Latest news about information security vulnerabilities, threats, incidents and events
Prevention of security vulnerabilities, threats, and incidents described below is wiser and cheaper than forensic investigations and mitigation of the consequences of a cyber-attack.
You can get evidence of this fact from the news below.
Use our services to find and mitigate your security vulnerabilities before the security threat agents find them.
Webinar: See How Identity Blind Spots Put Your SOC at Risk and How to Close Them
Security teams have more alerts, logs, and monitoring tools than ever. Yet when an attack happens, one simple question can still take too long to answer: Who or what is behind this activity, and what can they access? A suspicious login might belong to an employee...
More details.
Posted on Thu, 12 Nov 2026 23:37:15 +0530
ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories
A search result isn't always safe. An access request isn't always harmless. And a familiar account doesn't always mean a familiar person is using it. Simple things to remember. Yet a surprising amount of this week's trouble starts right there...
More details.
Posted on Thu, 12 Nov 2026 23:32:51 +0530
New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access
Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver. The proof of concept, called SignDrop, targets a log-authentication feature added to the driver last year...
More details.
Posted on Thu, 12 Nov 2026 23:20:27 +0530
Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry
A critical flaw in Red Hat Quay allows an attacker who can access a Quay registry to read and overwrite private container images in every repository. Quay enables anonymous access by default, and while it is enabled, the attacker needs no account...
More details.
Posted on Thu, 12 Nov 2026 21:57:01 +0530
Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass
Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authentication bypass...
More details.
Posted on Thu, 12 Nov 2026 21:08:49 +0530
186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers
Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of extensions that hijack user searches...
More details.
Posted on Thu, 12 Nov 2026 20:45:40 +0530
SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths
The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged...
More details.
Posted on Thu, 12 Nov 2026 18:38:28 +0530
Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs
Google Cloud VMs on AMD Turin chips need a guest OS patch and a stop-and-start to protect against three CPU side-channel flaws, Google said this week. The company has already applied mitigations against attacks between VMs, and between VMs and the host...
More details.
Posted on Thu, 12 Nov 2026 17:39:14 +0530
New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access
N-able on Thursday said it's investigating a new public disclosure containing claims of additional vulnerabilities in on-premise versions of N-central running version 2026.4.1 HF2. "Based on our initial review, the server issue described depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet," N-able said in a new advisory...
More details.
Posted on Thu, 12 Nov 2026 17:21:43 +0530
Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign
Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users. Every check defenders normally lean on to judge a link came back clean, and the operator designed it that way on purpose...
More details.
Posted on Thu, 12 Nov 2026 17:21:31 +0530
PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution
PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in remote code execution. The security flaw, tracked as CVE-2026-126325, carries a CVSS v4 score of 9...
More details.
Posted on Thu, 12 Nov 2026 17:03:15 +0530
Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover
A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occurs only if that server is later chosen to take over as the main server while it still lacks some recent changes...
More details.
Posted on Thu, 12 Nov 2026 14:55:00 +0530
Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data
A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines. A second HTTP/2 flaw can cause a server to send a client pieces of its memory, including responses intended for other connections...
More details.
Posted on Thu, 12 Nov 2026 13:50:37 +0530
Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories
Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company...
More details.
Posted on Thu, 12 Nov 2026 12:12:47 +0530
Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2...
More details.
Posted on Thu, 12 Nov 2026 10:42:26 +0530
ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients
ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access. In an advisory posted on its site, the company said there is no evidence that the incident involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software...
More details.
Posted on Thu, 12 Nov 2026 10:09:48 +0530
Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation
Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulnerabilities are listed below - CVE-2026-108186 (CVSS score: 9...
More details.
Posted on Wed, 11 Nov 2026 21:42:46 +0530
AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets
Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot laterally into compromised environments...
More details.
Posted on Wed, 11 Nov 2026 21:04:27 +0530
Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits
Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026. Cynet's CyOps and Research teams said they identified the suspicious activity in October 2026 against several E...
More details.
Posted on Wed, 11 Nov 2026 19:31:00 +0530
Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords
Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday. They included 24 apps built by staff at the social network X and at SpaceXSI, the company that makes the Grok AI assistant...
More details.
Posted on Wed, 11 Nov 2026 17:49:40 +0530
We Built An Agent That Broke All of Our Security Rules. Here's What We Learned.
We tell customers three things about securing AI agents: they need their own identities, access that fits the job they’re given, and traceability that’s separate from any human’s. That was true for us at Token as well...
More details.
Posted on Wed, 11 Nov 2026 17:31:59 +0530
eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
The in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys. Each intermediate CA has its own private key, which the company uses to sign the certificates it issues...
More details.
Posted on Wed, 11 Nov 2026 17:30:53 +0530
Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes
Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws. These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server...
More details.
Posted on Wed, 11 Nov 2026 13:47:53 +0530
Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges
AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges itself when an AI provider will not refund them...
More details.
Posted on Wed, 11 Nov 2026 13:19:04 +0530
Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons
An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown. When a chosen trigger appears, the model outputs an attacker's command, which an agent using that model would run with the agent's own permissions...
More details.
Posted on Wed, 11 Nov 2026 12:51:05 +0530
Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation...
More details.
Posted on Wed, 11 Nov 2026 11:34:02 +0530
Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2...
More details.
Posted on Wed, 11 Nov 2026 00:53:10 +0530
SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users
An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday. The attacker could also have seen requests being processed on that server that day, including requests sent in confidential mode, the company said earlier this week...
More details.
Posted on Wed, 11 Nov 2026 00:49:39 +0530
Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access
French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild. The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062...
More details.
Posted on Tue, 10 Nov 2026 23:42:21 +0530
Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem
Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year...
More details.
Posted on Tue, 10 Nov 2026 23:13:23 +0530
Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant. The activity, observed by Huntress in early October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems...
More details.
Posted on Tue, 10 Nov 2026 21:30:55 +0530
Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America
The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat...
More details.
Posted on Tue, 10 Nov 2026 21:28:44 +0530
Fireworks AI Confirms Wider Breach Affecting Customer Datasets, Model Weights and Notion AI Chats
Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts...
More details.
Posted on Tue, 10 Nov 2026 21:03:59 +0530
Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today...
More details.
Posted on Tue, 10 Nov 2026 17:45:31 +0530
Beyond the Alert: The Case for Rich Network Data
At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prevention has its limits, we arrive at an interdiction strategy: finding and disrupting what got in...
More details.
Posted on Tue, 10 Nov 2026 17:08:13 +0530
Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined...
More details.
Posted on Tue, 10 Nov 2026 15:46:51 +0530
Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails...
More details.
Posted on Tue, 10 Nov 2026 15:37:29 +0530
SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution
Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score. Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server...
More details.
Posted on Tue, 10 Nov 2026 15:32:40 +0530
France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites
An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday...
More details.
Posted on Tue, 10 Nov 2026 14:38:20 +0530
Anthropic's Claude Fable 5.2 Beats GPT-6 Cyber in Multi-Stage Cyberattack Benchmark
Anthropic on Monday released Claude Fable 5.2 and Claude Mythos 5.2 models, which it said exhibit improvements in coding, reasoning, and vision. During pre-release training, the large language models (LLMs)...
More details.
Posted on Tue, 10 Nov 2026 13:46:14 +0530
Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: 8...
More details.
Posted on Tue, 10 Nov 2026 12:22:54 +0530
N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits
N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell...
More details.
Posted on Tue, 10 Nov 2026 12:14:36 +0530
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation...
More details.
Posted on Tue, 10 Nov 2026 12:01:42 +0530
Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data
An attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today. The attacker used credentials for an AWS account that Qubole's platform uses to reach those customers...
More details.
Posted on Mon, 09 Nov 2026 23:21:21 +0530
Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware
Attackers used the Ethersphere project's own release automation to publish malicious versions of two of its tools for the Swarm decentralized storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2. Both releases download and run code built to steal the wallet key that Swarm Desktop keeps for its node, along with the stored password that unlocks it...
More details.
Posted on Mon, 09 Nov 2026 23:06:28 +0530
Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia
The South Asian cyber espionage group known as Bitter (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported remote access trojan called PapRAT...
More details.
Posted on Mon, 09 Nov 2026 20:01:29 +0530
⚡ Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More
A system doesn't always need a complicated bug to let someone in. Sometimes, a blank password is enough. That's one of the bigger stories this week. And it gets worse when the tools meant to keep systems updated or running safely become part of the attack...
More details.
Posted on Mon, 09 Nov 2026 18:58:25 +0530
Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars
The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine...
More details.
Posted on Mon, 09 Nov 2026 16:57:53 +0530
Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety
Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker. Keplr uses a company called Web3Auth to run that Google and Apple sign-in. The attacker used a security flaw at that company to reach the wallets, both companies said late last week...
More details.
Posted on Mon, 09 Nov 2026 16:26:25 +0530
LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks
Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday. It has several security fixes to release and asked operators to be careful until they are out...
More details.
Posted on Mon, 09 Nov 2026 15:31:21 +0530
Student Loan Breach Exposes 2.5M Records
2.5 million people were affected, in a breach that could spell more trouble down the line.
More details.
Posted on Wed, 31 Aug 2022 12:57:48 +0000
Watering Hole Attacks Push ScanBox Keylogger
Researchers uncover a watering hole attack likely carried out by APT TA423, which attempts to plant the ScanBox JavaScript-based reconnaissance tool.
More details.
Posted on Tue, 30 Aug 2022 16:00:43 +0000
Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms
Over 130 companies tangled in sprawling phishing campaign that spoofed a multi-factor authentication system.
More details.
Posted on Mon, 29 Aug 2022 14:56:19 +0000
Ransomware Attacks are on the Rise
Lockbit is by far this summer’s most prolific ransomware group, trailed by two offshoots of the Conti group.
More details.
Posted on Fri, 26 Aug 2022 16:44:27 +0000
Cybercriminals Are Selling Access to Chinese Surveillance Cameras
Tens of thousands of cameras have failed to patch a critical, 11-month-old CVE, leaving thousands of organizations exposed.
More details.
Posted on Thu, 25 Aug 2022 18:47:15 +0000
Twitter Whistleblower Complaint: The TL;DR Version
Twitter is blasted for security and privacy lapses by the company’s former head of security who alleges the social media giant’s actions amount to a national security risk.
More details.
Posted on Wed, 24 Aug 2022 14:17:04 +0000
Firewall Bug Under Active Attack Triggers CISA Warning
CISA is warning that Palo Alto Networks’ PAN-OS is under active attack and needs to be patched ASAP.
More details.
Posted on Tue, 23 Aug 2022 13:19:58 +0000
Fake Reservation Links Prey on Weary Travelers
Fake travel reservations are exacting more pain from the travel weary, already dealing with the misery of canceled flights and overbooked hotels.
More details.
Posted on Mon, 22 Aug 2022 13:59:06 +0000
iPhone Users Urged to Update to Patch 2 Zero-Days
Separate fixes to macOS and iOS patch respective flaws in the kernel and WebKit that can allow threat actors to take over devices and are under attack.
More details.
Posted on Fri, 19 Aug 2022 15:25:56 +0000
Google Patches Chrome’s Fifth Zero-Day of the Year
An insufficient validation input flaw, one of 11 patched in an update this week, could allow for arbitrary code execution and is under active attack.
More details.
Posted on Thu, 18 Aug 2022 14:31:38 +0000
BTH News: AI Finds 948 Paths to Root, a Password That Shouldn’t Work, and an Outlook Zero-Day
AI creates 948 Linux exploits, a password bypasses certain OpenSSH systems, attackers exploit an Outlook flaw, and ScreenConnect puts MSP access at risk.
More details.
Posted on Thu, 12 Nov 2026 17:20:15 +0000
Internet-Connected Doesn't Mean Internet-Accessible
Just because a device connects to the Internet doesn't mean the Internet can connect to it. Learn why the difference matters, what recent refrigeration attacks reveal, and how to protect your connected devices...
More details.
Posted on Tue, 10 Nov 2026 15:43:35 +0000
BTH News: A $6.3 Billion Job Interview, AI Hijacking, and More
A fake job interview becomes part of a $6.34 billion cryptocurrency theft. Hackers steal AI credentials and run up enormous bills. Cyberattacks hit European refrigeration systems, compromised websites target smartphones, and White House Internet addresses appear inside residential proxy networks...
More details.
Posted on Thu, 05 Nov 2026 15:52:04 +0000
CVSS, KEV, and EPSS: Three Signals, Not One Answer
CVSS measures severity. CISA's KEV catalog records known exploitation. EPSS estimates the chance of exploitation in the next 30 days. Here's how to use all three without mistaking any one of them for risk...
More details.
Posted on Tue, 03 Nov 2026 16:53:53 +0000
Black October: When Every Cybersecurity Vulnerability Is an Emergency, Nothing Is
Cybersecurity has an urgency problem. Brotli and PHP2Shell are real threats, but CVSS, KEV, exposure, and business impact answer different risk questions.
More details.
Posted on Fri, 30 Oct 2026 15:54:41 +0000
BTH News: October 29, 2026
Emergency Brotli patches, a poisoned LiteLLM release, PHP2Shell exploitation, and AI-assisted attacks in South Korea—plus what defenders should do next.
More details.
Posted on Thu, 29 Oct 2026 15:20:19 +0000
I Went Wardriving Nearly 25 Years Ago. Here’s What I Found.
Nearly 25 years ago, I mapped early Wi-Fi networks in Pennsylvania. More than 80% did not appear to be using WEP encryption—and WEP itself was already broken.
More details.
Posted on Tue, 27 Oct 2026 13:13:40 +0000
BTH News: October 22, 2026
Two critical PHP flaws meet forgotten systems, a 16-year-old Broadcom Wi-Fi bug, AI agents attacking 1,200 sites for about $5,000, and certificate-authority keys that were practically guessable. This week’s lesson: understand the real-world risk behind the headline...
More details.
Posted on Thu, 22 Oct 2026 15:56:53 +0000
BTH News: October 16, 2026
Microsoft's record Patch Tuesday, North Korean laptop farms in Texas, cryptocurrency hardware tampering, and an alleged listening device at OpenAI. Here's what caught my attention in cybersecurity this week...
More details.
Posted on Fri, 16 Oct 2026 15:00:00 +0000
The French Fridge Failure: A Lesson in Internet Exposure
Attackers remotely manipulated refrigeration systems at hundreds of French supermarkets, pushing temperatures as high as 50°C (122°F) and spoiling food. The incident is a stark reminder that critical management interfaces should never be exposed directly to the Internet...
More details.
Posted on Wed, 14 Oct 2026 21:30:59 +0000
Twenty-Five Years Later, What I Remember About September 11
Twenty-five years after September 11, 2001, I look back on the helplessness I felt watching the attacks unfold, and how ten days later I found a small way to help through my work in cybersecurity.
More details.
Posted on Fri, 11 Sep 2026 20:36:37 +0000
The Self-Scheduled Scam
A fake $499.99 PayPal charge appeared on my son’s calendar exactly one year after I documented a similar attack. Here is how calendar invite phishing works, what it means, and what to do when one appears...
More details.
Posted on Thu, 20 Aug 2026 15:14:59 +0000
Your Next Cyberattack Could Start with a Job Application
North Korean IT worker schemes are back in the spotlight with Season 2 of To Catch a Thief. But this isn't just a story about North Korea. It's a reminder that in an era of remote work and AI-generated identities, your next cyberattack could begin with a job application...
More details.
Posted on Thu, 06 Aug 2026 18:14:28 +0000
The Jurassic Park Moment for AI Security: When AI Starts Testing the Fence
AI doesn’t need to be malicious to become dangerous. It only needs an objective. Here’s what the OpenAI and Hugging Face incident teaches us about the future of cybersecurity.
More details.
Posted on Mon, 27 Jul 2026 16:01:00 +0000
So You Want a Career in Cybersecurity?
After nearly three decades in cybersecurity, hundreds of interviews, and building global security teams, here are the lessons I wish someone had shared when I was starting out.
More details.
Posted on Thu, 16 Jul 2026 14:30:00 +0000
A CAPTCHA Should Never Ask You to Open Terminal
A fake CAPTCHA on a trusted website tried to trick me into opening Terminal and executing a malicious command. That experience led to a deeper investigation into ClickFix, a rapidly growing social engineering technique that exploits trust instead of software vulnerabilities, and why attackers are increasingly impersonating security itself...
More details.
Posted on Wed, 08 Jul 2026 15:11:00 +0000
AI Agents Aren’t Employees: Why Identity Isn’t Enough
Enterprise security has spent decades answering two questions: Who are you? and What are you allowed to do? As AI agents become digital workers, identity and governance remain essential, but they may no longer be enough...
More details.
Posted on Thu, 02 Jul 2026 14:15:00 +0000
World Password Day 2026: Passwords Still Matter (Whether We Like It or Not)
Passwords remain one of the most common ways attackers gain access. Despite years of awareness, weak credentials, reuse, and exposure continue to drive breaches.
More details.
Posted on Thu, 07 May 2026 14:34:00 +0000
The Mythos Discovery: What It Means for Vulnerability Disclosure
Earlier this month, Anthropic's Claude Mythos Preview AI model discovered 27-year-old bugs that survived decades of human review. The Cloud Security Alliance, SANS, and over 100 CISOs just published emergency guidance...
More details.
Posted on Thu, 23 Apr 2026 14:14:00 +0000
How to Prioritize Vulnerability Remediation (Without Losing Your Mind)
Running a vulnerability scan is easy. Treating every finding as urgent is not. This model helps teams prioritize real risk instead of chasing severity scores.
More details.
Posted on Tue, 10 Feb 2026 03:27:29 +0000
Shocking 12 Recent Major Cyber Attacks 2026 That Are Reshaping Global Security
The year 2026 has already witnessed an alarming rise in cybercrime activity worldwide. From large-scale ransomware incidents to sophisticated nation-state espionage campaigns, the recent major cyber attacks 2026 highlight a rapidly evolving digital threat landscape...
More details.
Posted on Wed, 18 Feb 2026 20:28:47 +0000
Linux Security in 2026: Threat Landscape, Trending Attacks, and How to Harden Your Servers
Linux underpins cloud infrastructure, containers, edge devices, and supercomputers — and while it’s long been regarded as a secure platform, attackers are increasingly focusing on its ubiquitous presence...
More details.
Posted on Wed, 28 Jan 2026 05:24:13 +0000
Safeguarding the Backbone of the Global Economy: OT/ICS Security in the Oil and Gas Industry
The oil and gas industry is an essential pillar of the global economy, enabling energy production, transportation, and storage that fuel every aspect of modern life. At the core of these operations lie Operational Technology (OT) and Industrial Control Systems (ICS), critical systems responsible for monitoring and controlling key industrial processes...
More details.
Posted on Sun, 12 Jan 2025 09:37:30 +0000
Detailed Guide to SOAR and SIEM
What Is SOAR? SOAR stands for Security Orchestration, Automation, and Response. It’s a cybersecurity tool designed to simplify and enhance the efficiency of IT teams by automating responses to various security threats...
More details.
Posted on Sun, 12 Jan 2025 09:20:49 +0000
What is a cyberattack?
What is a cyberattack? Cyberattacks aim to damage or gain control or access to important documents and systems within a business or personal computer network. Cyberattacks are distributed by individuals or organizations for political, criminal, or personal intentions to destroy or gain access to classified information...
More details.
Posted on Wed, 30 Oct 2024 04:02:41 +0000
What is SIEM ?
Security information and event management, SIEM for short, is a solution that helps organizations detect, analyze, and respond to security threats before they harm business operations. SIEM, pronounced “sim,” combines both security information management (SIM) and security event management (SEM) into one security management system...
More details.
Posted on Tue, 29 Oct 2024 08:06:47 +0000
Cyber Security Operation Center Guidelines for best practices SOC Design
Cyber Security is become most needed services for all business and industries in 2024. Every business is concerned about Cyber Security. Security operations (SecOps) leaders face a multifaceted challenge:...
More details.
Posted on Tue, 30 Jan 2024 16:32:57 +0000
HOW TO BECOME CERTIFIED LEAD IMPLEMENTER – ISO 27001
ABOUT CERTIFIED LEAD IMPLEMENTER TRAINING AND EXAMINATION FOR INFORMATION SECURITY MANAGEMENT SYSTEM ISO / IEC 27001 Learn and get certified as a professional in implementation of ISO 27001 standard through our self-paced E-learning interactive course which comprises of 4 modules...
More details.
Posted on Thu, 26 Jan 2023 11:21:59 +0000
YouTube disrupted in Pakistan as former PM Imran Khan streams speech
NetBlocks metrics confirm the disruption of YouTube on multiple internet providers in Pakistan on Sunday 21 August 2022. The disruption comes as former Prime Minister Imran Khan makes a live broadcast to the public, despite a ban issued by the Pakistan Electronic Media Regulatory Authority (PEMRA)...
More details.
Posted on Mon, 22 Aug 2022 05:04:16 +0000
Recommendations for Parents about Cyber Bullying
Here are some dedicated tips for keeping younger children safe online. One of these training tips goes into the risks of young children on the Internet, covers cyber bullying and other risky Internet behavior...
More details.
Posted on Wed, 20 Oct 2021 06:36:27 +0000
Cybersecurity Professional Standards
Discover how unified cybersecurity professional standards and the UK Cyber Security Council are redefining trust, talent, and resilience in finance.
More details.
Posted on Tue, 29 Jul 2025 11:41:52 +0000
TLPT: Threat Led Penetration Testing Explained
Discover how TLPT (threat led penetration testing) helps organizations validate defenses against real-world cyber threats. Learn who needs threat led pentesting, what drives demand, and how it differs from red teaming and classic pentesting...
More details.
Posted on Fri, 20 Jun 2025 08:00:00 +0000
EUVD Vulnerability Database: Europe’s Answer to CVE Instability
The EUVD marks a strategic shift in vulnerability management, offering a transparent and sovereign alternative to the U.S.-centric CVE system—backed by EU law.
More details.
Posted on Wed, 14 May 2025 09:11:06 +0000
Cyber Incident Response Tips for Small Businesses
Learn how small businesses can build cyber incident response plans by adapting practical strategies from the UK’s “Cyber Incident Grab Bag.”
More details.
Posted on Sat, 03 May 2025 14:06:58 +0000
CVE Under Threat: What You Need to Know
MITRE’s CVE contract expired on April 16, putting global vulnerability tracking at risk. Learn what’s happening and how the security community is responding.
More details.
Posted on Wed, 16 Apr 2025 15:01:36 +0000
Unforgivable Software Vulnerabilities
Some software vulnerabilities are unforgivable—easy to find, easy to fix, and never should’ve existed. Here’s how to spot and prevent them.
More details.
Posted on Fri, 04 Apr 2025 14:27:14 +0000
Preventing Crypto Exchange Hacks: Lessons from Bybit Heist
Bybit lost $1.4B in a North Korean hack via malware, fake UI, and blind signing. Learn key security strategies to protect exchanges from cyber threats!
More details.
Posted on Wed, 26 Feb 2025 09:27:46 +0000
Cyber Defense Using Cyber Kill Chain and MITRE ATT&CK Explained
Learn how the Cyber Kill Chain and MITRE ATT&CK Framework enhance security by identifying, detecting, and responding to cyber threats effectively.
More details.
Posted on Thu, 06 Feb 2025 13:41:48 +0000
The Future of Authentication: Passkeys vs Passwords and 2FA
Passkeys replace passwords with secure, easy logins using biometrics and cryptography, eliminating phishing, breaches, and 2FA issues.
More details.
Posted on Wed, 22 Jan 2025 09:22:47 +0000
Lessons from 2024’s Worst Cyberattacks and How to Stay Secure
Analyzing 2024’s biggest cyberattacks: breaches, vulnerabilities exploited, and actionable steps to strengthen defenses for 2025.
More details.
Posted on Mon, 13 Jan 2025 21:47:29 +0000
What we do and what we offer.
About penetration tests and about our news.
