbox that auto‑summarizes messages, generates replies, and extracts to‑do items. The rollout includes free features like smart replies and email overviews, while advanced search and proof‑reading tools are...

A critical vulnerability was found in the All in One SEO (AIOSEO) WordPress plugin, affecting over three million sites. The flaw stems from a missing permission check on the /aioseo/v1/ai/credits REST endpoint, allowing contributors to retrieve the site‑wide AI access...

Grubhub confirmed that unauthorized actors downloaded data from its systems, prompting an immediate investigation and security hardening. The company disclosed that financial details and order histories were not compromised, but it is facing extortion demands from the ShinyHunters cybercrime group....
Scammers are exploiting PayPal's official invoice feature to send verified emails that display the blue tick, making them appear authentic. The malicious invoices include a fake support phone number in the "Note to Customer" section, prompting recipients to call and...

Security researchers have identified a critical remote authentication bypass in the Modular DS WordPress plugin, tracked as CVE‑2026‑23550. The flaw, present in versions 2.5.1 and earlier, lets attackers obtain admin‑level access by exploiting a trusted‑request bypass and an automatic login fallback....

European Space Agency (ESA) disclosed that it has been hit by successive cyber‑attacks, resulting in the theft of over 700 GB of data, including proprietary software, credentials, and mission documentation. The first leak, attributed to hacker “888,” exposed more than 200 GB,...

The NDSS 2025 paper investigates how users perceive risk‑based authentication (RBA) notifications triggered by correct passwords, incorrect passwords, and password resets. In a study of 273 participants, over 90% rated these alerts as important, yet they felt suspicious, nervous, and...

The Unit 42 report warns that the Milano‑Cortina 2026 Winter Olympics will be a prime target for cyber‑criminals, nation‑state espionage groups, and hacktivists. Ransomware gangs are expected to exploit ticketing, point‑of‑sale and other critical infrastructure for extortion. State‑linked actors such as...

Amazon’s EKS Auto Mode and EKS Capabilities automate the infrastructure layer of Kubernetes—node provisioning, scaling, networking and storage—while leaving architecture, add‑on lifecycle, and 24×7 incident response to the customer. Fairwinds Managed Kubernetes‑as‑a‑Service (KaaS) assumes those omitted responsibilities, delivering design, full...

Researchers at Germany's CISPA Helmholtz Center disclosed StackWarp, a new hardware vulnerability that spans AMD Zen 1 through Zen 5 processors. The flaw exploits a synchronization error in the CPU's stack engine, allowing a malicious host to manipulate a guest VM's stack...
A Netherlands‑based activist’s site, ICE List, which published personal details of thousands of Immigration and Customs Enforcement and Border Patrol officers, was knocked offline by a large‑scale distributed denial‑of‑service attack on Tuesday. The site’s founder, Dominick Skinner, believes the assault...

Tenzai evaluated five leading AI coding agents—Anysphere Cursor, Claude Code, OpenAI Codex, Replit, and Cognition Devin—by having them build three identical apps. The 15 generated applications contained 69 vulnerabilities, with no exploitable SQL injection or XSS but universal SSRF issues...
Researchers uncovered a five‑year browser‑extension malware campaign dubbed GhostPoster, which hid malicious code inside a PNG image to evade static analysis. The campaign spanned Chrome, Edge and Firefox, ultimately involving 18 extensions and more than 840,000 installations. Koi Security first...
The NASA Office of Inspector General released its 2025 Top Management and Performance Challenges report, highlighting five critical agency priorities, including returning humans to the Moon and sustaining low‑Earth‑orbit operations. The report flags a heat‑shield venting defect on Orion’s spacecraft...

Cyata is building a unified control plane to manage "agentic identity," the emerging security challenge of AI‑driven agents that act across SaaS, endpoints, and data stores. Unlike traditional employee accounts, these agents operate dynamically, creating "shadow agents" that evade existing...

CloudSEK, the Bengaluru‑based AI‑powered cyber‑threat‑intelligence firm, secured a strategic investment from Connecticut Innovations as part of a $10 million Series B2 round. The funding follows a $19 million Series B1 raise and will fuel the company’s U.S. expansion, including a new regional hub in...