The Buyer’s Guide to AI Usage Control
Enterprises are grappling with an explosion of AI tools embedded in SaaS, browsers, and shadow applications, yet most security programs still rely on legacy, perimeter‑focused controls. The new Buyer’s Guide for AI Usage Control highlights that AI risk resides in real‑time interactions, not just data movement, and proposes an interaction‑centric governance model that discovers and enforces policies at the point of use. It outlines a five‑stage maturity path—from discovery to real‑time control—and stresses operational simplicity and future‑proofing as decisive factors. Vendors that deliver seamless, context‑aware enforcement can close the widening visibility gap.
The First 90 Seconds: How Early Decisions Shape Incident Response Investigations
Eric Zimmerman of the SANS Institute argues that incident response failures stem more from early‑stage decisions than from tool gaps. He defines the "first 90 seconds" as a repeatable decision window that recurs each time a new system enters scope,...
When Cloud Outages Ripple Across the Internet
Recent high‑profile outages at AWS, Azure and Cloudflare have shown that cloud failures ripple far beyond compute, crippling the identity layer that underpins authentication and authorization. When shared services such as DNS, load balancers or managed databases go down, even...
Securing the Mid-Market Across the Complete Threat Lifecycle
Mid‑market firms face tight budgets and lean security teams, making traditional, siloed tools costly and inefficient. The article advocates a full‑lifecycle approach—prevention, protection, detection, and response—delivered through integrated platforms such as Bitdefender GravityZone. By unifying endpoint, cloud, identity, and network...
Open VSX Supply Chain Attack Used Compromised Dev Account to Spread GlassWorm
Researchers uncovered a supply‑chain breach of the Open VSX Registry where a legitimate developer’s credentials were hijacked to publish malicious updates of four popular extensions. The poisoned versions, released on Jan 30 2026, embedded the GlassWorm loader and were downloaded over 22,000...
Mandiant Finds ShinyHunters-Style Vishing Attacks Stealing MFA to Breach SaaS Platforms
Mandiant reports a surge in ShinyHunters‑style vishing campaigns that harvest SSO credentials and MFA codes to infiltrate SaaS environments. The attacks, attributed to UNC6661, UNC6671, and UNC6240, impersonate IT staff and use fake credential‑harvesting sites to enroll attackers’ devices for...
Badges, Bytes and Blackmail
Orange Cyberdefense compiled a dataset of 418 publicly announced law‑enforcement actions against cybercrime from 2021 to mid‑2025. The analysis shows extortion, malware distribution and hacking as the most frequently targeted offenses, with arrests accounting for 29% of responses. The United...
ThreatsDay Bulletin: New RCEs, Darknet Busts, Kernel Bugs & 25+ More Stories
The FBI’s seizure of the RAMP cybercrime forum underscores law‑enforcement pressure on underground marketplaces, while Meta confronts a U.S. lawsuit alleging unauthorized access to WhatsApp messages. CISA published its first list of post‑quantum cryptography‑compatible products, urging organizations to prepare for...
3 Decisions CISOs Need to Make to Prevent Downtime Risk in 2026
Enterprises face escalating operational downtime risk, prompting CISOs to prioritize three strategic decisions. First, adopt STIX/TAXII‑compatible threat intelligence feeds that deliver fresh, high‑quality indicators, boosting detection rates by up to 58 %. Second, eliminate noisy false positives to protect analysts from...
Fake Moltbot AI Coding Assistant on VS Code Marketplace Drops Malware
Moltbot, an open‑source AI coding assistant with over 85,000 GitHub stars, has no official Visual Studio Code extension, yet a counterfeit "ClawdBot Agent – AI Coding Assistant" appeared on the Marketplace. Published on January 27 2026, the malicious extension automatically runs on IDE launch...
From Triage to Threat Hunts: How AI Accelerates SecOps
AI‑driven SOC agents are moving from hype to practical augmentation, handling every alert with human‑level accuracy. By automatically correlating telemetry from EDR, identity, cloud and network sources, they eliminate the triage bottleneck and achieve near‑zero dwell time. The continuous investigation...
Fake Python Spellchecker Packages on PyPI Delivered Hidden Remote Access Trojan
Researchers uncovered two malicious PyPI packages, spellcheckerpy and spellcheckpy, that pretended to be spell‑checking tools but delivered a Python‑based remote‑access trojan. The packages were downloaded just over 1,000 times before being removed, with version 1.2.0 adding an execution trigger that runs...
CTEM in Practice: Prioritization, Validation, and Outcomes That Matter
Continuous Threat Exposure Management (CTEM) is a Gartner‑defined, continuous cycle that links threats, vulnerabilities, and attack‑surface data to prioritize exploitable exposures. It moves security from isolated scans to an operational model of scoping, discovery, prioritization, validation, and mobilization. By integrating...
China-Linked Hackers Have Used the PeckBirdy JavaScript C2 Framework Since 2023
Trend Micro researchers have uncovered a JScript‑based command‑and‑control framework called PeckBirdy, used by China‑aligned APT groups since 2023. The framework runs via living‑off‑the‑land binaries across browsers, MSHTA, WScript, Node JS and .NET, delivering modular backdoors such as HOLODONUT and MKDOOR. It powers...
Indian Users Targeted in Tax Phishing Campaign Delivering Blackmoon Malware
Researchers at eSentire have uncovered a tax‑phishing campaign targeting Indian users by masquerading as the Income Tax Department. The campaign delivers a multi‑stage backdoor that first sideloads a malicious DLL, then escalates privileges and installs a Blackmoon trojan variant alongside...
Winning Against AI-Based Attacks Requires a Combined Defensive Approach
Offensive AI is reshaping cyber attacks, with large language models generating and morphing malware in real time. Recent incidents such as Anthropic’s AI‑orchestrated espionage campaign and ClickFix steganography attacks show adversaries bypassing traditional endpoint detection (EDR). Network Detection and Response...
Filling the Most Common Gaps in Google Workspace Security
Google Workspace’s default security leaves critical gaps, especially in Gmail where Business Email Compromise and sophisticated spear‑phishing thrive. Native protections lack contextual awareness of VIP contacts and cannot fully safeguard years‑long email archives. The article recommends enabling advanced scanning, enforcing...
SmarterMail Auth Bypass Exploited in the Wild Two Days After Patch Release
A critical authentication‑bypass flaw in SmarterTools' SmarterMail was patched on Jan 15, 2026, but attackers began exploiting it by Jan 17, 2026. The vulnerability allows unauthenticated users to reset the system administrator password via the /api/v1/auth/force-reset-password endpoint and then execute OS commands, yielding a...
Exposure Assessment Platforms Signal a Shift in Focus
Gartner’s inaugural Magic Quadrant introduces Exposure Assessment Platforms (EAP) as a formal replacement for traditional vulnerability management, emphasizing Continuous Threat Exposure Management. The report evaluated 20 vendors on continuous discovery, risk‑informed prioritization, and cross‑environment visibility. Data shows 74 % of identified...
The Hidden Risk of Orphan Accounts
Orchid Security highlights the growing threat of orphan accounts—unused human, service, and AI identities that remain active across enterprise environments due to fragmented IAM and IGA processes. These hidden credentials, often with elevated privileges, have been leveraged in high‑profile breaches...
Why Secrets in JavaScript Bundles Are Still Being Missed
Intruder scanned 5 million web applications and uncovered over 42,000 exposed tokens hidden in JavaScript bundles. The secrets spanned 334 types, including active GitHub, GitLab, and Linear API keys, as well as Slack, Zapier, and CAD service credentials. Existing scanners—traditional regex‑based...
Black Basta Ransomware Leader Added to EU Most Wanted and INTERPOL Red Notice
Ukrainian and German authorities have arrested two Ukrainian suspects linked to the Black Basta ransomware‑as‑a‑service operation and placed its alleged Russian leader, Oleg Nefedov, on the EU Most Wanted and INTERPOL Red Notice lists. The gang, which emerged in 2022, infiltrated over...
Five Malicious Chrome Extensions Impersonate Workday and NetSuite to Hijack Accounts
Researchers identified five malicious Chrome extensions that masquerade as HR and ERP tools such as Workday, NetSuite, and SuccessFactors. The add‑ons steal authentication cookies, block security‑admin pages, and enable session hijacking by injecting stolen tokens. While most have been removed...
China-Linked APT Exploits Sitecore Zero-Day in Attacks on American Critical Infrastructure
Chinese‑linked APT group UAT‑8837 has been exploiting a critical Sitecore zero‑day (CVE‑2025‑53690, CVSS 9.0) to breach American critical‑infrastructure networks. The attackers gain initial access via the vulnerability or stolen credentials, then deploy open‑source tools such as GoTokenTheft, SharpHound and Rubeus to...
ThreatsDay Bulletin: AI Voice Cloning Exploit, Wi-Fi Kill Switch, PLC Vulns, and 14 More Stories
The latest ThreatsDay bulletin spotlights a wave of high‑severity, unauthenticated remote code execution flaws—from Redis’s XACKDEL buffer overflow affecting roughly 2,900 servers to AI‑ML libraries that execute malicious model metadata. It also flags a Broadcom Wi‑Fi chipset kill‑switch that can...
Model Security Is the Wrong Frame – The Real Risk Is Workflow Security
Security teams are still focusing on protecting AI models, but recent incidents show the real risk lies in the workflows surrounding them. Malicious Chrome extensions harvested chat data from over 900,000 users, and prompt‑injection attacks can coerce AI coding assistants...
4 Outdated Habits Destroying Your SOC's MTTR in 2026
Many security operations centers still rely on outdated, manual processes that slow incident response. The article highlights four habits—manual sample review, sole reliance on static scans, fragmented toolsets, and excessive alert escalations—that inflate mean time to respond. It shows how...
Researchers Null-Route Over 550 Kimwolf and Aisuru Botnet Command Servers
Black Lotus Labs at Lumen Technologies announced that it has null‑routed traffic to more than 550 command‑and‑control nodes used by the AISURU/Kimwolf botnet since early October 2025. The botnet now controls over two million Android devices, primarily unsecured TV boxes, and...
New Research: 64% of 3rd-Party Applications Access Sensitive Data Without Justification
New research shows 64% of third‑party applications on websites access sensitive data without a clear business justification, up from 51% in 2024. Only 39% of security leaders have deployed dedicated web‑exposure solutions, despite 81% ranking web attacks as a top...
Critical Node.js Vulnerability Can Cause Server Crashes via Async_hooks Stack Overflow
Node.js released security updates fixing a critical vulnerability (CVE‑2025‑59466) that causes the runtime to terminate with exit code 7 when a stack overflow occurs while async_hooks is enabled. The bug affects all versions from 8.x through 18.x and impacts major frameworks...
![[Webinar] Securing Agentic AI: From MCPs and Tool Access to Shadow API Key Sprawl](/cdn-cgi/image/width=1200,quality=75,format=auto,fit=cover/https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2N9qZuwkcslheNUOsWaTDrMYeXiBUfw1y-hItTvuGo71srarOm7AWzq3o7ro9E0x_CnC7XmJGXKl1tfkc6gTMK288y6M_zN6Yg1FATduXSQmMlp_jnHESxVYZDuJnNozO_Ff-r-lWIyG5AikC8AwrOckeYVYcCQv2RjeLof2bxV_TrcbvRvZqrTIcjD0/s2600/ai-agent.jpg)
[Webinar] Securing Agentic AI: From MCPs and Tool Access to Shadow API Key Sprawl
The Hacker News webinar spotlights the emerging security gap as agentic AI tools like Copilot, Claude Code, and Codex move from code generation to full‑cycle software deployment. Central to the risk are Machine Control Protocols (MCPs), which dictate which tools,...
New Advanced Linux VoidLink Malware Targets Cloud and Container Environments
Check Point Research has uncovered VoidLink, a sophisticated, cloud‑native Linux malware framework designed for long‑term stealth in cloud and container environments. First seen in December 2025, the platform includes custom loaders, rootkits, and more than 30 plug‑in modules written in Zig,...
China-Linked UAT-7290 Targets Telecoms with Linux Malware and ORB Nodes
A China‑linked threat group identified as UAT‑7290 has been conducting espionage‑focused intrusions against telecom providers in South Asia and, more recently, organizations in southeastern Europe. The actor performs extensive reconnaissance before exploiting one‑day vulnerabilities and SSH brute‑force to compromise edge...
ThreatsDay Bulletin: RustFS Flaw, Iranian Ops, WebUI RCE, Cloud Leaks, and 12 More Stories
This week’s ThreatsDay bulletin highlighted a surge in cyber threats across multiple fronts. CISA expanded its KEV catalog by 245 high‑risk flaws, while a critical hard‑coded token in RustFS exposed clusters to remote takeover. OpenAI faced a court order to...
The State of Trusted Open Source
Chainguard’s quarterly “State of Trusted Open Source” report analyzes usage of over 1,800 container images across its customer base, revealing that Python is the most popular image and that the majority of production workloads rely on a long‑tail of less‑common...
Coolify Discloses 11 Critical Flaws Enabling Full Server Compromise on Self-Hosted Instances
Cybersecurity researchers disclosed eleven critical‑severity flaws in Coolify, an open‑source self‑hosting platform, that enable authenticated users to execute arbitrary commands as root and even escape containers. The vulnerabilities, catalogued as CVE‑2025‑66209 through CVE‑2025‑59158, carry CVSS scores from 9.4 to 10.0....
Critical N8n Vulnerability (CVSS 10.0) Allows Unauthenticated Attackers to Take Full Control
Researchers disclosed CVE‑2026‑21858, a CVSS 10.0 flaw in n8n that lets unauthenticated attackers hijack any instance via a Content‑Type confusion in webhook handling. The vulnerability affects all versions up to 1.65.0 and was patched in version 1.121.0 released November 18, 2025. It joins three...
The Future of Cybersecurity Includes Non-Human Employees
Enterprises are witnessing a surge in non‑human identities (NHIs) such as bots, AI agents, and service accounts, now deemed as critical as human accounts—51% of respondents in ConductorOne's 2025 report affirm this shift. These machine identities often operate with standing,...
Ongoing Attacks Exploiting Critical RCE Vulnerability in Legacy D-Link DSL Routers
A critical remote code execution flaw (CVE‑2026‑0625) has been discovered in legacy D‑Link DSL routers, exploiting the dnscfg.cgi endpoint via command injection. The vulnerability carries a CVSS score of 9.3 and is actively being leveraged in the wild, with attacks...
Two Chrome Extensions Caught Stealing ChatGPT and DeepSeek Chats From 900,000 Users
Security researchers have identified two malicious Chrome extensions—"Chat GPT for Chrome with GPT‑5, Claude Sonnet & DeepSeek AI" and "AI Sidebar with Deepseek, ChatGPT, Claude, and more"—that together have been installed by roughly 900,000 users. The extensions harvest OpenAI ChatGPT...
What Is Identity Dark Matter?
Identity dark matter describes the growing pool of unmanaged human and non‑human identities spread across SaaS, IaaS, on‑prem and shadow applications. Traditional IAM and IGA tools only cover the managed half, leaving bots, service accounts and orphaned users invisible. This...
VS Code Forks Recommend Missing Extensions, Creating Supply Chain Risk in Open VSX
AI‑powered forks of Microsoft VS Code such as Cursor, Windsurf, Google Antigravity and Trae have been found recommending extensions that do not exist in the Open VSX registry. Because the extension names are unclaimed, threat actors can publish malicious packages under those...
Critical AdonisJS Bodyparser Flaw (CVSS 9.2) Enables Arbitrary File Write on Servers
A critical path‑traversal flaw (CVE‑2026‑21440) in the @adonisjs/bodyparser npm package received a CVSS score of 9.2, allowing remote attackers to write arbitrary files when MultipartFile.move() is called without proper sanitization. The vulnerability affects versions up to 10.1.1 and 11.0.0‑next.5 and...
Transparent Tribe Launches New RAT Attacks Against Indian Government and Academia
Transparent Tribe, also known as APT36, has launched a new wave of remote‑access‑trojan (RAT) attacks against Indian government, academic and strategic organizations. The campaign delivers weaponized LNK files disguised as PDFs, which execute HTA scripts via mshta.exe and load a...
The ROI Problem in Attack Surface Management
Attack surface management (ASM) tools promise reduced risk by expanding visibility, yet most programs deliver only larger asset inventories and louder dashboards. Security teams see counts climb and alerts surge, but leadership still struggles to answer whether incidents actually decline....
U.S. Treasury Lifts Sanctions on Three Individuals Linked to Intellexa and Predator Spyware
The U.S. Treasury’s Office of Foreign Assets Control removed three individuals tied to the Intellexa Consortium—responsible for the Predator commercial spyware—from the Specially Designated Nationals list. The delisting followed petitions asserting the subjects had distanced themselves from the consortium, though...
Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware
Silver Fox, a China‑based cyber‑crime group, has shifted its phishing focus to India, using income‑tax‑themed emails to deliver the modular ValleyRAT remote‑access trojan. The campaign tricks recipients into opening a PDF that redirects to a malicious zip file, which contains...
How to Integrate AI Into Modern SOC Workflows
AI is rapidly entering security operations, yet many SOCs lack a structured integration strategy. The 2025 SANS SOC Survey shows 40% of teams use AI tools without defined processes and 42% deploy them out‑of‑the‑box, leading to inconsistent value. Effective adoption...
⚡ Weekly Recap: MongoDB Attacks, Wallet Breaches, Android Spyware, Insider Crime & More
The weekly cyber recap highlights a wave of active exploits, most notably the MongoDB "MongoBleed" vulnerability (CVE‑2025‑14847) being leveraged against over 87,000 instances worldwide. High‑profile breaches include a Trust Wallet Chrome extension hack that cost users roughly $7 million and a...
MongoDB Vulnerability CVE-2025-14847 Under Active Exploitation Worldwide
MongoDB disclosed a critical vulnerability (CVE‑2025‑14847, CVSS 8.7) that allows unauthenticated attackers to read server memory via a flaw in zlib compression. Over 87,000 internet‑exposed instances have been identified, with 42% of cloud environments hosting at least one vulnerable deployment. The...