access ai android api apple attack authentication backdoor breach business ceo china cisa cisco ciso cloud compliance control credentials crypto cve cyber cyberattack cybercrime cybersecurity data data-breach defense detection email exploit finance flaw framework fraud google governance government group hacker hacking healthcare identity infrastructure injection intelligence Internet jobs law leak linux malicious malware microsoft monitoring network open-source password phishing privacy ransomware remote-code-execution resilience risk russia scam service software strategy supply-chain technology theft threat tool unclassified update usa vulnerability windows zero-day
-
Inaudible sounds used to fingerprint browsers catch AliExpress red-handed
Tags: unclassifiedIs the technique outdated? Yes. Is it still creepy? Also yes. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/08/aliexpress-caught-fingerprinting-visitors-after-sending-inaudible-sounds-to-browsers/ also interesting: Famous YouTube Channels Hacked to Distribute Infostealers NinjaOne und SentinelOne – Effiziente IT-Sicherheit durch smarte Integration Mozilla investing in Everything.me: Mozilla has announced it is investing in Everything.me, a company that makes… Oettinger allegedly…
-
Hackers target WordPress sites in miniOrange auth bypass attacks
Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that can be used to forge SAML responses and log in as administrators. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-target-wordpress-sites-in-miniorange-auth-bypass-attacks/ also interesting: Password managers under increasing threat as infostealers triple and adapt Cybersecurity…
-
UK power plant shutdown highlights CNI cyber challenges
An alleged Iranian attack on a small reserve ‘peaker’ power plant went largely unnoticed despite causing four days of downtime. Cyber experts say the incident raises serious questions about CNI resilience. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366649386/UK-power-plant-shutdown-highlights-CNI-cyber-challenges also interesting: Iran and China-linked actors used ChatGPT for preparing attacks Fake Job Offers Used to…
-
Thousands of Leaked AWS Access Keys Are Still Active
Truffle Security found 9,308 leaked AWS keys still active, including 768 corporate credentials with full administrative control of cloud accounts. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-leaked-aws-access-keys-still-active/ also interesting: Top 12 ways hackers broke into your systems in 2024 Business continuity and cybersecurity: Two sides of the same coin Hardening browser security with zero-trust…
-
CISA Orders Civilian Agencies to Patch Exploited TrueConf Server Flaws
CISA ordered civilian agencies to patch two exploited TrueConf Server flaws used to compromise systems and distribute trojanized client installers. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/cybersecurity/news-cisa-trueconf-server-flaws-patch-order/ also interesting: CISA Flags Critical Palo Alto Network Flaws Actively Exploited in the Wild U.S. CISA adds a flaw in Microsoft Windows to its Known Exploited Vulnerabilities…
-
After Mythos: When the Attacker Doesn’t Need to Log In
AI Agents Are Rewriting Attack Economics, CISO Risk and Enterprise Defense For years, the attacker’s problem was access. Steal a credential, find an open port and wait. Today, increasingly, the attacker’s problem is simply asking an AI model the right question. That change was the real topic at a recent roundtable of CISOs and Microsoft…
-
After Mythos: When the Attacker Doesn’t Need to Log In
AI Agents Are Rewriting Attack Economics, CISO Risk and Enterprise Defense For years, the attacker’s problem was access. Steal a credential, find an open port and wait. Today, increasingly, the attacker’s problem is simply asking an AI model the right question. That change was the real topic at a recent roundtable of CISOs and Microsoft…
-
AnMed Confirms Data Theft, Warns Patients of Criminal Scams
Ransomware Gang Gentlemen Says It Stole 6TB of Sensitive Patient Info. Nonprofit health system AnMed has confirmed cybercriminals stole information in a July cyberattack that disrupted its IT environment and patient services for several weeks. The organization is also warning patients not to fall for potential fraud, payment and other scams by criminals. First seen…
-
German Cyber Agency Warns Fingerprints Can Be Spoofed
BSI Says AI, High-Resolution Photos and 3D Printing Increase Biometric Risks. Germany’s cybersecurity agency is warning against relying solely on fingerprint authentication, saying criminals can use high-resolution photos, AI and 3D printing to create synthetic fingerprints capable of spoofing some biometric systems. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/german-cyber-agency-warns-fingerprints-be-spoofed-a-32643 also interesting: Cybersecurity Snapshot: AI…
-
Bipartisan Senate bill aims to prepare energy sector for Q-Day
Under the bill, FERC would consider cyber threats from quantum computers and post-quantum cryptography in its reliability standards for the energy sector. First seen on cyberscoop.com Jump to article: cyberscoop.com/quantum-guard-act-electric-grid-cybersecurity/ also interesting: The most notorious and damaging ransomware of all time Cybersecurity Snapshot: Tenable Highlights Risks of AI Use in the Cloud, as UK’s NCSC…
-
Treasury sanctions alleged Iranian hackers as part of ‘economic D-Day’
It’s a follow-up to an indictment the Justice Department unsealed last week against people affiliated with the Mabna Institute. First seen on cyberscoop.com Jump to article: cyberscoop.com/us-treasury-sanctions-iranian-hackers-economic-dday/ also interesting: Iran-Backed Hackers Blast Out Threatening Texts to Israelis Top 12 ways hackers broke into your systems in 2024 Iran’s MuddyWater Hackers Target US Firms with New…
-
Indian man who fled US arrested on charges he helped scammers siphon $7.5 million from the elderly
A Jersey City resident is facing charges for his alleged role as a money mule for overseas cyberscammers who stole millions from elderly New Yorkers. First seen on therecord.media Jump to article: therecord.media/cyber-scam-indian-arrested also interesting: Microsoft India’s X account hijacked in Roaring Kitty crypto scam Indian authorities seize loot from collapsed BitConnect crypto scam Google…
-
AliExpress caught fingerprinting visitors after sending inaudible sounds to browsers
Tags: unclassifiedIs the technique outdated? Yes. Is it still creepy? Also yes. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/08/aliexpress-caught-fingerprinting-visitors-after-sending-inaudible-sounds-to-browsers/ also interesting: Der Nachfolger für SHA-2 Forschungsprojekt: Spionage-App fotografiert Büro-Panoramen… Webinar: How to build relationships with developers Interne Kommunikation: Wer die US-Wahlkampfteams gehackt hat
-
BSidesCharm 2026 You Can’t Migrate What You Can’t See: Discovering Real Post-Quantum Crypto
Tags: cryptoPresenters: Joseph N Wilson, Anurag Swarnim Yadav Our thanks to BSidesCharm for publishing their Creators, Authors and Presenter’s outstanding BSidesCharm 2026 content on the Organizations’ YouTube Channel. Permalink First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/bsidescharm-2026-you-cant-migrate-what-you-cant-see-discovering-real-post-quantum-crypto/ also interesting: SEC reports drop in enforcement actions for 2024 FY >>Aggressive Inventory Zombies<<: Unmasking a Massive Phishing and…
-
Cybercriminals Turn GTA VI Leaks Into Malware Bait
A fake 113GB GTA VI build is packed with malware, using massive empty files to hide a tiny malicious payload. GTA VI hype has reached the point where people are volunteering to infect their own computers just to check if a leak is real. Someone on X asked their followers to >>take one for the…
-
TikTok reaches $400M settlement with US over COPPA violations
Tags: privacyThe U.S. Department of Justice announced a $400 million settlement with TikTok, ByteDance, and affiliated companies over allegations that they violated the Children’s Online Privacy Protection Act (COPPA). First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/legal/tiktok-reaches-400m-settlement-with-us-over-coppa-violations/ also interesting: South Korea Keeps DeepSeek AI Chatbot Off App Stores Tenable Cloud Vulnerability Management: Reducing Vulnerability Risk in…
-
Fake GTA 6 Extended Look and demo sites deliver an infostealer
Bogus “Play Now” sites are exploiting the GTA 6 leak hype to spread malware that steals passwords stored in browsers. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/fake-gta-6-extended-look-and-demo-sites-deliver-an-infostealer/ also interesting: Top 7 zero-day exploitation trends of 2024 Privacy Roundup: Week 9 of Year 2025 Privacy Roundup: Week 12 of Year 2025 6 rising malware trends…
-
Randall Munroe’s XKCD ‘Airport Meeting’
via the comic artistry and dry wit of Randall Munroe, creator of XKCD Permalink First seen on securityboulevard.com Jump to article: https://securityboulevard.com/2026/08/randall-munroes-xkcd-airport-meeting/ also interesting: 11 hottest IT security certs for higher pay today CISA releases Thorium, an open-source, scalable platform for malware analysis Introducing MAESTRO: A framework for securing generative and agentic AI Top 10…
-
The Vulnerability Gap: Why Discovery Is Outrunning Repair
AI is discovering more vulnerabilities, faster, and under a tightening regulatory environment, making this an all-hands-on-deck moment for the cybersecurity community. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/vulnerability-gap-why-discovery-is-outrunning-repair also interesting: The highest-paying jobs in cybersecurity today Old threats, new consequences: 90% of cyber claims stem from email and remote access HackerOne Adds AI Agent…
-
ChatGPT for Teens Adds New Safeguards, but Safety Gaps Remain
ChatGPT for Teens adds stronger protections for users ages 13 to 17, but parents still face limits around monitoring, age prediction, and AI safety. The post ChatGPT for Teens Adds New Safeguards, but Safety Gaps Remain appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-chatgpt-teens-safety-gaps/ also interesting: Black Hat SEO Poisoning Search…
-
Microsoft Exchange Server SE CU1 Delayed Amid AI-Assisted Security Reviews
Microsoft has yet to set a firm Exchange Server SE CU1 release date as engineers work through AI-assisted security findings and ongoing patch releases. The post Microsoft Exchange Server SE CU1 Delayed Amid AI-Assisted Security Reviews appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-exchange-server-se-cu1-delay/ also interesting: Privacy Roundup: Week 3 of…
-
Top 10 Cybersecurity Companies in 2026
Compare the top cybersecurity companies in 2026, including Cisco, CrowdStrike, Bitdefender, Semperis, and more, to find the right security vendor. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/cybersecurity/top-cybersecurity-companies/ also interesting: 7 key trends defining the cybersecurity market today 6 hot cybersecurity trends Wie CISOs vom ERP-Leid profitieren A new approach for GenAI risk protection
-
What a Cloud DDoS Simulation Actually Validates
A DDoS cloud simulation is a controlled, authorized exercise, not an attempt to overwhelm the cloud provider’s global infrastructure. If you run AWS Shield Advanced or Azure DDoS Network Protection, the practical question is whether that protection performs as expected inside your architecture, against the attack vectors that could realistically reach it. This article covers……
-
How to Run a Recurring DDoS Testing Program
A practical guide to setting the cadence, onboarding the SOC, closing findings, and working with your testing vendor between engagements Running DDoS testing as a recurring program means linking every planned simulation to remediation, retesting, SOC training, and the next material change in the environment. Unlike a one-off project, it does not end when the……
-
How to Run an Authorized DDoS Test in AWS and Azure
An authorized DDoS test in AWS or Azure begins by confirming that you own the target, that the relevant DDoS protection service covers it, and that an approved partner will conduct the simulation within the provider’s policy. Under those conditions, separate prior approval is generally not required from AWS or Microsoft. AWS does require an……
-
DDoS Testing Tools: How to Choose a Test That Proves Your Defenses Work
A practical guide for security teams comparing free tools, self-service platforms, and expert-led testing DDoS testing tools range from free traffic generators to self-service platforms and expert-led simulations. The right choice is not the tool that can simulate DDoS attack traffic at the highest volume, but the one that produces credible evidence about the risks……
-
3-Legged OAuth (3LO) Explained: How the OAuth Flow Works
11 min readOAuth, and more specifically OAuth 2.0, is the de facto standard for application authorization. With this framework, you can define a flow to grant access to protected resources. More recently, OAuth 2.1 consolidated the standard by defining security best practices such as Proof Key for Code Exchange (PKCE) and exact URI matching. This…
-
Why Your Engineering Team Secretly Hates Your AI Initiative (And How to Fix It)
Engineering teams resist AI initiatives over career anxiety and loss of control, not technical doubts. What actually worked leading teams through this at LoginRadius and GrackerAI. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/why-your-engineering-team-secretly-hates-your-ai-initiative-and-how-to-fix-it/ also interesting: Can AI be Meaningfully Regulated, or is Regulation a Deceitful Fudge? Windows 11 to Deprecate NTLM, Add AI-Powered App…
-
âš¡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
A package gets installed. A login prompt opens. A box sits exposed to the internet. Nothing looks unusual yet.That’s roughly the mood this week. Trusted tools turn hostile, old weak spots get fresh attention, AI makes exploit work cheaper, and researchers keep finding attacks that sound harder than they actually are.Plenty to clean up. Here’s…
-
New Guidance Helps Businesses Verify Quantum-Safe Hardware Claims
Tags: HardwareTCG has released new guidance to help proving that trusted platform modules genuinely meet essential quantum-safe requirements First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/guidance-verify-quantum-safe/ also interesting: Zyxel won’t patch endlife routers against zero-day attacks Phishing-Resistant MFA: Why FIDO is Essential The age of infostealers is here. Is your financial service secure? Quantum Breakthroughs Compress…
-
Tricky ‘SynkLoader’ Multitool May Herald Ransomware
An advanced, multilingual malware family brings back a trick from yesteryear, screen hijacking, for effective password theft, along with a slew of novel features. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/tricky-synkloader-multitool-ransomware also interesting: Ransomware access playbook: What Black Basta’s leaked logs reveal Steaelite RAT combines data theft and ransomware management capability in one tool…
-
What the latest UAE cyber attacks reveal about threats to critical sectors
ThreatLocker CEO Danny Jenkins explains why aviation, energy and education organisations remain attractive targets, and why prevention should take precedence over detection First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366649634/What-the-latest-UAE-cyber-attacks-reveal-about-threats-to-critical-sectors also interesting: Rising attack exposure, threat sophistication spur interest in detection engineering 5 ways CISOs are experimenting with AI 13 cyber questions to better vet…
-
Australian Regs Make Scam Victims Prove Lapses by Banks
Fraud Expert Ken Palla on Why It’s So Hard to Show a Bank’s Controls Have Failed. Australia ties scam reimbursement to whether banks, telecoms and digital platforms have met their obligations for anti-fraud controls. Fraud expert Ken Palla says many of the roughly 30 required controls are hard to define, making compliance and victim reimbursement…
-
Australian Regs Make Scam Victims Prove Lapses by Banks
Fraud Expert Ken Palla on Why It’s So Hard to Show a Bank’s Controls Have Failed. Australia ties scam reimbursement to whether banks, telecoms and digital platforms have met their obligations for anti-fraud controls. Fraud expert Ken Palla says many of the roughly 30 required controls are hard to define, making compliance and victim reimbursement…
-
UK power facility disabled for days after suspected state-linked cyberattack
The disruption took place amid a wave of attacks targeting vulnerable industrial devices in the water and energy sectors. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/uk-power-facility-disabled-Iran-cyberattack/828599/ also interesting: Rhode Island suffers major cyberattack, exposing personal data of thousands When Good Tools Go Bad: Dual-Use in Cybersecurity ‘Patching Is Not Enough’ With Microsoft SharePoint Server…
-
ToxicPanda 2.0 can take over your Android phone and banking apps
A new version of the Android banking Trojan can seize control of infected phones and block access to Google Play and Google Play Services. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/toxicpanda-2-0-can-take-over-your-android-phone-and-banking-apps/ also interesting: The most notorious and damaging ransomware of all time TDL003 – Breaking Barriers: IPv6 Adoption and DNS Transformation with Tommy Jensen…
-
What happens to your data when you die? (Lock and Code S07E17)
Tags: dataThis week on the Lock and Code podcast, we speak with Tamara Kneese about the many ways your data remains long after your die. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/what-happens-to-your-data-when-you-die-lock-and-code-s07e17/ also interesting: 10 Teachings for Indian Companies Post the Alleged boAt Data Breach MITRE Launches AI Incident Sharing Initiative Intel Broker Claims Cisco…
-
AliExpress caught using silent audio to fingerprint visitors’ browsers
Tags: unclassifiedSilent audio processing on the AliExpress website was found helping to fingerprint visitors’ browsers without relying on cookies. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/aliexpress-caught-using-silent-audio-to-fingerprint-visitors-browsers/ also interesting: Malwarebytes Launches Enterprise Edition Authorities Seized Cryptonator Site Charged the Admin Trend Micro kommentiert Takedown von ALPHV/BlackCat Neue Sicherheitsansätze: So wird Bring-your-own-Device sicher
-
Map What Your Agent Can Reach Before It Deletes It FireTail Blog
Tags: access, ai, control, credentials, data, group, intelligence, jobs, leak, risk, threat, tool, vulnerabilityAug 24, 2026 – Ayush Sethi – What your workforce’s AI prompts reveal in aggregate Most AI security controls judge one prompt at a time. We built Topics to read the layer above them, where a workforce’s prompts add up into a pattern that no single message shows.Someone in your legal team pastes a contract…
-
Fake Microsoft security scans trick victims into uninstalling their antivirus
We found fake Microsoft-branded scanners that invent security problems, tell victims to uninstall AV, and then steer them into a refund scam. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/fake-microsoft-security-scans-trick-victims-into-uninstalling-their-antivirus/ also interesting: Privacy Roundup: Week 7 of Year 2025 Getting the Most Value Out of the OSCP: The PEN-200 Course Windows 10/11: Defender mit simplen…
-
Fake Codex Download Uses Google Sites to Deliver macOS Malware
Fake Codex pages used Google Sites, sponsored search and ClickFix to target Mac users First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/fake-codex-download-google-sites/ also interesting: MacOS DigitStealer malware poses as DynamicLake, targets Apple Silicon M2/M3 devices Hackers Are Using Shared AI Chats to Steal Your Passwords and Crypto Google links axios supply chain attack to North…
-
NIST Warns of Unique Security Risks in Multi-Cloud Environments
NIST has set out 23 novel challenges that arise in multi-cloud environments and has encouraged the cyber community to find solutions First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/nist-risks-multi-cloud/ also interesting: Beyond Checkboxes: The Essential Need for Robust API Compliance Cybersecurity Snapshot: CISA’s Best Cyber Advice on Securing Cloud, OT, Apps and More Cybersecurity Snapshot:…
-
ToxicPanda Banking Trojan Matures into Enterprise Threat
The latest version of the Android malware has new features that expand its global reach and put more than users’ financial applications at risk. First seen on darkreading.com Jump to article: www.darkreading.com/mobile-security/toxicpanda-banking-trojan-matures-enterprise-threat also interesting: >>Crocodilus<< A New Malware Targeting Android Devices for Full Takeover Anatsa Malware Escalates: Android Under Siege as Hackers Harvest Credentials and…
-
US Charges 17 Iranian Hackers Over Theft of 31.5TB of Academic Data
US prosecutors charge 17 Iranians hackers over an alleged campaign that stole 31.5TB of research and targeted universities, companies and government agencies worldwide. First seen on hackread.com Jump to article: hackread.com/us-charges-iranian-hackers-theft-31b-academic-data/ also interesting: The 2024 cyberwar playbook: Tricks used by nation-state actors Top 12 ways hackers broke into your systems in 2024 Top 10 Cybersecurity…
-
Airlock Digital Completes Independent IRAP Assessment at the PROTECTED Level
Independent assessment provides Australian organisations with additional evidence when evaluating application control for sensitive, government, defence and critical infrastructure environments. First seen on hackread.com Jump to article: hackread.com/airlock-digital-completes-independent-irap-assessment/ also interesting: Cybersecurity Snapshot: Security Lags Cloud and AI Adoption, Tenable Report Finds, as CISA Lays Out Vision for CVE Program’s Future Okta introduces Identity Security Fabric…
-
Google Tests Built-In Opt-Out in Chrome for Data Sharing and Sales
Google is testing Global Privacy Control in Chrome Canary, letting users ask websites not to sell or share their data or use it for targeted advertising online. First seen on hackread.com Jump to article: hackread.com/google-tests-opt-out-chrome-data-sharing-sales/ also interesting: TDL003 – Breaking Barriers: IPv6 Adoption and DNS Transformation with Tommy Jensen Google to Purge Billions of Files…
-
Hacker Leaks 1,033 Stripe Merchant API Keys and 688K Customer Records
A 33GB database linked to 669 Stripe merchants has appeared on PwnForums, containing customer data, live-mode API keys, invoices, and payment records worldwide. First seen on hackread.com Jump to article: hackread.com/hacker-leak-stripe-merchant-api-keys-customer-records/ also interesting: HPE’s sensitive data exposed in alleged IntelBroker hack Privacy Roundup: Week 11 of Year 2025 IDOR Attacks and the Growing Threat to…
-
Cybersecurity Hiring Has Gone Global: Why U.S. Companies Are Looking Beyond the Domestic Talent Pool
Cybersecurity hiring is moving beyond US borders, as employers seek qualified specialists worldwide to fill persistent skills gaps and protect critical systems. First seen on hackread.com Jump to article: hackread.com/cybersecurity-hiring-us-companies-domestic-talent-pool/ also interesting: Tips for a successful cybersecurity job interview 6 hard truths security pros must learn to live with The highest-paying jobs in cybersecurity today…