Trusted Smart Chain Completes CertiK Audit, Advancing Secure RWA Tokenization
Trusted Smart Chain announced the successful completion of a comprehensive security audit by CertiK, a leading blockchain audit firm. The audit examined smart‑contract logic, permissioning and threat resilience, confirming the network’s readiness for tokenized securities and real‑world asset issuance. By embedding security and regulatory alignment at the protocol level, the chain aims to provide a trustworthy foundation for compliant on‑chain finance. The milestone positions the platform as a viable infrastructure for regulated financial instruments moving onto blockchain.
You Have Built an AI. Have You Tried to Break It?
Enterprises are racing to deploy generative AI models, but lab performance alone isn’t enough. Generative AI red teaming flips traditional testing by deliberately provoking models with adversarial prompts to uncover hidden failure modes. This process reveals security leaks, bias, hallucinations,...
China-Linked APT Exploits Sitecore Zero-Day in Attacks on American Critical Infrastructure
Chinese‑linked APT group UAT‑8837 has been exploiting a critical Sitecore zero‑day (CVE‑2025‑53690, CVSS 9.0) to breach American critical‑infrastructure networks. The attackers gain initial access via the vulnerability or stolen credentials, then deploy open‑source tools such as GoTokenTheft, SharpHound and Rubeus to...
Illumynt Reports 60% Revenue Growth and Launches Global Innovation Center to Meet Rising Enterprise Security and Sustainability Demands
illumynt announced a 60% year‑over‑year revenue increase for 2025, driven by demand from hyperscalers and data‑intensive enterprises. The company expanded its Columbus, Ohio, site to over 190,000 square feet and designated it as a Global Innovation Center of Excellence. The...
Building a Better Bugbot
Cursor’s Bugbot, an AI‑driven code‑review agent, has evolved from a prototype to an agentic architecture that now scans over two million pull requests each month. By introducing a custom resolution‑rate metric and running 40 systematic experiments, its bug‑resolution rate climbed from...
How Banks Can Reduce Fraud and False Declines with Predictive AI and Stream-First Architecture
Banks face soaring transaction volumes and increasingly complex payment corridors, expanding the fraud surface. Experts argue that merely reacting to bad transactions is insufficient; banks must detect “bad journeys” using predictive AI. When combined with a stream‑first architecture, AI can...
New Intelligence Is Moving Faster than Enterprise Controls
A new NTT global study finds AI integration outpaces enterprise security and governance. Companies expand AI deployments but many lack infrastructure readiness, data integrity controls, and mature governance. Only a small share can support AI at scale; performance drives design,...
APD Investigates Third-Party Cybersecurity Incident, Says No Evidence of Data Compromise
The Anchorage Police Department (APD) disclosed a cybersecurity incident on Jan 7, 2026 involving its third‑party data‑migration vendor, Whitebox Technologies. APD reported no evidence that its systems or data were compromised and immediately shut down affected servers while revoking vendor access....
Who’s on the Other End? Rented Accounts Are Stress-Testing Trust in Gig Platforms
A TransUnion study of U.S. gig workers reveals that 34% have been defrauded by customers, while nearly half admit to renting or selling their accounts. Victims demand stronger identity checks, yet confidence in existing safety tools remains low. The research...
Google Brings Generative AI to Gmail, Raising New Privacy Questions
Google is embedding its Gemini generative‑AI engine into Gmail, launching an AI Inbox that auto‑summarizes messages, generates replies, and extracts to‑do items. The rollout includes free features like smart replies and email overviews, while advanced search and proof‑reading tools are...
All In One SEO WordPress Vulnerability Affects Over 3 Million Sites via @Sejournal, @Martinibuster
A critical vulnerability was found in the All in One SEO (AIOSEO) WordPress plugin, affecting over three million sites. The flaw stems from a missing permission check on the /aioseo/v1/ai/credits REST endpoint, allowing contributors to retrieve the site‑wide AI access...
Grubhub Confirms Hackers Stole Data in Recent Security Breach
Grubhub confirmed that unauthorized actors downloaded data from its systems, prompting an immediate investigation and security hardening. The company disclosed that financial details and order histories were not compromised, but it is facing extortion demands from the ShinyHunters cybercrime group....
New PayPal Scam Sends Verified Invoices With Fake Support Numbers
Scammers are exploiting PayPal's official invoice feature to send verified emails that display the blue tick, making them appear authentic. The malicious invoices include a fake support phone number in the "Note to Customer" section, prompting recipients to call and...
Hackers Exploit Modular DS WordPress Plugin Flaw for Admin Access
Security researchers have identified a critical remote authentication bypass in the Modular DS WordPress plugin, tracked as CVE‑2026‑23550. The flaw, present in versions 2.5.1 and earlier, lets attackers obtain admin‑level access by exploiting a trusted‑request bypass and an automatic login fallback....
Cyberthieves Hit European Space Agency, Stealing Hundreds of Gigabytes of Data
European Space Agency (ESA) disclosed that it has been hit by successive cyber‑attacks, resulting in the theft of over 700 GB of data, including proprietary software, credentials, and mission documentation. The first leak, attributed to hacker “888,” exposed more than 200 GB,...
NDSS 2025 – “Who Is Trying To Access My Account?”
The NDSS 2025 paper investigates how users perceive risk‑based authentication (RBA) notifications triggered by correct passwords, incorrect passwords, and password resets. In a study of 273 participants, over 90% rated these alerts as important, yet they felt suspicious, nervous, and...
Winter Olympics Could Share Podium With Cyberattackers
The Unit 42 report warns that the Milano‑Cortina 2026 Winter Olympics will be a prime target for cyber‑criminals, nation‑state espionage groups, and hacktivists. Ransomware gangs are expected to exploit ticketing, point‑of‑sale and other critical infrastructure for extortion. State‑linked actors such as...
The Cost of EKS Auto + Capabilities vs Fairwinds Managed KaaS
Amazon’s EKS Auto Mode and EKS Capabilities automate the infrastructure layer of Kubernetes—node provisioning, scaling, networking and storage—while leaving architecture, add‑on lifecycle, and 24×7 incident response to the customer. Fairwinds Managed Kubernetes‑as‑a‑Service (KaaS) assumes those omitted responsibilities, delivering design, full...
New StackWarp Attack Threatens Confidential VMs on AMD Processors
Researchers at Germany's CISPA Helmholtz Center disclosed StackWarp, a new hardware vulnerability that spans AMD Zen 1 through Zen 5 processors. The flaw exploits a synchronization error in the CPU's stack engine, allowing a malicious host to manipulate a guest VM's stack...
Website that Leaked Thousands of ICE Agents’ Personal Information Is Down After DDoS Attack
A Netherlands‑based activist’s site, ICE List, which published personal details of thousands of Immigration and Customs Enforcement and Border Patrol officers, was knocked offline by a large‑scale distributed denial‑of‑service attack on Tuesday. The site’s founder, Dominick Skinner, believes the assault...
Vibe Coding Tested: AI Agents Nail SQLi but Fail Miserably on Security Controls
Tenzai evaluated five leading AI coding agents—Anysphere Cursor, Claude Code, OpenAI Codex, Replit, and Cognition Devin—by having them build three identical apps. The 15 generated applications contained 69 vulnerabilities, with no exploitable SQL injection or XSS but universal SSRF issues...
GhostPoster Browser Malware Hid for 5 Years With 840,000 Installs
Researchers uncovered a five‑year browser‑extension malware campaign dubbed GhostPoster, which hid malicious code inside a PNG image to evade static analysis. The campaign spanned Chrome, Edge and Firefox, ultimately involving 18 extensions and more than 840,000 installations. Koi Security first...
NASA’s Top Five Challenges: New Report
The NASA Office of Inspector General released its 2025 Top Management and Performance Challenges report, highlighting five critical agency priorities, including returning humans to the Moon and sustaining low‑Earth‑orbit operations. The report flags a heat‑shield venting defect on Orion’s spacecraft...
The Next Security Battleground: Agentic Identity
Cyata is building a unified control plane to manage "agentic identity," the emerging security challenge of AI‑driven agents that act across SaaS, endpoints, and data stores. Unlike traditional employee accounts, these agents operate dynamically, creating "shadow agents" that evade existing...
CloudSEK Secures Strategic Investment From Connecticut Innovations
CloudSEK, the Bengaluru‑based AI‑powered cyber‑threat‑intelligence firm, secured a strategic investment from Connecticut Innovations as part of a $10 million Series B2 round. The funding follows a $19 million Series B1 raise and will fuel the company’s U.S. expansion, including a new regional hub in...
Global Agencies Release New Guidance to Secure Industrial Networks
The U.S. Cybersecurity and Infrastructure Security Agency, the U.K. National Cyber Security Centre, and the FBI released a joint set of security principles for operational technology (OT) environments. The guidance addresses the expanding attack surface caused by increased connectivity between...
NDSS 2025 – SKILLPoV: Towards Accessible And Effective Privacv Notice For Amazon Alexa Skills
Researchers at NDSS 2025 introduced SKILLPoV, a tool that automatically generates voice‑based privacy notices for Amazon Alexa skills. By analyzing skill code and leveraging ChatGPT, SKILLPoV creates concise notices delivered at skill launch, achieving 91.3% detection accuracy and 96.4% completeness....
Hackers Increasingly Shun Encryption in Favour of Pure Data Theft and Extortion
Cyber‑criminals are increasingly abandoning encryption‑based ransomware in favor of pure data‑theft extortion. Symantec and Carbon Black report a jump from 28 incidents in 2024 to nearly 1,500 in 2025, while traditional ransomware remained flat at about 4,700 attacks. The surge...
Vulnerabilities Surge, But Messy Reporting Blurs Picture
The National Vulnerability Database recorded a record 48,177 CVE identifiers for 2025, marking the ninth consecutive year of growth. Reporting is now dominated by new CNAs, with Patchstack, Wordfence and WPScan contributing 23% of all entries and MITRE falling to...
Seerist Launches AskAnna, a Breakthrough AI-Powered Q&A Tool Transforming Security and Intelligence Workflows
Seerist has launched AskAnna, an AI‑powered natural‑language Q&A tool that taps the company’s proprietary event models and Control Risks’ human‑generated analysis to deliver fully sourced intelligence answers. The platform instantly synthesizes thousands of vetted reports, providing line‑item attribution and transparent...
HHS OCR Comments on Its 2026 Priorities
The HHS Office for Civil Rights (OCR) released its 2026 enforcement roadmap, highlighting four priority areas: continuing the HIPAA Privacy Rule Right of Access initiative, expanding the Security Rule Risk Analysis to broader risk management, intensifying hacking and ransomware actions,...
Cyber Threat Actors Ramp Up Attacks on Industrial Environments
Cybercriminals and hacktivists sharply increased attacks on industrial control systems in 2025, with vulnerability disclosures nearly doubling to 2,451 across 152 vendors. Siemens was the most affected vendor, reporting 1,175 flaws, while Schneider Electric faced a higher proportion of critical...
CodeBuild Flaw Put AWS Console Supply Chain At Risk
Security researchers at Wiz uncovered a critical misconfiguration in AWS CodeBuild that let unauthenticated attackers inject malicious code into core AWS open‑source repositories, including the widely used AWS SDK for JavaScript. The flaw stemmed from an unanchored regular‑expression filter on...
Feedzai and Matrix USA Launch Global Partnership to Modernize Financial-Crime Prevention with AI-Native Defenses
Feedzai, the AI-native risk‑operations platform, has partnered with Matrix USA to create a global Center of Excellence that accelerates AI‑driven fraud and anti‑money‑laundering (AML) deployments for banks. The collaboration blends Feedzai’s real‑time detection engine with Matrix USA’s advisory and integration...
Saying Goodbye to Windows Hello for Business: Five User Experience Pitfalls that Make Business Leaders Go for Best-in-Breed Solutions
The article highlights five user‑experience pitfalls of Windows Hello for Business that cause employees to abandon biometric authentication. Environmental variables—lighting, glasses, hats, facial hair, and device positioning—lead to frequent failures, prompting users to fall back on PINs or passwords. This...
Report: Massive Amounts of Sensitive Data Being Shared with GenAI Tools
A Harmonic Security report analyzing 22.4 million prompts across six generative AI tools reveals an exponential rise in sensitive data exposure, with 71% of incidents tied to ChatGPT. Approximately 579,000 prompts (2.6%) contained company‑sensitive information, especially code, legal discourse, and M&A...
Promptware Kill Chain – Five-Step Kill Chain Model For Analyzing Cyberthreats
The Promptware Kill Chain introduces a five‑step framework that treats malicious prompts and poisoned content as a distinct class of AI malware. It maps the lifecycle of attacks on large language model applications from initial access through privilege escalation, persistence,...
CISO Role Reaches “Inflexion Point” With Executive-Level Titles
The 2026 State of the CISO Report shows a structural shift, with 46% of North American CISOs now holding executive titles such as EVP or SVP. Over half of respondents say their role has expanded to cover SecOps, architecture, GRC,...
ThreatsDay Bulletin: AI Voice Cloning Exploit, Wi-Fi Kill Switch, PLC Vulns, and 14 More Stories
The latest ThreatsDay bulletin spotlights a wave of high‑severity, unauthenticated remote code execution flaws—from Redis’s XACKDEL buffer overflow affecting roughly 2,900 servers to AI‑ML libraries that execute malicious model metadata. It also flags a Broadcom Wi‑Fi chipset kill‑switch that can...
AI Security Platform WitnessAI Raises $58m to Expand Globally
WitnessAI secured $58 million in strategic funding led by Sound Ventures, aiming to accelerate global expansion and broaden its AI security suite. The platform provides enterprises with real‑time visibility and control over large‑language models and autonomous AI agents, addressing governance gaps...
Meeting the New ETSI Standard for AI Security
ETSI has released EN 304 223, the first globally applicable European standard that defines baseline security requirements for AI systems across enterprises. The standard aligns with the EU AI Act and introduces concrete provisions covering deep neural networks, generative AI,...
JPMorgan Claims Ex-Advisor In Fla. Stole Trade Secrets To Poach Clients For LPL
JPMorgan has filed a federal lawsuit seeking a temporary restraining order against former private‑client advisor Kevin J. Sercia. The bank alleges Sercia accessed roughly 175 client profiles on its Advisor Central system after hours and stole confidential information to solicit...
New CastleLoader Variant Linked to 469 Infections Across Critical Sectors
Cyber‑security firm ANY.RUN has identified a new, more stealthy variant of the CastleLoader malware, now linked to 469 compromised devices across U.S. government agencies and European critical infrastructure. The loader uses a social‑engineering “ClickFix” prompt and Inno Setup/AutoIt to gain...
Delinea Acquries StrongDM to Secure Access to IT Infrastructure
Delinea announced it will acquire StrongDM, a platform that provides just‑in‑time (JIT) access to IT infrastructure for both human operators and non‑human identities. The deal expands Delinea’s privileged access management suite to cover dynamic, AI‑driven workloads and supports a zero...
7 Reasons to Get Certified in API Security
Wallarm University now offers a free, hands‑on API security certification that lets participants run real attacks and practice defenses. The program is built by seasoned API security experts and covers emerging threats such as AI‑driven and agentic APIs. Recent Wallarm...
Data Privacy Teams Face Staffing Shortages and Budget Constraints, ISACA Warns
ISACA’s State of Privacy 2026 report reveals that median privacy team size dropped to five members, down from eight the previous year, while technical privacy roles face the steepest shortages. Budget pressures persist, with only 36% of respondents feeling adequately...
Classroom Device Management: 8 Strategies for K-12 Success
Classroom device management is essential for K‑12 schools integrating laptops, tablets, and BYOD. The article outlines eight practical strategies, including clear rules, mobile device management tools, app whitelisting, screen monitoring, scheduled access, BYOD integration, activity tracking, and continuous teacher development....
Hundreds of Millions of Audio Devices Need a Patch to Prevent Wireless Hacking and Tracking
Researchers at KU Leuven uncovered critical Fast Pair flaws in 17 audio accessories from ten manufacturers, enabling a WhisperPair attack that silently hijacks Bluetooth earbuds, headphones, and speakers within 50 feet. The vulnerability lets attackers take control of audio streams, activate...
Model Security Is the Wrong Frame – The Real Risk Is Workflow Security
Security teams are still focusing on protecting AI models, but recent incidents show the real risk lies in the workflows surrounding them. Malicious Chrome extensions harvested chat data from over 900,000 users, and prompt‑injection attacks can coerce AI coding assistants...